## 3 Theoretical Framework and Dataset
### Dataset  
Data from an anonymous email communication system [14; 16; 17] from the Complutense University of Madrid (UCM) were used. These data have been previously processed to eliminate sensitive personal information; thus, only the email headers has been used to record senders' and recipients' addresses. It was decided to use real data instead of a simulation to try to match the characteristics of real-world social networks: There is a significant number of nodes with a lot of connections, and there is a set of nodes with very few connections. Also, social networks do not have a homogeneous distribution of degrees [36; 37]. To our knowledge, the majority of the researchers in this subject have implemented their algorithms on simulated data.  
The dataset includes previously anonymized email addresses, each with a subdomain indicating the school the user belongs to. Only emails sent within the same subdomain were used. Emails sent by a user to themselves and emails sent to a user in a different subdomain were ignored. This approach encapsulates a community of users belonging to a school or department, better representing real-world social network behavior.  
It is important to notice that the dataset used in this research has been used before [14; 16; 17], and in this research we have included 20 schools or departments of different sizes. Each one of these is different since they have different numbers of senders, recipients, and rounds. As shown in Table 1, their characteristics vary according to the size of each school. For example, School 9 has more than 480 senders and recipients, and thus more than 9800 rounds. On the other hand, School 31 has a little bit more than 30 senders and recipients and just 177 rounds. Besides the number of senders and recipients, Table 1 shows the number of rounds used per school and its threshold value \(n\). The data provided by UCM have different thresholds; although the majority of faculties are configured at 10, some others have a higher threshold.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Faculty** & **Sender** & **Recipients** & **Rounds** & **Threshold** \\ \hline Faculty 1 & 101 & 112 & 700 & 10 \\ \hline Faculty 2 & 152 & 173 & 51 & 10 \\ \hline Faculty 3 & 73 & 101 & 1387 & 10 \\ \hline Faculty 5 & 183 & 221 & 2261 & 10 \\ \hline Faculty 7 & 59 & 71 & 554 & 10 \\ \hline Faculty 8 & 37 & 46 & 289 & 10 \\ \hline Faculty 9 & 489 & 482 & 9805 & 10 \\ \hline Faculty 10 & 370 & 396 & 2640 & 10 \\ \hline Faculty 12 & 497 & 486 & 4350 & 12 \\ \hline Faculty 13 & 69 & 62 & 452 & 13 \\ \hline Faculty 14 & 241 & 263 & 85 & 14 \\ \hline Faculty 15 & 264 & 284 & 1621 & 15 \\ \hline Faculty 16 & 257 & 264 & 87 & 16 \\ \hline \hline \end{tabular}
\end{table}
Table 1: Dataset used in this research.  
A timed mixed-network was not employed because the number of message would be variable and the number of senders and receivers may be excessively large [14; 16]. In order to obtain a better classification rate, we found it is better to use a threshold mix. So instead of dividing by time, each dataset is divided by the number of messages stored. For each round, the maximum number of messages stored (or threshold) is set to 10.