NetClaw: Structural Fingerprinting Reveals Domain Signatures Across Real-World Networks

Introduction

Different types of real-world networks, from collaboration graphs among scientists to the hyperlink structure of the web, arise from distinct generative processes. These processes leave structural imprints that can, in principle, be detected from topology alone, without any knowledge of node semantics or edge labels. A practical reference that maps measurable topological features to network domains would help researchers select appropriate models, set simulation parameters, and flag anomalous graphs.

This work constructs such a reference by computing $15$ structural metrics on $n = 20$ networks drawn from $6$ domains in the Stanford Large Network Dataset Collection (SNAP). The metrics span scale (node and edge counts), connectivity (degree statistics, density), local structure (clustering, transitivity), global geometry (shortest paths, diameter), mixing patterns (assortativity), community organization (modularity), and heavy-tail behavior (power-law exponent and cutoff). The analysis then asks two questions. First, which of these metrics differ significantly across domains? Second, can a classifier recover a network's domain from its structural fingerprint?

The pipeline is deterministic, fully automated, and runs inside a single Docker container with pinned dependencies. All random seeds are fixed at $42$. The remainder of the paper describes the data and methods (Section 2), presents statistical and classification results (Section 3), interprets the findings (Section 4), states limitations (Section 5), and concludes (Section 6).

Methods

Data Collection

Twenty undirected networks were downloaded from SNAP (snap.stanford.edu) using Python's urllib.request module. The networks span six domains: collaboration ($4$ networks: ca-CondMat, ca-GrQc, ca-HepPh, ca-HepTh), communication ($2$: email-Enron, email-Eu-core), infrastructure ($3$: as-caida20071105, as-skitter, oregon1_010331), peer-to-peer ($4$: p2p-Gnutella05, p2p-Gnutella06, p2p-Gnutella08, p2p-Gnutella09), social ($4$: facebook_combined, soc-Epinions1, soc-sign-bitcoinotc, wiki-Vote), and web ($3$: web-BerkStan, web-NotreDame, web-Stanford). Domain sizes range from $2$ (communication) to $4$ (collaboration, peer-to-peer, social). All directed edges were converted to undirected edges. Self-loops were removed. No additional filtering was applied.

Network sizes range from $986$ nodes and $16{,}064$ edges (email-Eu-core) to $325{,}729$ nodes and $1{,}941{,}926$ edges (web-Stanford). The full inventory of node and edge counts appears in Table 1 (results/metrics.csv).

Feature Extraction

Fifteen topological metrics were computed for each network using NetworkX 3.4.2, python-louvain 0.16, and the powerlaw 1.5 package:

1. Scale metrics ($4$): num_nodes, num_edges, density, avg_degree.
2. Local structure ($2$): avg_clustering (mean of local clustering coefficients), transitivity (global clustering coefficient, ratio of triangles to connected triples).
3. Global geometry ($3$): avg_shortest_path_sample (mean shortest path length on a sample of $500$ node pairs from the largest connected component), diameter_sample (maximum observed shortest path in the same sample), max_degree.
4. Mixing and community ($3$): assortativity (degree-degree Pearson correlation), modularity (Louvain algorithm, resolution $= 1.0$), num_components and largest_component_fraction.
5. Heavy-tail behavior ($2$): powerlaw_alpha (power-law exponent from maximum-likelihood fitting) and powerlaw_xmin (lower bound of the power-law region).

Two metrics, num_components and largest_component_fraction, were constant across all $20$ networks (every network had $1$ component with fraction $1.0$) and were therefore excluded from statistical testing. One network (web-Stanford) returned missing values for avg_clustering and transitivity due to computational cost on its $255{,}265$ nodes. Similarly, three web networks lacked modularity values. These missing entries are noted but do not affect the remaining $17$ networks for clustering/transitivity or the $17$ networks with modularity scores.

All computations used NumPy 2.2.3, SciPy 1.15.2, pandas 2.2.3, and matplotlib 3.10.1 for visualization.

Statistical Testing

For each of the $13$ testable metrics, a Kruskal-Wallis H test (scipy.stats.kruskal) assessed whether the metric distributions differed across the $6$ domains. The Kruskal-Wallis test was chosen because several metrics violate normality assumptions required by one-way ANOVA, and the sample sizes per domain are small ($2$ to $4$). The significance threshold was set at $\alpha = 0.05$.

For metrics where the Kruskal-Wallis test reached significance, Dunn's post-hoc pairwise comparisons (scikit-posthocs 0.11.0) were performed with Bonferroni correction for multiple comparisons. Bootstrap $95$ confidence intervals ($10{,}000$ resamples) were computed for each domain mean.

No correction was applied across the $13$ independent Kruskal-Wallis tests. A Bonferroni correction at the family level would set $\alpha_{\text{adj}} = 0.05 / 13 = 0.0038$; under that threshold, only max_degree ($p = 0.0061$) would approach but not reach significance. The uncorrected results are reported as the primary analysis, with this caveat noted.

Classification

A Random Forest classifier (scikit-learn 1.6.1, $100$ trees, random_state $= 42$, n_jobs $= 1$) was trained to predict domain labels from the $15$-metric feature vector. Because the dataset contains only $n = 20$ samples across $6$ classes, leave-one-out cross-validation (LOO-CV) was used to maximize training data per fold. Gini-based feature importances were extracted from the full model trained on all $20$ samples.

UMAP (umap-learn 0.5.7, n_neighbors $= 5$, min_dist $= 0.3$, random_state $= 42$, metric $=$ euclidean) was applied to the standardized $15$-metric matrix for two-dimensional visualization of domain separation.

Reproducibility

All random seeds were set to $42$ (numpy.random.seed, random.seed, and the random_state parameter on every scikit-learn estimator and UMAP). Louvain community detection used random_state $= 42$. The pipeline ran n_jobs $= 1$ for deterministic thread ordering. Figure DPI was fixed at $150$. All iterations over sets or dictionaries used sorted keys. The execution environment was a Docker container built from python:3.11-slim with dependencies pinned in requirements.txt (exact versions listed above). Input data integrity can be verified by re-downloading from the same SNAP URLs and comparing file checksums.

Results

All results reported in this section are deterministic and fully reproducible. The complete numerical outputs are stored in results/metrics.csv, results/statistical_tests.json, and results/classification_results.json.

Descriptive Statistics

The $20$ networks span four orders of magnitude in node count, from $n = 986$ (email-Eu-core) to $n = 325{,}729$ (web-Stanford), and in edge count, from $m = 13{,}422$ (ca-GrQc) to $m = 1{,}941{,}926$ (web-Stanford). Density ranges from $9.0 \times 10^{-6}$ (as-skitter) to $0.033$ (email-Eu-core). Average degree varies from $2.66$ (as-skitter) to $43.69$ (facebook_combined).

Statistical Tests

Of $13$ metrics tested with the Kruskal-Wallis H test, $7$ reached significance at $\alpha = 0.05$:

Six metrics did not reach significance: density ($H = 10.707$, $p = 0.0575$), modularity ($H = 9.132$, $p = 0.0579$), num_nodes ($H = 9.626$, $p = 0.0865$), num_edges ($H = 7.790$, $p = 0.1682$), powerlaw_alpha ($H = 6.038$, $p = 0.3025$), and powerlaw_xmin ($H = 3.946$, $p = 0.5572$). Two metrics (num_components, largest_component_fraction) were constant across all networks and could not be tested.

Post-Hoc Pairwise Comparisons

Dunn's test with Bonferroni correction identified the following pairwise differences at $p < 0.05$:

• assortativity: collaboration vs. infrastructure ($p = 0.009$). Collaboration networks show strong positive assortativity (mean $= 0.408$, 95% CI $[0.182, 0.634]$), while infrastructure networks are disassortative (mean $= -0.162$, 95% CI $[-0.195, -0.106]$).
• max_degree: collaboration vs. web ($p = 0.024$) and peer-to-peer vs. web ($p = 0.020$). Web networks have the highest mean max_degree ($18{,}231$), driven by web-Stanford's hub with degree $38{,}625$. Collaboration and peer-to-peer networks have much lower hub sizes (means $229$ and $101$, respectively).
• avg_clustering: collaboration vs. peer-to-peer ($p = 0.013$). Collaboration networks exhibit high clustering (mean $= 0.576$, 95% CI $[0.517, 0.632]$), consistent with triangle-rich co-authorship structures. Peer-to-peer networks show near-zero clustering (mean $= 0.009$, 95% CI $[0.007, 0.010]$).
• transitivity: collaboration vs. infrastructure ($p = 0.027$). Collaboration mean transitivity is $0.458$ versus $0.006$ for infrastructure.
• avg_shortest_path_sample: social vs. web ($p = 0.033$). Social networks have shorter average paths (mean $= 3.73$) compared to web graphs (mean $= 8.19$).
• avg_degree: infrastructure vs. social ($p = 0.048$). Social networks average $22.55$ connections per node versus $3.61$ for infrastructure.

Domain Profiles

The significant metrics define characteristic profiles for each domain:

• Collaboration: high assortativity ($0.408$), high clustering ($0.576$), high transitivity ($0.458$), high modularity ($0.746$). These reflect the tightly-knit community structure of co-authorship networks.
• Peer-to-peer: near-zero clustering ($0.009$), low transitivity ($0.013$), moderate degree ($6.86$), positive but small assortativity ($0.034$). Consistent with the flat, random-like overlay topology of file-sharing protocols.
• Infrastructure: negative assortativity ($-0.162$), low clustering ($0.170$), very low transitivity ($0.006$), low average degree ($3.61$). Autonomous system graphs exhibit hub-and-spoke connectivity where high-degree nodes connect preferentially to low-degree peers.
• Web: highest max_degree ($18{,}231$), longest paths ($8.19$), largest diameters ($24.67$), negative assortativity ($-0.087$). Web graphs contain extreme hubs (portal pages) and long chains of navigational depth.
• Social: moderate values across most metrics, highest average degree ($22.55$), short paths ($3.73$). The heterogeneity within this category (Facebook ego-network, Epinions trust network, Bitcoin OTC, Wikipedia votes) leads to high variance.
• Communication: moderate clustering ($0.458$), moderate density ($0.017$). With only $n = 2$ networks, domain estimates are unreliable.

Classification

The Random Forest LOO-CV classifier achieved an overall accuracy of $65$ ($13$ of $20$ networks correctly classified). Per-domain results:

Macro-average precision was $0.522$, recall $0.597$, and F1 $0.553$. Weighted-average F1 was $0.606$.

Collaboration ($4/4$) and peer-to-peer ($4/4$) networks were perfectly classified, reflecting their distinct structural signatures (high clustering vs. near-zero clustering, positive assortativity vs. neutral). Communication networks ($0/2$) were entirely misclassified as social, likely because both email networks share similar degree distributions and clustering coefficients with social graphs. Social networks ($1/4$) scattered across collaboration, infrastructure, and web predictions, consistent with the structural heterogeneity within this broad category.

The top-$5$ features by Gini importance were max_degree ($0.133$), assortativity ($0.104$), avg_clustering ($0.104$), diameter_sample ($0.099$), and avg_shortest_path_sample ($0.079$). These align with the metrics that showed the strongest Kruskal-Wallis effects. Two features, num_components and largest_component_fraction, contributed zero importance, consistent with their constant values.

UMAP Visualization

Figure 1 (figures/taxonomy_umap.png) shows the $20$ networks projected into two dimensions from the $15$-metric feature space. Peer-to-peer networks form a tight cluster in the upper-left region. Collaboration networks group in the center-left. Web and infrastructure networks occupy the right side of the plot but overlap with each other. Social and communication networks are dispersed, with communication networks positioned near social networks, consistent with the classifier's confusion between these two domains.

Figure 2 (figures/domain_boxplots.png) displays boxplots for the top-$5$ discriminative metrics by domain. Collaboration networks visibly separate from other domains on assortativity and avg_clustering. Peer-to-peer networks separate on avg_clustering (near zero). Web networks separate on diameter_sample (highest median and widest range).

Figure 3 (figures/confusion_heatmap.png) confirms the per-domain classification patterns: solid diagonal entries for collaboration and peer-to-peer, and off-diagonal spread for social and communication.

Figure 4 (figures/feature_importance.png) shows the ranked Gini importances, with max_degree, assortativity, and avg_clustering as the three most informative features.

Discussion

The results show that topological metrics can partially distinguish network domains, with $7$ of $13$ tested metrics differing significantly across $6$ SNAP domains. The strongest separations involve clustering-related metrics (avg_clustering, transitivity) and degree mixing (assortativity, max_degree), rather than scale metrics (node count, edge count) or heavy-tail parameters (power-law exponent).

This pattern is consistent with the idea that generative mechanisms, not network size, drive structural signatures. Co-authorship networks produce triangles (shared collaborators), yielding high clustering and positive assortativity. Autonomous system graphs grow by preferential attachment with hierarchical tiering, producing disassortative hubs. Peer-to-peer overlays use randomized or flooding-based neighbor selection, which suppresses triangle formation. Web graphs accumulate extreme hubs (portal pages) while maintaining long navigational chains, producing high max_degree and large diameter.

The $65$ LOO-CV accuracy should be interpreted in context. With $n = 20$ samples and $6$ classes, a uniform random baseline would achieve approximately $17$ accuracy. The classifier nearly quadruples this baseline, but the small sample size limits statistical confidence. The perfect classification of collaboration and peer-to-peer networks suggests that these domains have strong, internally consistent structural fingerprints. The failure on communication networks (both classified as social) may reflect genuine structural similarity between email and social networks rather than classifier weakness. Both involve directed person-to-person messaging with reciprocity and community structure.

The social domain is the most heterogeneous: it includes a dense Facebook ego-network (avg_degree $= 43.69$, clustering $= 0.606$), a sparse Epinions trust graph (avg_degree $= 10.69$, clustering $= 0.138$), a Bitcoin OTC trust network, and a Wikipedia voting network. These graphs arise from different social processes and produce correspondingly different structural fingerprints. A finer-grained domain taxonomy might separate trust networks from friendship networks, potentially improving both statistical separation and classification.

The Dunn post-hoc results, after Bonferroni correction over $15$ pairwise comparisons per metric, identify $6$ significant pairs across the $7$ significant metrics. The most informative single contrast is collaboration vs. infrastructure on assortativity ($p = 0.009$), reflecting the fundamental difference between assortative mixing in co-authorship and disassortative hub-spoke connectivity in routing infrastructure.

These findings provide a practical lookup table: given a network of unknown origin, computing its clustering coefficient and assortativity narrows the candidate domain. High clustering ($> 0.4$) with positive assortativity ($> 0.2$) suggests a collaboration network. Near-zero clustering ($< 0.02$) with neutral assortativity suggests peer-to-peer. Negative assortativity ($< -0.1$) with low average degree ($< 5$) suggests infrastructure.

Limitations

1. Small and unbalanced sample. The analysis covers only $n = 20$ networks from $6$ domains, with domain sizes ranging from $2$ (communication) to $4$ (collaboration, peer-to-peer, social). The communication domain has only $2$ networks, making any domain-level estimate for communication unreliable. Statistical power is limited: Kruskal-Wallis on groups of size $2$-$4$ can detect only large effects. Classification with LOO-CV on $20$ samples provides point estimates of accuracy but no reliable confidence intervals. Expanding the dataset to $50$+ networks per domain would be necessary for claims about generalizability.

2. Domain taxonomy is coarse. The six domains (collaboration, communication, infrastructure, peer-to-peer, social, web) aggregate structurally diverse networks. The "social" category includes ego-networks, trust graphs, and voting networks. A finer-grained taxonomy might reveal clearer structural boundaries but would require more networks per sub-domain. The current analysis cannot distinguish whether misclassifications reflect genuine structural overlap between domains or artifacts of the coarse labeling.

3. Single random seed. All stochastic operations used random_state $= 42$. While this ensures reproducibility, it captures only one realization of UMAP embeddings, Random Forest bootstraps, and Louvain community assignments. Variance across seeds was not measured. The reported accuracy of $65$ and the UMAP cluster positions may shift with different seeds. A proper evaluation would repeat the pipeline across $10$+ seeds and report mean $\pm$ standard deviation.

4. Missing values for large networks. The web-Stanford network ($255{,}265$ nodes) returned missing values for avg_clustering and transitivity due to computational cost. Three web networks lacked modularity values. These missing entries reduce the effective sample size for affected metrics and may bias domain-level summaries for the web category.

5. No correction for multiple testing across metrics. The $13$ Kruskal-Wallis tests were not corrected for family-wise error. Under a Bonferroni threshold of $\alpha_{\text{adj}} = 0.0038$, none of the $7$ nominally significant results would survive. The reported significance levels should be treated as exploratory, not confirmatory.

6. Metric selection is not exhaustive. The $15$ chosen metrics represent common topological descriptors but omit spectral properties (algebraic connectivity, spectral radius), motif counts, centrality distributions, and rich-club coefficients. Different or additional metrics might yield stronger domain separation.

Conclusion

This work computed $15$ structural metrics on $20$ SNAP networks across $6$ domains and found that $7$ metrics, led by max_degree ($H = 16.28$, $p = 0.0061$), assortativity ($H = 14.91$, $p = 0.0108$), and avg_clustering ($H = 12.77$, $p = 0.0256$), differ significantly across domains at $\alpha = 0.05$. A Random Forest classifier achieved $65$ LOO-CV accuracy ($13/20$), with perfect classification of collaboration and peer-to-peer networks but complete failure on the $2$-network communication domain.

The practical contribution is a reference table mapping topological signatures to network domains. Clustering and assortativity together discriminate collaboration, peer-to-peer, and infrastructure networks. The analysis is incremental but systematic: it applies standard methods to a curated multi-domain sample with full reproducibility. The pipeline is deterministic, containerized, and open. All code, data, and results are available for verification and extension to larger network collections.