SIMPLEX
Make structural change visible
Complex systems reveal themselves through relationships. SIMPLEX measures how those relationships connect, separate, and form loops—turning the structure of your data into evidence you can examine.
DataField Intelligence’s persistent homology engine produces exact, reproducible structural measurements for teams building network analysis, monitoring, and anomaly detection workflows.
Exact computation. Reproducible execution. Traceable results.
The invisible shapes of data
A network can change even when its overall activity looks familiar. Separate groups may become connected. Established relationships may fragment. Patterns of interaction may reorganize.
SIMPLEX gives you a mathematical way to measure that structure across analysis scales. These measurements add another source of evidence alongside the statistics, rules, and models you already use.
Connections
Measure how separate groups join together as the relationship threshold changes. Identify structure that remains distinct across a range of thresholds.
Loops
Identify loops that remain unfilled in the mathematical representation of your data, and measure the range of scales over which they persist.
Change
Compare structural summaries from successive observations to investigate how a system is reorganizing.
From complex relationships to measurable structure
Persistent homology follows features across a sequence of relationship thresholds. It records when connected groups merge and when loops appear and become filled. The result is a compact description of structure across scales, rather than a view tied to one threshold.
SIMPLEX makes those measurements available as structured outputs for analysis, comparison, and integration. Application logic and domain context establish what a structural change means.
Built for results you can inspect
Exact within a defined scope
SIMPLEX computes exact persistent homology for supported metric and weighted-graph workloads. Its focused scope covers connected components and loops, known technically as H0 and H1. The core topological computation follows a defined mathematical procedure and requires no trained model.
Designed for reproducibility
Deterministic execution and explicit configuration support repeatable analysis. Teams can compare runs and examine how changes in inputs or analysis choices affect the result.
Traceable by design
Structured results include persistence intervals, birth/death pairings, simplex identifiers, execution statistics, and provenance metadata. These artifacts help engineers review the computation behind a summary or downstream signal.
Work with your data and analytical pipeline
Supported inputs: Point clouds, dense distance matrices, sparse distance triplets, and weighted undirected graphs.
Core outputs: H0/H1 persistence results and associated computational and provenance records.
Integration approach: A focused runtime and command-line interface for technical evaluation and incorporation into existing analytical workflows. Data preparation translates domain records into the metric or graph representation appropriate to the use case.
Traffic Sentinel
A clearer view of changing network behavior
Traffic Sentinel is DataField’s cybersecurity application of SIMPLEX, under development for investigating structural changes in enterprise internet activity.
It organizes telemetry into relationships among hosts, domains, services, and other network entities. SIMPLEX measures the resulting structure; Traffic Sentinel combines those measurements with cyber context to support investigation.
For security operations teams, the objective is concrete: connect an unusual pattern to the entities and activity that deserve a closer look.
An investigation might ask:
Which hosts are developing unusual relationships with an external destination?
Which traffic relationships account for a structural change?
Does the surrounding evidence suggest suspicious activity, an expected operational event, or a need for further review?
A structural anomaly is evidence to investigate. Its significance depends on the network, the activity, and the supporting context.