Graph Streams Research Articles

Network mutual information measures for graph similarity

A wide range of tasks in network analysis, such as clustering network populations or identifying anomalies in temporal graph streams, require a measure of the similarity between two graphs. To provide a meaningful data summary for downstream scientific analyses, the graph similarity measures used for these tasks must be principled, interpretable, and capable of distinguishing meaningful overlapping network structure from statistical noise at different scales of interest. Here we derive a family of graph mutual information measures that satisfy these criteria and are constructed using only fundamental information theoretic principles. Our measures capture the information shared among networks according to different encodings of their structural information, with our mesoscale mutual information measure allowing for network comparison under any specified network coarse-graining. We test our measures in a range of applications on real and synthetic network data, finding that they effectively highlight intuitive aspects of network similarity across scales in a variety of systems.

Anomaly Detection over Streaming Graphs with Finger-Based Higher-Order Graph Sketch

A streaming graph is a constantly growing sequence of edges, which forms a dynamic graph that changes with every edge in the stream. An anomalous behavior in a streaming graph can be modeled as an edge or a subgraph that is unusual compared to the rest of the graph. Identifying anomalous behaviors in real time is essential to the early warning of abnormal or notable events. Due to the complexity of the problem, little work has been reported so far to solve the problem. In this paper, we propose Finger-based Higher-order Graph Sketch (FHGS for short), which is an approximate data structure for streaming graphs with linear memory usage, high update speed, and high accuracy and supports both edge and subgraph anomaly detection. FHGS first maps each edge into a matrix based on hash functions, and then counts its frequency in a time window with unique fingerprints for detecting anomalies. Extensive experiments confirm that our approach generate high-quality results compared to baseline methods.

Continual learning with high-order experience replay for dynamic network embedding

Dynamic network embedding (DNE) poses a tough challenge in graph representation learning, especially when confronted with the frequent updates of streaming data. Conventional DNEs primarily resort to parameter updating but perform inadequately on historical networks, resulting in the problem of catastrophic forgetting. To tackle such issues, recent advancements in graph neural networks (GNNs) have explored matrix factorization techniques. However, these approaches encounter difficulties in preserving the global patterns of incremental data. In this paper, we propose CLDNE, a Continual Learning framework specifically designed for Dynamic Network Embedding. At the core of CLDNE lies a streaming graph auto-encoder that effectively captures both global and local patterns of the input graph. To further overcome catastrophic forgetting, CLDNE is equipped with an experience replay buffer and a knowledge distillation module, which preserve high-order historical topology and static historical patterns. We conduct experiments on four dynamic networks using link prediction and node classification tasks to evaluate the effectiveness of CLDNE. The outcomes demonstrate that CLDNE successfully mitigates the catastrophic forgetting problem and reduces training time by 80% without a significant loss in learning new patterns.

SSKG: Subject stream knowledge graph, a new approach for event detection from text

Events play a crucial role in shaping societal meaning and discourse. They are recorded in text data streams from social networks or online sources and analyzing them is vital for predicting and managing future occurrences. Methods for event detection from text data streams have been developed to enhance accuracy and efficiency in analyzing large datasets. This study focuses on events published as text data streams in Telegram. Two main perspectives are considered for better results: firstly, major events can overshadow the detection of smaller ones with fewer narrative instances. Secondly, due to diverse narratives surrounding each event, establishing meaningful connections between narrative sets is essential. In this research, two new concepts, “subject stream” and “stream graph,” are introduced. The subject stream aims to process topics to mitigate the impact of bursty events on detecting others. The stream graph models data stream and identifies various narratives associated with each event for better identification and categorization. Combining these approaches accurately represents events and their characteristics in the real world. Implementing the system in three versions demonstrates the effectiveness of using the “stream graph” alongside the “subject stream,” resulting in improved execution speed and accuracy. Evaluation results show a 6% enhancement in topic recall.

Open-world structured sequence learning via dense target encoding

Structured sequences are popularly used to describe graph data with time-evolving node features and edges. A typical real-world scenario of structured sequences is that unknown class labels continuously arrive and thus the training and testing often across different class spaces. This scenario is also referred to as the open-world learning problem on structured sequences. In this paper, we present a new Dense Open-world Structured Sequence Learning model (DOSSL for short) to learn graph streams in the open-world learning setting. To capture both structural and temporal information, DOSSL uses a GNN-based stochastic recurrent neural network for learning node representation in graph streams, then a truncated Laplacian distribution to describe the latent distribution of graph nodes, and a sampling function is used to generate node representations. Further, DOSSL learns dense target embeddings for the known classes to improve the compactness of known class distribution and reserve enough space for open-world unknown classes. The ultimate open-world classifier is optimized to detect the samples from unknown classes under the constraints of DVAE loss, label loss, class uncertainty loss, and dense target loss. Through empirical analysis conducted on real-world datasets, it has been demonstrated that the advanced technique known as DOSSL exhibits the ability to acquire precise node classifiers by harnessing the power of graph streams.

TC-Match: Fast Time-Constrained Continuous Subgraph Matching

Continuously monitoring structural patterns in streaming graphs is a critical task in many real-time graph-based applications. In this paper, we study the problem of time-constrained continuous subgraph matching (shorted as TCSM) over streaming graphs. Given a query graph Q with timing order constraint and a data graph stream G , TCSM aims to report all incremental matches of Q in G for each update of G , where a match should obey both structure constraint (i.e., isomorphism) and timing order constraint of Q. Although TCSM has a wide range of applications, such as cyber-attack detection and credit card fraud detection, we note that this problem has not been well addressed. The state-of-the-art bears the limitations of high index space cost and intermediate result maintenance cost. In this paper, we propose TC-Match, an effective approach to TCSM. First, we design a space and time cost-effective index CSS, which is essentially a k -partite graph structure where a node corresponds to an edge in G. By carefully creating links between nodes, we can encapsulate into CSS the partial embedding and timing order information between edges in G. We theoretically show that CSS has polynomial space and construction time complexities. Second, based on the property of CSS, we develop an efficient incremental matching algorithm with an effective node merging optimization. Extensive experiments show that TC-Match can achieve up to 3 orders of magnitude query performance improvement over the baseline methods, and meanwhile the memory consumption is reduced by 48.7%-86.7%.

GraphTango: A Hybrid Representation Format for Efficient Streaming Graph Updates and Analysis

Streaming graph processing performs batched updates and analytics on a time-evolving graph. The underlying representation format of the graph largely determines the throughputs of these updates and analytics phases. Existing representation formats usually employ variations of hash tables or adjacency lists. However, a recent study showed that the adjacency-list-based approaches perform poorly on heavy-tailed graphs, and the hash table-based approaches suffer on short-tailed graphs. We propose GraphTango, a hybrid representation format that provides excellent update and analytics throughput regardless of the graph’s degree distribution. GraphTango dynamically switches among three different formats based on a vertex’s degree: (i) Low-degree vertices store the edges directly with the neighborhood metadata, confining accesses to a single cache line, (2) Medium-degree vertices use adjacency lists, and (3) High-degree vertices use hash tables as well as adjacency lists. In this case, the adjacency list provides fast traversal during the analytics phase, while the hash table provides constant-time lookups during the update phase. We further optimized the performance by designing an open-addressing-based hash table that fully utilizes every fetched cache line. In addition, we developed a thread-local lock-free memory pool that allows fast growing/shrinking of the adjacency lists and hash tables in a multi-threaded environment. We evaluated GraphTango with the help of the SAGA-Bench framework and compared it with four other representation formats: Stinger, Degree-aware Robin Hood Hashing, and two adjacency list-based formats with different workload balancing scheme. On average, GraphTango provides 4.5x higher insertion throughput, 3.2x higher deletion throughput, and 1.1x higher analytics throughput over the next best format. Furthermore, we integrated GraphTango with the state-of-the-art graph processing frameworks DZiG and RisGraph. Compared to the vanilla DZiG and vanilla RisGraph, [GraphTango + DZiG] and [GraphTango + RisGraph] reduces the average batch processing time by 2.3x and 1.5x, respectively.

GraphZeppelin : How to Find Connected Components (Even When Graphs Are Dense, Dynamic, and Massive)

Finding the connected components of a graph is a fundamental problem with uses throughout computer science and engineering. The task of computing connected components becomes more difficult when graphs are very large, or when they are dynamic, meaning the edge set changes over time subject to a stream of edge insertions and deletions. A natural approach to computing the connected components problem on a large, dynamic graph stream is to buy enough RAM to store the entire graph. However, the requirement that the graph fit in RAM is an inherent limitation of this approach and is prohibitive for very large graphs. Thus, there is an unmet need for systems that can process dense dynamic graphs, especially when those graphs are larger than available RAM. We present a new high-performance streaming graph-processing system for computing the connected components of a graph. This system, which we call GraphZeppelin , uses new linear sketching data structures ( CubeSketch ) to solve the streaming connected components problem and as a result requires space asymptotically smaller than the space required for a lossless representation of the graph. GraphZeppelin is optimized for massive dense graphs: GraphZeppelin can process millions of edge updates (both insertions and deletions) per second, even when the underlying graph is far too large to fit in available RAM. As a result GraphZeppelin vastly increases the scale of graphs that can be processed.

Dynamic PageRank with Decay: A Modified Approach for Node Anomaly Detection in Evolving Graph Streams

Dynamic PageRank with Decay: A Modified Approach for Node Anomaly Detection in Evolving Graph Streams

SIM: A fast real-time graph stream summarization with improved memory efficiency and accuracy

A graph stream composed of sequentially approaching arriving edges is commonly utilized to represent complicated structured data in interactive application systems. Since graph streams are extraordinarily vast and high velocity, efficient storage and analysis of graph streams face serious challenges. Current graph stream summarization schemes have effectively achieved the storage and management of graph streams. Unfortunately, they either cannot accomplish real-time queries or have low overall query accuracy. To this end, a novel summary structure, named Shared Interaction Matrix (SIM), is proposed for real-time queries rapidly and accurately with smaller memory. SIM is designed as a two-layer adjacency matrix with different structures to improve memory efficiency while preserving the key of heavy edges to support real-time measurement. Moreover, SIM leverages shared hash technology and an integral replacement strategy to boost insertion query speed and query accuracy. The performance of SIM is evaluated by conducting extensive experiments on the CPU and OVS platform. The experimental results show that SIM significantly enhances measurement accuracy and reduces insertion and query processing latency by 39.21%–93.50% while achieving real-time queries, compared with the state-of-the-art schemes.

Conditional heavy hitter monitoring and application of heterogeneous graph streams based on sketches

Graph streams offer valuable insights into real network evolution in the era of big data. Heavy hitters and conditional heavy hitters focus on identifying entities with significant network traffic, revealing network data characteristics. In this paper, we present two methods, BLSketch and MHLSketch, for identifying heavy hitters and conditional heavy hitters in heterogeneous graph streams. BLSketch uses the bidirectional mapper, Bimap, for efficient query response times while retaining candidate information. MHLSketch uses min heap to preserve a minimal set of candidates to minimize storage space, excelling in space efficiency. The two methods can be incorporated with any sketch based graph summarization method, showing excellent adaptability. Experimental results on four real-world heterogeneous datasets of varying scales with the largest dataset containing millions of edges demonstrate our methods significantly improve the quality of query answering, outperforming state-of-the-art methods, with precision close to 1 and average relative error close to 0. We further combine our methods with density clustering to introduce the SDC model, which efficiently identifies hot regions and key users in Location-Based Social Networks (LBSN). In experiments, SDC outperforms traditional clustering by reducing up to 93.1% of cold Points of Interest (POIs) and shows strong potential for practical applications.

A computational framework based on the dynamic pipeline approach

Stream processing has inspired new computational approaches to facilitate effectiveness and efficiency. One such approach is the dynamic pipeline, which serves as a powerful computational model for stream processing. It is particularly well suited for solving problems that require incremental generation of results, making it an approach for scenarios where real-time analysis and responsiveness are critical. This paper aims to address a family of problems using the Dynamic Pipeline approach, and as a first step, we provide a comprehensive characterization of this problem family. In addition, we present the definition of a Dynamic Pipeline framework. To demonstrate the practicality of this framework, we present a proof of concept through its implementation and perform an empirical performance study. To this end, we focus on solving the problem of enumerating or listing the weakly connected components of a graph within the proposed framework. We provide two implementations of this algorithm to demonstrate the computational power and continuous behavior of the Dynamic Pipeline framework. The first implementation serves as a baseline for our experiments, representing an ad hoc solution based on the Dynamic Pipeline approach. In contrast, the second implementation is built on top of the developed framework. The observed results strongly support the suitability and effectiveness of the Dynamic Pipeline framework for implementing graph stream processing problems, especially those where continuous and real-time result generation is essential.

MWP: Multi-Window Parallel Evaluation of Regular Path Queries on Streaming Graphs

A persistent Regular Path Query (RPQ) on a streaming graph is to continuously find every pair of vertices that are connected by a path in the graph within a sliding window, such that the edge label sequence of this path matches a given regular expression. The existing RPQ evaluation algorithm in the literature incrementally maintains a set of spanning-tree-like data structures to quickly form query results and to avoid reprocessing edges that are shared by multiple sliding windows. This approach allows parallel processing of the graph edges within a sliding window but requires a blocking expiration phase between sliding windows to remove the old edges. This blocking phase can significantly degrade the query performance, especially when the edges arrive quickly and the sliding windows overlap significantly. This paper presents a new RPQ evaluation strategy called Multi-Window Parallel (MWP) method leveraging a new data structure called Timestamped Rooted Digraph (TRD). The novel idea is to incrementally maintain TRDs for the quick formulation of query results, like the aforementioned spanning trees, but simultaneously contain needed information for multiple sliding windows. MWP eliminates the forced blocking expiration phase. Only when memory runs low, a quick "dirty garbage collection" (DGC) process is done to remove some unneeded edges and nodes on TRDs, without incurring large costs. Extensive experiments on real graph datasets show that MWP significantly outperforms the existing algorithm in terms of throughput, tail latency, and scalability, and that DGC provides an effective solution for releasing memory with minimum impact.

FiFrauD: Unsupervised Financial Fraud Detection in Dynamic Graph Streams

Given a stream of financial transactions between traders in an e-market, how can we accurately detect fraudulent traders and suspicious behaviors in real time? Despite the efforts made in detecting these fraudsters, this field still faces serious challenges, including the ineffectiveness of existing methods for the complex and streaming environment of e-markets. As a result, it is still difficult to quickly and accurately detect suspected traders and behavior patterns in real-time transactions, and it is still considered an open problem. To solve this problem and alleviate the existing challenges, in this article, we propose FiFrauD, which is an unsupervised, scalable approach that depicts the behavior of manipulators in a transaction stream. In this approach, real-time transactions between traders are converted into a stream of graphs and, instead of using supervised and semi-supervised learning methods, fraudulent traders are detected precisely by exploiting density signals in graphs. Specifically, we reveal the traits of fraudulent traders in the market and propose a novel metric from this perspective, i.e., graph topology, time, and behavior. Then, we search for suspicious blocks by greedily optimizing the proposed metric. Theoretical analysis demonstrates upper bounds for FiFrauD's effectiveness in catching suspicious trades. Extensive experiments on five real-world datasets with both actual and synthetic labels demonstrate that FiFrauD achieves significant accuracy improvements compared with state-of-the-art fraud detection methods. Also, it can find various suspicious behavior patterns in a linear runtime and provide interpretable results. Furthermore, FiFrauD is resistant to the camouflage tactics used by fraudulent traders.

A Streaming Graph Partitioning Method to Achieve High Cohesion and Equilibrium via Multiplayer Repeated Game

A Streaming Graph Partitioning Method to Achieve High Cohesion and Equilibrium via Multiplayer Repeated Game

LM-SRPQ: Efficiently Answering Regular Path Query in Streaming Graphs

Regular path query (RPQ) is a basic operation for graph data analysis, and persistent RPQ in streaming graphs is a new-emerging research topic. In this paper, we propose a novel algorithm for persistent RPQ in streaming graphs, named LM-SRPQ. It solves persistent RPQ with a combination of intermediate result materialization and real-time graph traversal. Compared to prior art, it merges redundant storage and computation, achieving higher memory and time efficiency. We carry out extensive experiments with both real-world and synthetic streaming graphs to evaluate its performance. Experiment results confirm its superiority compared to prior art in both memory and time efficiency.

Querying Structural Diversity in Streaming Graphs

Structural diversity of a vertex refers to the diversity of connections within its neighborhood and has been applied in various fields such as viral marketing and user engagement. The paper studies querying the structural diversity of a vertex for any query time windows in streaming graphs. Existing studies are limited to static graphs which fail to capture vertices' structural diversities in snapshots evolving over time. We design an elegant index structure to significantly reduce the index size compared to the basic approach. We propose an optimized incremental algorithm to update the index for continuous edge arrivals. Extensive experiments on real-world streaming graphs demonstrate the effectiveness of our framework.

Learning to Sketch: A Neural Approach to Item Frequency Estimation in Streaming Data.

Recently, there has been a trend of designing neural data structures to go beyond handcrafted data structures by leveraging patterns of data distributions for better accuracy and adaptivity. Sketches are widely used data structures in real-time web analysis, network monitoring, and self-driving to estimate item frequencies of data streams within limited space. However, existing sketches have not fully exploited the patterns of the data stream distributions, making it challenging to tightly couple them with neural networks that excel at memorizing pattern information. Starting from the premise, we envision a pure neural data structure as a base sketch, which we term the meta-sketch, to reinvent the base structure of conventional sketches. The meta-sketch learns basic sketching abilities from meta-tasks constituted with synthetic datasets following Zipf distributions in the pre-training phase and can be quickly adapted to real (skewed) distributions in the adaption phase. The meta-sketch not only surpasses its competitors in sketching conventional data streams but also holds good potential in supporting more complex streaming data, such as multimedia and graph stream scenarios. Extensive experiments demonstrate the superiority of the meta-sketch and offer insights into its working mechanism.

Dichotomy Graph Sketch: Summarizing Graph Streams with High Accuracy Based on Deep Learning

In many applications, data streams are indispensable to describe the relationships between nodes in networks, such as social networks, computer networks, and hyperlink networks. Fundamentally, a graph stream is a dynamic representation of a graph, which is usually composed of a sequence of edges, where each edge is represented by two endpoints and a weight. As a result of its large volume and highly dynamic nature, several graph sketches were proposed for the purposes of summarizing large-scale graph streams and enabling fast query processing. By using a compact data structure with hash functions, the graph sketches sequentially store the edges. Nevertheless, the existing graph sketches suffer from low performance on graph query tasks as a result of unpredictable collisions between heavy edges and light edges. To store heavy edges and light edges, this paper introduces a novel learning-based Dichotomy Graph Sketch (DGS) mechanism that uses two separate graph sketches, a heavy sketch and a light sketch. During a graph stream session, DGS obtains heavy edges and light edges, and uses these edges as training samples for a deep neural network (DNN) based binary classifier. The DNN-based classifier is then used to determine whether the upcoming edges are heavy or not. We will store the edges that are classified as heavy edges in the heavy sketch, and those that are classified as light edges in the light sketch. By combining the learnable classifier and Dichotomy Graph Sketches, the proposed mechanism resolves the hashing collision problem in conventional graph sketches and significantly improves graph query accuracy. The DGS algorithm outperforms the state-of-the-art graph sketches in a variety of graph query tasks based on extensive experiments that were conducted on four real-world graph stream datasets.

CoDiS: Community Detection via Distributed Seed Set Expansion on Graph Streams

Community detection has been (and remains) a very important topic in several fields. From marketing and social networking to biological studies, community detection plays a key role in advancing research in many different fields. Research on this topic originally looked at classifying nodes into discrete communities (non-overlapping communities) but eventually moved forward to placing nodes in multiple communities (overlapping communities). Unfortunately, community detection has always been a time-inefficient process, and datasets are too large to realistically process them using traditional methods. Because of this, recent methods have turned to parallelism and graph stream models, where the edge list is accessed one edge at a time. However, all these methods, while offering a significant decrease in processing time, still have several shortcomings. We propose a new parallel algorithm called community detection with seed sets (CoDiS), which solves the overlapping community detection problem in graph streams. Initially, some nodes (seed sets) have known community structures, and the aim is to expand these communities by processing one edge at a time. The innovation of our approach is that it splits communities among the parallel computation workers so that each worker is only updating a subset of all the communities. By doing so, we decrease the edge processing throughput and decrease the amount of time each worker spends on each edge. Crucially, we remove the need for every worker to have access to every community. Experimental results show that we are able to gain a significant improvement in running time with no loss of accuracy.