Mining Billion-node Graphs: Patterns, Generators and Tools

138
CMU SCS Mining Billion-node Graphs: Patterns, Generators and Tools Christos Faloutsos CMU (on sabbatical at google)

description

Mining Billion-node Graphs: Patterns, Generators and Tools. Christos Faloutsos CMU (on sabbatical at google). Our goal:. Open source system for mining huge graphs: PEGASUS project (PEta GrAph mining System) www.cs.cmu.edu/~pegasus code and papers. Outline. Introduction – Motivation - PowerPoint PPT Presentation

Transcript of Mining Billion-node Graphs: Patterns, Generators and Tools

Page 1: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

Mining Billion-node Graphs: Patterns, Generators and Tools

Christos Faloutsos

CMU

(on sabbatical at google)

Page 2: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 2

Our goal:

Open source system for mining huge graphs:

PEGASUS project (PEta GrAph mining System)

• www.cs.cmu.edu/~pegasus

• code and papers

Google'11

Page 3: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 3

Outline

• Introduction – Motivation

• Problem#1: Patterns in graphs

• Problem#2: Tools

• Problem#3: Scalability

• Conclusions

Google'11

Page 4: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 4

Graphs - why should we care?

Internet Map [lumeta.com]

Food Web [Martinez ’91]

Friendship Network [Moody ’01]

Google'11

• Social networks• (orkut, linkedIn …)

• twitter

Page 5: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 5

Graphs - why should we care?

• IR: bi-partite graphs (doc-terms)

• web: hyper-text graph

• ... and more:

D1

DN

T1

TM

... ...

Google'11

Page 6: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 6

Graphs - why should we care?

• ‘viral’ marketing

• web-log (‘blog’) news propagation

• computer network security: email/IP traffic and anomaly detection

• ....

Google'11

Page 7: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 7

Outline

• Introduction – Motivation

• Problem#1: Patterns in graphs– Static graphs– Weighted graphs– Time evolving graphs

• Problem#2: Tools

• Problem#3: Scalability

• Conclusions

Google'11

Page 8: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 8

Problem #1 - network and graph mining

• What does the Internet look like?• What does FaceBook look like?

• What is ‘normal’/‘abnormal’?• which patterns/laws hold?

Google'11

Page 9: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 9

Problem #1 - network and graph mining

• What does the Internet look like?• What does FaceBook look like?

• What is ‘normal’/‘abnormal’?• which patterns/laws hold?

– To spot anomalies (rarities), we have to discover patterns

Google'11

Page 10: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 10

Problem #1 - network and graph mining

• What does the Internet look like?• What does FaceBook look like?

• What is ‘normal’/‘abnormal’?• which patterns/laws hold?

– To spot anomalies (rarities), we have to discover patterns

– Large datasets reveal patterns/anomalies that may be invisible otherwise…

Google'11

Page 11: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 11

Graph mining

• Are real graphs random?

Google'11

Page 12: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 12

Laws and patterns• Are real graphs random?• A: NO!!

– Diameter– in- and out- degree distributions– other (surprising) patterns

• So, let’s look at the data

Google'11

Page 13: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 13

Solution# S.1

• Power law in the degree distribution [SIGCOMM99]

log(rank)

log(degree)

internet domains

att.com

ibm.com

Google'11

Page 14: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 14

Solution# S.1

• Power law in the degree distribution [SIGCOMM99]

log(rank)

log(degree)

-0.82

internet domains

att.com

ibm.com

Google'11

Page 15: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 15

Solution# S.2: Eigen Exponent E

• A2: power law in the eigenvalues of the adjacency matrix

E = -0.48

Exponent = slope

Eigenvalue

Rank of decreasing eigenvalue

May 2001

Google'11

Page 16: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 16

Solution# S.2: Eigen Exponent E

• [Mihail, Papadimitriou ’02]: slope is ½ of rank exponent

E = -0.48

Exponent = slope

Eigenvalue

Rank of decreasing eigenvalue

May 2001

Google'11

Page 17: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 17

But:

How about graphs from other domains?

Google'11

Page 18: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 18

More power laws:

• web hit counts [w/ A. Montgomery]

Web Site Traffic

in-degree (log scale)

Count(log scale)

Zipf

userssites

``ebay’’

Google'11

Page 19: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 19

epinions.com• who-trusts-whom

[Richardson + Domingos, KDD 2001]

(out) degree

count

trusts-2000-people user

Google'11

Page 20: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

And numerous more

• # of sexual contacts

• Income [Pareto] –’80-20 distribution’

• Duration of downloads [Bestavros+]

• Duration of UNIX jobs (‘mice and elephants’)

• Size of files of a user

• …

• ‘Black swans’Google'11 C. Faloutsos (CMU + Google) 20

Page 21: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 21

Outline

• Introduction – Motivation

• Problem#1: Patterns in graphs– Static graphs

• degree, diameter, eigen,

• triangles

• cliques

– Weighted graphs– Time evolving graphs

• Problem#2: ToolsGoogle'11

Page 22: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 22

Solution# S.3: Triangle ‘Laws’

• Real social networks have a lot of triangles

Google'11

Page 23: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 23

Solution# S.3: Triangle ‘Laws’

• Real social networks have a lot of triangles– Friends of friends are friends

• Any patterns?

Google'11

Page 24: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 24

Triangle Law: #S.3 [Tsourakakis ICDM 2008]

ASNHEP-TH

Epinions X-axis: # of participatingtrianglesY: count (~ pdf)

Google'11

Page 25: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 25

Triangle Law: #S.3 [Tsourakakis ICDM 2008]

ASNHEP-TH

Epinions

Google'11

X-axis: # of participatingtrianglesY: count (~ pdf)

Page 26: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 26

Triangle Law: #S.4 [Tsourakakis ICDM 2008]

SNReuters

EpinionsX-axis: degreeY-axis: mean # trianglesn friends -> ~n1.6 triangles

Google'11

Page 27: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 27

Triangle Law: Computations [Tsourakakis ICDM 2008]

But: triangles are expensive to compute(3-way join; several approx. algos)

Q: Can we do that quickly?

details

Google'11

Page 28: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 28

Triangle Law: Computations [Tsourakakis ICDM 2008]

But: triangles are expensive to compute(3-way join; several approx. algos)

Q: Can we do that quickly?A: Yes!

#triangles = 1/6 Sum ( i3 )

(and, because of skewness (S2) , we only need the top few eigenvalues!

details

Google'11

Page 29: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 29

Triangle Law: Computations [Tsourakakis ICDM 2008]

1000x+ speed-up, >90% accuracy

details

Google'11

Page 30: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

EigenSpokes

B. Aditya Prakash, Mukund Seshadri, Ashwin Sridharan, Sridhar Machiraju and Christos Faloutsos: EigenSpokes: Surprising Patterns and Scalable Community Chipping in Large Graphs, PAKDD 2010, Hyderabad, India, 21-24 June 2010.

C. Faloutsos (CMU + Google) 30Google'11

Page 31: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

EigenSpokes• Eigenvectors of adjacency matrix

equivalent to singular vectors (symmetric, undirected graph)

31C. Faloutsos (CMU + Google)Google'11

Page 32: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

EigenSpokes• Eigenvectors of adjacency matrix

equivalent to singular vectors (symmetric, undirected graph)

32C. Faloutsos (CMU + Google)Google'11

N

N

details

Page 33: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

EigenSpokes• Eigenvectors of adjacency matrix

equivalent to singular vectors (symmetric, undirected graph)

33C. Faloutsos (CMU + Google)Google'11

N

N

details

Page 34: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

EigenSpokes• Eigenvectors of adjacency matrix

equivalent to singular vectors (symmetric, undirected graph)

34C. Faloutsos (CMU + Google)Google'11

N

N

details

Page 35: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

EigenSpokes• Eigenvectors of adjacency matrix

equivalent to singular vectors (symmetric, undirected graph)

35C. Faloutsos (CMU + Google)Google'11

N

N

details

Page 36: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

EigenSpokes

• EE plot:

• Scatter plot of scores of u1 vs u2

• One would expect– Many points @

origin– A few scattered

~randomly

C. Faloutsos (CMU + Google) 36

u1

u2

Google'11

1st Principal component

2nd Principal component

Page 37: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

EigenSpokes

• EE plot:

• Scatter plot of scores of u1 vs u2

• One would expect– Many points @

origin– A few scattered

~randomly

C. Faloutsos (CMU + Google) 37

u1

u290o

Google'11

Page 38: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

EigenSpokes - pervasiveness

•Present in mobile social graph across time and space

•Patent citation graph

38C. Faloutsos (CMU + Google)Google'11

Page 39: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

EigenSpokes - explanation

Near-cliques, or near-bipartite-cores, loosely connected

39C. Faloutsos (CMU + Google)Google'11

Page 40: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

EigenSpokes - explanation

Near-cliques, or near-bipartite-cores, loosely connected

40C. Faloutsos (CMU + Google)Google'11

Page 41: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

EigenSpokes - explanation

Near-cliques, or near-bipartite-cores, loosely connected

41C. Faloutsos (CMU + Google)Google'11

Page 42: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

EigenSpokes - explanation

Near-cliques, or near-bipartite-cores, loosely connected

So what? Extract nodes with high

scores high connectivity Good “communities”

spy plot of top 20 nodes

42C. Faloutsos (CMU + Google)Google'11

Page 43: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

Bipartite Communities!

magnified bipartite community

patents fromsame inventor(s)

`cut-and-paste’bibliography!

43C. Faloutsos (CMU + Google)Google'11

Page 44: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 44

Outline

• Introduction – Motivation

• Problem#1: Patterns in graphs– Static graphs

• degree, diameter, eigen,

• triangles

• cliques

– Weighted graphs– Time evolving graphs

• Problem#2: ToolsGoogle'11

Page 45: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 45

Observations on weighted graphs?

• A: yes - even more ‘laws’!

M. McGlohon, L. Akoglu, and C. Faloutsos Weighted Graphs and Disconnected Components: Patterns and a Generator. SIG-KDD 2008

Google'11

Page 46: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 46

Observation W.1: Fortification

Q: How do the weights

of nodes relate to degree?

Google'11

Page 47: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 47

Observation W.1: Fortification

More donors, more $ ?

$10

$5

Google'11

‘Reagan’

‘Clinton’$7

Page 48: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

Edges (# donors)

In-weights($)

C. Faloutsos (CMU + Google) 48

Observation W.1: fortification:Snapshot Power Law

• Weight: super-linear on in-degree • exponent ‘iw’: 1.01 < iw < 1.26

Orgs-Candidates

e.g. John Kerry, $10M received,from 1K donors

More donors, even more $

$10

$5

Google'11

Page 49: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 49

Outline

• Introduction – Motivation

• Problem#1: Patterns in graphs– Static graphs – Weighted graphs– Time evolving graphs

• Problem#2: Tools

• …

Google'11

Page 50: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 50

Problem: Time evolution• with Jure Leskovec (CMU ->

Stanford)

• and Jon Kleinberg (Cornell – sabb. @ CMU)

Google'11

Page 51: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 51

T.1 Evolution of the Diameter

• Prior work on Power Law graphs hints at slowly growing diameter:– diameter ~ O(log N)– diameter ~ O(log log N)

• What is happening in real data?

Google'11

Page 52: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 52

T.1 Evolution of the Diameter

• Prior work on Power Law graphs hints at slowly growing diameter:– diameter ~ O(log N)– diameter ~ O(log log N)

• What is happening in real data?

• Diameter shrinks over time

Google'11

Page 53: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 53

T.1 Diameter – “Patents”

• Patent citation network

• 25 years of data

• @1999– 2.9 M nodes– 16.5 M edges

time [years]

diameter

Google'11

Page 54: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 54

T.2 Temporal Evolution of the Graphs

• N(t) … nodes at time t

• E(t) … edges at time t

• Suppose thatN(t+1) = 2 * N(t)

• Q: what is your guess for E(t+1) =? 2 * E(t)

Google'11

Page 55: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 55

T.2 Temporal Evolution of the Graphs

• N(t) … nodes at time t• E(t) … edges at time t• Suppose that

N(t+1) = 2 * N(t)

• Q: what is your guess for E(t+1) =? 2 * E(t)

• A: over-doubled!– But obeying the ``Densification Power Law’’

Google'11

Page 56: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 56

T.2 Densification – Patent Citations

• Citations among patents granted

• @1999– 2.9 M nodes– 16.5 M edges

• Each year is a datapoint

N(t)

E(t)

1.66

Google'11

Page 57: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 57

Outline

• Introduction – Motivation

• Problem#1: Patterns in graphs– Static graphs – Weighted graphs– Time evolving graphs

• Problem#2: Tools

• …

Google'11

Page 58: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 58

More on Time-evolving graphs

M. McGlohon, L. Akoglu, and C. Faloutsos Weighted Graphs and Disconnected Components: Patterns and a Generator. SIG-KDD 2008

Google'11

Page 59: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 59

Observation T.3: NLCC behaviorQ: How do NLCC’s emerge and join with the

GCC?

(``NLCC’’ = non-largest conn. components)

– Do they continue to grow in size?

– or do they shrink?

– or stabilize?

Google'11

Page 60: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 60

Observation T.3: NLCC behaviorQ: How do NLCC’s emerge and join with the

GCC?

(``NLCC’’ = non-largest conn. components)

– Do they continue to grow in size?

– or do they shrink?

– or stabilize?

Google'11

Page 61: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 61

Observation T.3: NLCC behaviorQ: How do NLCC’s emerge and join with the

GCC?

(``NLCC’’ = non-largest conn. components)

– Do they continue to grow in size?

– or do they shrink?

– or stabilize?

Google'11

YES

YES

YES

Page 62: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 62

Observation T.3: NLCC behavior

• After the gelling point, the GCC takes off, but NLCC’s remain ~constant (actually, oscillate).

IMDB

CC size

Time-stampGoogle'11

Page 63: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 63

Timing for Blogs

• with Mary McGlohon (CMU->Google)

• Jure Leskovec (CMU->Stanford)

• Natalie Glance (now at Google)

• Mat Hurst (now at MSR)

[SDM’07]

Google'11

Page 64: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 64

T.4 : popularity over time

Post popularity drops-off – exponentially?

lag: days after post

# in links

1 2 3

@t

@t + lag

Google'11

Page 65: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 65

T.4 : popularity over time

Post popularity drops-off – exponentially?POWER LAW!Exponent?

# in links(log)

days after post(log)

Google'11

Page 66: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 66

T.4 : popularity over time

Post popularity drops-off – exponentially?POWER LAW!Exponent? -1.6 • close to -1.5: Barabasi’s stack model• and like the zero-crossings of a random walk

# in links(log) -1.6

days after post(log)

Google'11

Page 67: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

Google'11 C. Faloutsos (CMU + Google) 67

-1.5 slope

J. G. Oliveira & A.-L. Barabási Human Dynamics: The Correspondence Patterns of Darwin and Einstein. Nature 437, 1251 (2005) . [PDF]

Page 68: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

T.5: duration of phonecalls

Surprising Patterns for the Call Duration Distribution of Mobile Phone Users

Pedro O. S. Vaz de Melo, Leman

Akoglu, Christos Faloutsos, Antonio A. F. Loureiro

PKDD 2010

Google'11 C. Faloutsos (CMU + Google) 68

Page 69: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

Probably, power law (?)

Google'11 C. Faloutsos (CMU + Google) 69

??

Page 70: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

No Power Law!

Google'11 C. Faloutsos (CMU + Google) 70

Page 71: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

‘TLaC: Lazy Contractor’

• The longer a task (phonecall) has taken,

• The even longer it will take

Google'11 C. Faloutsos (CMU + Google) 71

Odds ratio=

Casualties(<x):Survivors(>=x)

== power law

Page 72: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

72

Data Description

Data from a private mobile operator of a large city 4 months of data 3.1 million users more than 1 billion phone records

Over 96% of ‘talkative’ users obeyed a TLAC distribution (‘talkative’: >30 calls)

Google'11 C. Faloutsos (CMU + Google)

Page 73: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 73

Outline

• Introduction – Motivation

• Problem#1: Patterns in graphs

• Problem#2: Tools– OddBall (anomaly detection)– Belief Propagation– Immunization

• Problem#3: Scalability

• Conclusions

Google'11

Page 74: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

OddBall: Spotting Anomalies in Weighted Graphs

Leman Akoglu, Mary McGlohon, Christos Faloutsos

Carnegie Mellon University

School of Computer Science

PAKDD 2010, Hyderabad, India

Page 75: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

Main idea

For each node,

• extract ‘ego-net’ (=1-step-away neighbors)

• Extract features (#edges, total weight, etc etc)

• Compare with the rest of the population

C. Faloutsos (CMU + Google) 75Google'11

Page 76: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

What is an egonet?

ego

76

egonet

C. Faloutsos (CMU + Google)Google'11

Page 77: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

Selected Features

Ni: number of neighbors (degree) of ego i Ei: number of edges in egonet i Wi: total weight of egonet i λw,i: principal eigenvalue of the weighted

adjacency matrix of egonet I

77C. Faloutsos (CMU + Google)Google'11

Page 78: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

Near-Clique/Star

78Google'11 C. Faloutsos (CMU + Google)

Page 79: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

Near-Clique/Star

79C. Faloutsos (CMU + Google)Google'11

Page 80: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

Near-Clique/Star

80C. Faloutsos (CMU + Google)Google'11

Page 81: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

Andrew Lewis (director)

Near-Clique/Star

81C. Faloutsos (CMU + Google)Google'11

Page 82: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 82

Outline

• Introduction – Motivation

• Problem#1: Patterns in graphs

• Problem#2: Tools– OddBall (anomaly detection)– Belief Propagation– Immunization

• Problem#3: Scalability

• Conclusions

Google'11

Page 83: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

Fraud detection• Problem: Given network and noisy domain

knowledge about weakly-suspicious nodes (flags), which nodes are most risky?

CashAccounts Payable

Inventory

Bad Debt

Non-Trade A/R

Accounts Receivable

Revenue 1

Revenue 2

83

Revenue 3

Revenue 4

Revenue 5Google'11 C. Faloutsos (CMU + Google)

Page 84: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

Fraud detection• Flags: eg, too many round numbers, etc

CashAccounts Payable

Inventory

Bad Debt

Non-Trade A/R

Accounts Receivable

Revenue 1

Revenue 2

84

Revenue 3

Revenue 4

Revenue 5Google'11 C. Faloutsos (CMU + Google)

Page 85: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

Solution: Belief Propagation

85

• Solution: Social Network Analytic Risk Evaluation– Assume homophily between nodes (“guilt

by association”)– Use belief propagation (message passing)– Upon convergence, determine end risk

scores.

[SNARE: McGlohon+, KDD’09]Google'11 C. Faloutsos (CMU + Google)

Page 86: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

Fraud detection• Problem: Given network and noisy domain

knowledge about suspicious nodes (flags), which nodes are most risky?

CashAccounts Payable

Inventory

Bad Debt

Non-Trade A/R

Accounts Receivable

Revenue 1

Revenue 2

86

Revenue 3

Revenue 4

Revenue 5Google'11 C. Faloutsos (CMU + Google)

Page 87: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

Fraud detection• Problem: Given network and noisy domain

knowledge about suspicious nodes (flags), which nodes are most risky?

CashAccounts Payable

Inventory

Bad Debt

Non-Trade A/R

Accounts Receivable

Revenue 1

Revenue 2

87

Revenue 3

Revenue 4

Revenue 5Google'11 C. Faloutsos (CMU + Google)

Page 88: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

BP and ‘SNARE’

88

• Accurate – significant improvement over base

• Flexible - Can be applied to other domains

• Scalable - Linear time

• Robust - Works on large range of parameters

False positive rate

True positive

rate

Results for accounts data (ROC Curve)

SNARE

Baseline (flags only)

Google'11 C. Faloutsos (CMU + Google)

Page 89: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

How to do B.P. on large graphs?

A: [U Kang, Polo Chau, +, ICDE’11],

to appear

Google'11 C. Faloutsos (CMU + Google) 89

Page 90: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 90

Outline

• Introduction – Motivation

• Problem#1: Patterns in graphs

• Problem#2: Tools– OddBall (anomaly detection)– Belief propagation– Immunization

• Problem#3: Scalability -PEGASUS

• Conclusions

Google'11

Page 91: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

Immunization and epidemic thresholds

• Q1: which nodes to immunize?

• Q2: will a virus vanish, or will it create an epidemic?

Google'11 C. Faloutsos (CMU + Google) 91

Page 92: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

Q1: Immunization:

?

?

•Given •a network, •k vaccines, and •the virus details

•Which nodes to immunize?

Google'11 92C. Faloutsos (CMU + Google)

Page 93: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

Q1: Immunization:

?

?

•Given •a network, •k vaccines, and •the virus details

•Which nodes to immunize?

Google'11 93C. Faloutsos (CMU + Google)

Page 94: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

Q1: Immunization:

?

?

•Given •a network, •k vaccines, and •the virus details

•Which nodes to immunize?

Google'11 94C. Faloutsos (CMU + Google)

Page 95: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

Q1: Immunization:

?

?

•Given •a network, •k vaccines, and •the virus details

•Which nodes to immunize?

A: immunize the ones that maximally raise the `epidemic threshold’ [Tong+, ICDM’10]

Google'11 95C. Faloutsos (CMU + Google)

Page 96: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

Q2: will a virus take over?

• Flu-like virus (no immunity, ‘SIS’)

• Mumps (life-time immunity, ‘SIR’)

• Pertussis (finite-length immunity, ‘SIRS’)

Google'11 C. Faloutsos (CMU + Google) 96

?

?

: attack prob: heal prob

Page 97: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

Q2: will a virus take over?

• Flu-like virus (no immunity, ‘SIS’)

• Mumps (life-time immunity, ‘SIR’)

• Pertussis (finite-length immunity, ‘SIRS’)

Google'11 C. Faloutsos (CMU + Google) 97

?

?

: attack prob: heal prob

depends on connectivity (avg degree? Max degree? variance? Something else?

Page 98: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

Q2: will a virus take over?

• Flu-like virus (no immunity, ‘SIS’)

• Mumps (life-time immunity, ‘SIR’)

• Pertussis (finite-length immunity, ‘SIRS’)

Google'11 C. Faloutsos (CMU + Google) 98

?

?

: attack prob: heal prob

depends on connectivity: ONLY on first eigenvalue

Page 99: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

A2: will a virus take over?

• For all typical virus propagation models (flu, mumps, pertussis, HIV, etc)

• The only connectivity easure that matters, is

1

the first eigenvalue of the

adj. matrix

[Prakash+, arxiv]

Google'11 C. Faloutsos (CMU + Google) 99

?

?

Page 100: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

A2: will a virus take over?

Google'11 C. Faloutsos (CMU + Google) 100

Fraction ofinfected

Time ticks

Below: exp. extinction

Above: take-over

Graph:Portland, OR31M links1.5M nodes

Page 101: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 101

Outline

• Introduction – Motivation

• Problem#1: Patterns in graphs

• Problem#2: Tools– OddBall (anomaly detection)– Belief propagation– Immunization

• Problem#3: Scalability -PEGASUS

• Conclusions

Google'11

Page 102: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

Google'11 C. Faloutsos (CMU + Google) 102

Scalability• Google: > 450,000 processors in clusters of ~2000

processors each [Barroso, Dean, Hölzle, “Web Search for a Planet: The Google Cluster Architecture” IEEE Micro 2003]

• Yahoo: 5Pb of data [Fayyad, KDD’07]• Problem: machine failures, on a daily basis• How to parallelize data mining tasks, then?• A: map/reduce – hadoop (open-source clone)

http://hadoop.apache.org/

Page 103: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 103

Centralized Hadoop/PEGASUS

Degree Distr. old old

Pagerank old old

Diameter/ANF old HERE

Conn. Comp old HERE

Triangles done

Visualization started

Outline – Algorithms & results

Google'11

Page 104: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

HADI for diameter estimation

• Radius Plots for Mining Tera-byte Scale Graphs U Kang, Charalampos Tsourakakis, Ana Paula Appel, Christos Faloutsos, Jure Leskovec, SDM’10

• Naively: diameter needs O(N**2) space and up to O(N**3) time – prohibitive (N~1B)

• Our HADI: linear on E (~10B)– Near-linear scalability wrt # machines– Several optimizations -> 5x faster

C. Faloutsos (CMU + Google) 104Google'11

Page 105: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

????????

19+ [Barabasi+]

105C. Faloutsos (CMU + Google)

Radius

Count

Google'11

~1999, ~1M nodes

Page 106: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

YahooWeb graph (120Gb, 1.4B nodes, 6.6 B edges)• Largest publicly available graph ever studied.

????????

19+ [Barabasi+]

106C. Faloutsos (CMU + Google)

Radius

Count

Google'11

??

~1999, ~1M nodes

Page 107: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

YahooWeb graph (120Gb, 1.4B nodes, 6.6 B edges)• Largest publicly available graph ever studied.

????????

19+? [Barabasi+]

107C. Faloutsos (CMU + Google)

Radius

Count

Google'11

14 (dir.)

~7 (undir.)

Page 108: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

YahooWeb graph (120Gb, 1.4B nodes, 6.6 B edges)•7 degrees of separation (!)•Diameter: shrunk

????????

19+? [Barabasi+]

108C. Faloutsos (CMU + Google)

Radius

Count

Google'11

14 (dir.)

~7 (undir.)

Page 109: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

YahooWeb graph (120Gb, 1.4B nodes, 6.6 B edges)Q: Shape?

????????

109C. Faloutsos (CMU + Google)

Radius

Count

Google'11

~7 (undir.)

Page 110: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

110C. Faloutsos (CMU + Google)

YahooWeb graph (120Gb, 1.4B nodes, 6.6 B edges)• effective diameter: surprisingly small.• Multi-modality (?!)

Google'11

Page 111: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

Radius Plot of GCC of YahooWeb.

111C. Faloutsos (CMU + Google)Google'11

Page 112: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

112C. Faloutsos (CMU + Google)

YahooWeb graph (120Gb, 1.4B nodes, 6.6 B edges)• effective diameter: surprisingly small.• Multi-modality: probably mixture of cores .

Google'11

Page 113: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

113C. Faloutsos (CMU + Google)

YahooWeb graph (120Gb, 1.4B nodes, 6.6 B edges)• effective diameter: surprisingly small.• Multi-modality: probably mixture of cores .

Google'11

EN

~7

Conjecture:DE

BR

Page 114: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

114C. Faloutsos (CMU + Google)

YahooWeb graph (120Gb, 1.4B nodes, 6.6 B edges)• effective diameter: surprisingly small.• Multi-modality: probably mixture of cores .

Google'11

~7

Conjecture:

Page 115: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

Running time - Kronecker and Erdos-Renyi Graphs with billions edges.

details

Page 116: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 116

Centralized Hadoop/PEGASUS

Degree Distr. old old

Pagerank old old

Diameter/ANF old HERE

Conn. Comp old HERE

Triangles done

Visualization started

Outline – Algorithms & results

Google'11

Page 117: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

Generalized Iterated Matrix Vector Multiplication (GIMV)

C. Faloutsos (CMU + Google) 117

PEGASUS: A Peta-Scale Graph Mining System - Implementation and Observations. U Kang, Charalampos E. Tsourakakis, and Christos Faloutsos. (ICDM) 2009, Miami, Florida, USA. Best Application Paper (runner-up).

Google'11

Page 118: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

Generalized Iterated Matrix Vector Multiplication (GIMV)

C. Faloutsos (CMU + Google) 118

• PageRank• proximity (RWR)• Diameter• Connected components• (eigenvectors, • Belief Prop. • … )

Matrix – vectorMultiplication

(iterated)

Google'11

details

Page 119: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

119

Example: GIM-V At Work

• Connected Components – 4 observations:

Size

Count

C. Faloutsos (CMU + Google)Google'11

Page 120: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

120

Example: GIM-V At Work

• Connected Components

Size

Count

C. Faloutsos (CMU + Google)Google'11

1) 10K x largerthan next

Page 121: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

121

Example: GIM-V At Work

• Connected Components

Size

Count

C. Faloutsos (CMU + Google)Google'11

2) ~0.7B singleton nodes

Page 122: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

122

Example: GIM-V At Work

• Connected Components

Size

Count

C. Faloutsos (CMU + Google)Google'11

3) SLOPE!

Page 123: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

123

Example: GIM-V At Work

• Connected Components

Size

Count300-size

cmptX 500.Why?

1100-size cmptX 65.Why?

C. Faloutsos (CMU + Google)Google'11

4) Spikes!

Page 124: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

124

Example: GIM-V At Work

• Connected Components

Size

Count

suspiciousfinancial-advice sites

(not existing now)

C. Faloutsos (CMU + Google)Google'11

Page 125: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

125

GIM-V At Work• Connected Components over Time

• LinkedIn: 7.5M nodes and 58M edges

Stable tail slopeafter the gelling point

C. Faloutsos (CMU + Google)Google'11

Page 126: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 126

Outline

• Introduction – Motivation

• Problem#1: Patterns in graphs

• Problem#2: Tools

• Problem#3: Scalability

• Conclusions

Google'11

Page 127: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 127

OVERALL CONCLUSIONS – low level:

• Several new patterns (fortification, triangle-laws, conn. components, etc)

• New tools:

– anomaly detection (OddBall), belief propagation, immunization

• Scalability: PEGASUS / hadoop

Google'11

Page 128: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 128

OVERALL CONCLUSIONS – high level

• Large datasets reveal patterns/outliers that are invisible otherwise

• Terrific opportunities

– Large datasets, easily(*) available PLUS

– s/w and h/w developments

Google'11

Page 129: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 129

References• Leman Akoglu, Christos Faloutsos: RTG: A Recursive

Realistic Graph Generator Using Random Typing. ECML/PKDD (1) 2009: 13-28

• Deepayan Chakrabarti, Christos Faloutsos: Graph mining: Laws, generators, and algorithms. ACM Comput. Surv. 38(1): (2006)

Google'11

Page 130: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 130

References• Deepayan Chakrabarti, Yang Wang, Chenxi Wang, Jure

Leskovec, Christos Faloutsos: Epidemic thresholds in real networks. ACM Trans. Inf. Syst. Secur. 10(4): (2008)

• Deepayan Chakrabarti, Jure Leskovec, Christos Faloutsos, Samuel Madden, Carlos Guestrin, Michalis Faloutsos: Information Survival Threshold in Sensor and P2P Networks. INFOCOM 2007: 1316-1324

Google'11

Page 131: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 131

References• Christos Faloutsos, Tamara G. Kolda, Jimeng Sun:

Mining large graphs and streams using matrix and tensor tools. Tutorial, SIGMOD Conference 2007: 1174

Google'11

Page 132: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 132

References• T. G. Kolda and J. Sun. Scalable Tensor

Decompositions for Multi-aspect Data Mining. In: ICDM 2008, pp. 363-372, December 2008.

Google'11

Page 133: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 133

References• Jure Leskovec, Jon Kleinberg and Christos Faloutsos

Graphs over Time: Densification Laws, Shrinking Diameters and Possible Explanations, KDD 2005 (Best Research paper award).

• Jure Leskovec, Deepayan Chakrabarti, Jon M. Kleinberg, Christos Faloutsos: Realistic, Mathematically Tractable Graph Generation and Evolution, Using Kronecker Multiplication. PKDD 2005: 133-145

Google'11

Page 134: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 134

References• Jimeng Sun, Yinglian Xie, Hui Zhang, Christos

Faloutsos. Less is More: Compact Matrix Decomposition for Large Sparse Graphs, SDM, Minneapolis, Minnesota, Apr 2007.

• Jimeng Sun, Spiros Papadimitriou, Philip S. Yu, and Christos Faloutsos, GraphScope: Parameter-free Mining of Large Time-evolving Graphs ACM SIGKDD Conference, San Jose, CA, August 2007

Google'11

Page 135: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

References

• Jimeng Sun, Dacheng Tao, Christos Faloutsos: Beyond streams and graphs: dynamic tensor analysis. KDD 2006: 374-383

Google'11 C. Faloutsos (CMU + Google) 135

Page 136: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 136

References

• Hanghang Tong, Christos Faloutsos, and Jia-Yu Pan, Fast Random Walk with Restart and Its Applications, ICDM 2006, Hong Kong.

• Hanghang Tong, Christos Faloutsos, Center-Piece Subgraphs: Problem Definition and Fast Solutions, KDD 2006, Philadelphia, PA

Google'11

Page 137: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 137

References

• Hanghang Tong, Christos Faloutsos, Brian Gallagher, Tina Eliassi-Rad: Fast best-effort pattern matching in large attributed graphs. KDD 2007: 737-746

Google'11

Page 138: Mining Billion-node Graphs: Patterns, Generators and Tools

CMU SCS

C. Faloutsos (CMU + Google) 138

Project info

Akoglu, Leman

Chau, Polo

Kang, U

McGlohon, Mary

Tong, Hanghang

Prakash,Aditya

Google'11

Thanks to: NSF IIS-0705359, IIS-0534205, CTA-INARC; Yahoo (M45), LLNL, IBM, SPRINT, Google, INTEL, HP, iLab

www.cs.cmu.edu/~pegasus