How segmented is my network?

Rohit Dube

Home/Archive/arXiv

arXiv · 2602.10125

How segmented is my network?

Rohit Dube

View original source ↗Read source document ↗Export metadata ↓

Abstract

Network segmentation is a popular security practice for limiting lateral movement, yet practitioners lack a metric to measure how segmented a network actually is. We define segmentedness as the fraction of potential node-pair communications disallowed by policy -- equivalently, the complement of graph edge density -- and show it to be the first statistically principled scalar metric for this purpose. Then, we derive a normalized estimator for segmentedness and evaluate its uncertainty using confidence intervals. For a 95\% confidence interval with a margin-of-error of $\pm 0.1$, we show that a minimum of $M=97$ sampled node pairs is sufficient. This result is independent of the total number of nodes in the network, provided that node pairs are sampled uniformly at random. We evaluate the estimator through Monte Carlo simulations on Erdős--Rényi, stochastic block models, and real-world enterprise network datasets, demonstrating accurate estimation. Finally, we discuss applications of the estimator, such as baseline tracking, zero trust assessment, and merger integration.

Explore related subjects

cs.SI cs.NI stat.AP

Keep this discovery

Explore connections, maps & timelines

BibTeX RIS

Rohit Dube. 2026-07-15. How segmented is my network?. https://arxiv.org/abs/2602.10125

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

Two Fault Lines: Latent Polarity Geometry in X Community Notes

Community Notes is X's crowdsourced fact-checking system. A note is published beneath the post it corrects only when raters who usually disagree both rate it helpful, a design called bridging. To apply that rule, the system learns who disagrees with whom from the ratings alone, placing every rater and note on one line, the polarity axis. Every scorer in the production pipeline uses a single axis. Refitting the base model these scorers share on the full public data (212.9M ratings, 2.33M notes, 1.07M raters), we find that one axis is too few. The space is at least two-dimensional. The first axis is left/right politics, while the second, which we interpret as trust in institutions, is largely independent of the first. A held-out test confirms that the second axis improves prediction of unseen ratings, while a third adds little. A second rater dimension learned from one set of topics predicts how raters judge COVID and Ukraine notes excluded from the fit, so it does not merely restate subject matter. Among heavily rated notes that barely divide raters politically, the published share falls from 71.5% to 11.7% as second-axis disagreement grows. A one-axis fit records these notes only as weakly polarised and less helpful; the information that raters at one end of the second axis support them is lost. Authors write notes matching their own position on both axes (r = 0.538 and 0.358), and a small minority of raters cast most ratings (Gini = 0.718). Fewer notes are published in the smallest language communities, but the shortfall is in ratings received, not in how the rule treats them. Keeping ratings per note constant, only Hindi stays below the global rate of 10.85%, and Greek moves from 7.76% to 11.68%. We argue for a bridging model with more than one axis of disagreement, and for recruiting raters in the languages the current design reaches least.

cs.SI↗

arXiv2026

Setting the clock: Evaluating temporal window parameters for coordinated behavior detection

Coordinated behavior is a central mechanism of online collective action. On social media platforms, it can support legitimate mobilization, but it can also be exploited in disinformation campaigns, astroturfing, and information operations. Detecting coordinated behavior on social media platforms typically relies on coordination networks, where users are linked when they perform similar actions within shared temporal windows. While the temporal window is central to how coordination is operationalized, it is often treated as an implementation detail rather than as a substantive modeling decision. This paper presents a first analysis of how two key temporal parameters, window length and stride, affect the detection of coordinated communities within information operation campaigns. We find that window length determines which coordination patterns are detectable, while window stride has negligible effect on precision and recall. Our analysis highlights selecting appropriate temporal window parameters as an open methodological challenge requiring careful treatment.

cs.SI↗

arXiv2026

Auditing bipartite motif interpretations: a worked example with conservation checks and open-path decomposition

Motif profiles of bipartite agent-object networks, such as tourist-site visits and customer-item transactions, are read as evidence about structural roles and about differences between networks, often without asking what the two degree sequences already fix. In a simple bipartite graph the induced k-fan count on one node type is a sum of degree combinations, so it has zero variance under a null that preserves both degree sequences. We apply this known result to a reconstructed tourism rating network of 17 tourists, 80 sites and 637 edges, the sole inferential worked example, and, as a provenance-limited illustration, to published motif-instance aggregates over 36 monthly luxury customer-item networks. The four fan classes are exact functions of the degree sequences: in the tourism network the raw fan counts and the size-3 two-fan ratio (84.7% fan-out) restate those sequences. The published luxury counts require at least 89,502 customer-item edges against 26,451 reported transactions, so their 99.8% fan-in is reported as a descriptive value only. Against a hard bipartite configuration null, the four-cycle count is degree-consistent (z about +1.0) and the open path is deficient (z about -5.8) by 2,243 instances, 2.4% of the null mean; the deficit survives every leave-one-tourist-out re-run (z -4.5 to -8.1). An exact identity splits it at the point estimate into 64.4% mixing and 35.6% four-cycle, but that split is not an attribution: the observed mixing term lies below all 500 null samples, the two components are almost collinear under the null (r = 0.968), and the mixing share ranges from 36.6% to 116.5% under leave-one-tourist-out deletion. The deficit is extreme relative to the sampled null, while its class-level interpretation is undetermined and unstable. We give a four-step pre-interpretation check and a reference implementation.

cs.SI↗