1. CPT-S 415 Topics in Computer Science Big Data
Yinghui Wu
EME B45

2. How to make big data small
Input: A class Q of queries
Question: Can we effectively find, given queries Q  Q and any (possibly big) data D, a small DQ such that
Q(D) = Q(DQ)? D
Q( )
Q( ) DQ
Much smaller than D
Data synopsis
Boundedly evaluable queries
Query answering using views
Incremental evaluation
Distributed query processing
Effective methods for making big data small 2

3. Data-driven approximation for bounded resources

4. Traditional approximation theory
Traditional approximation algorithms T: for an NPO (NP-complete optimization problem),
for each instance x, T(x) computes a feasible solution y
quality metric f(x, y)
performance ratio : for all x,
Minimization: OPT(x)  f(x, y)   OPT(x)
Maximization: 1/ OPT(x)  f(x, y)  OPT(x)
OPT(x): optimal solution,   1
Does it work when it comes to querying big data?

5. The approximation theory revisited
Traditional approximation algorithms T: for an NPO
for each instance x, T(x) computes a feasible solution y
quality metric f(x, y)
performance ratio (minimization): for all x,
OPT(x)  f(x, y)   OPT(x)
Big data?
Approximation: for even low PTIME problems, not just NPO
Quality metric: answer to a query is not necessarily a number
Approach: it does not help much if T(x) conducts computation on “big” data x directly!
A quest for revising approximation algorithms for querying big data

6. Data-driven: Resource bounded query answering
Input: A class Q of queries, a resource ratio   [0, 1), and a performance ratio   (0, 1]
Question: Develop an algorithm that given any query Q  Q and dataset D,
accesses a fraction D of D such that |D|  |D|
computes as Q(D) as approximate answers to Q(D), and
accuracy(Q, D, )  
Computing graph matches in batch style is expensive.
We find new matches by making maximal use of previous computation, without paying the price of the high complexity of graph pattern matching.
Q( D )
dynamic reduction D D Q
approximation Q’
Q’( D )
Accessing |D| amount of data in the entire process 6

7. Resource bounded query answering
Q( D )
dynamic reduction D D Q
approximation
Q( D )
Resource bounded: resource ratio   [0, 1)
decided by our available resources: time, space, energy…
Dynamic reduction: given Q and D
find D for all Q
histogram, wavelets, sketches, sampling, …
In combination with other tricks for making big data small

8. Personalized social search
Graph Search, Facebook
Find me all my friends who live in Seattle and like cycling
Find me restaurants in London my friends have been to
Find me photos of my friends in New York
Localized patterns
personalized social search with  = %!
with near 100% accuracy
1.5 * 10-6 * 1PB (1015B/106GB) = 15 * 109 = 15GB
We are making big graphs of PB size as small as 15GB
Add to this data synopses, schema, distributed, views, …
make big graphs of PB size fit into our memory!

9. Personalized social search, ego network analysis, …
Localized queries
Localized queries: can be answered locally
Graph pattern queries: revised simulation queries
matching relation over dQ-neighborhood of a personalized node
Michael: “find cycling fans who know both my friends in cycling club and my friends in hiking groups
Michael
hiking
group
cycling club
member
?cycling lovers
(unique match)
hiking group …
cycling fans
hgm
hg1
hg2
cc1
cc2
cc3
cl1
cl2
cln-1
cln
Personalized node
Personalized social search, ego network analysis, …

10. Resource-bounded simulation
9/11/2018
Resource-bounded simulation
Preprocessing
(auxiliary information)
dynamic reduction
(compute reduced subgraph)
Approximate query evaluation over reduced subgraph
local auxiliary information
If v is included, the number of additional nodes that need also to be included – budget
degree
|neighbor|
<label, frequency> … G Q u v u v ？
Dynamically updated auxiliary information
Boolean guarded condition: label matching
Cost c(u,v)
Potential p(u,v), estimated probability that v matches u
bound b of the number of nodes to be visited
Auxiliary structure u v
label
match
The probability for v to match u (total number of nodes in the neighbor of v that are candidate matches
Query guided search – potential/cost estimation

11. Resource-bounded simulation
9/11/2018
Resource-bounded simulation
preprocessing
dynamic reduction
(compute reduced subgraph)
Approximate query evaluation over reduced subgraph
bound = 18
visited = 16
Match relation:
(Michael, Michael),
(hiking group, hgm), (cycling club, cc1),
(cycling club, cc3),
(cycling lover, cln-1),
(cycling lover, cln)
TRUE
Cost=1
Potential=3
Bound =2
TRUE
Cost=1
Potential=2
Bound =2
Michael
hiking group …
cycling club
member
cycling fans
hgm
hg1
hg2
cc1
cc2
cc3
cl1
cl2
cln-1
cln
cycling club
cc1
cc2
cc3
member
hgm
hiking
group
hiking group
Michael
hiking
group
cycling club
?cycling lovers
?cycling lovers
cln-1
cln
cycling fans
Auxiliary structure
FALSE -
Dynamic data reduction and query-guided search

12. Non-localized queries
Reachability
Input: A directed graph G, and a pair of nodes s and t in G
Question: Does there exist a path from s to t in G?
Non-localized: t may be far from s
Michael
cc1
cl3
cl7
cln-1
cl4
cl9
cl5 …
cl6
cl16
Eric
Is Michael connected to Eric via social links?
Does dynamic reduction work for non-localized queries?

13. Resource-bounded reachability
Reduction
size |GQ| <= α|G|
Reachability query
results
Approximation
(experimentally
Verified; no false positive,
in time O(α|G|)
big graph G
small tree index GQ
O(|G|)
dynamic reduction for non-localized queries

14. Preprocessing: landmarks
9/11/2018
Preprocessing: landmarks
Preprocessing
dynamic reduction
(compute landmark index)
Approximate query evaluation over landmark index
Michael
cl5
Recall Landmarks
a landmark node covers certain number of node pairs
Reachability of the pairs it covers can be computed by landmark labels …
cl9
cc1 …
cl4
cl6
cl7
cl3 …
cl16
Big picture
cln-1
cc1 “I can reach cl3”
cl4
cl6
cl3 …
cl16
Eric
cln-1, “cl3 can reach me”
<= α|G|
Search landmark index instead of G

15. Hierarchical landmark Index
9/11/2018
Hierarchical landmark Index
Landmark Index
landmark nodes are selected to encode pairwise reachability
Hierarchical indexing: apply multiple rounds of landmark selection to construct a tree of landmarks
Michael
cc1
cl3
cl7
cln-1
cl4
cl9
cl5 …
cl6
cl16
Eric
cl4
cl3
cl5
cl6 … …
cc1
cl7
cln-1
cl9
cl16
Big picture
v can reach v’ if there exists v1, v2, v2 in the index such that v reaches v1, v2 reaches v’, and v1 and v2 are connected to v3 at the same level

16. Hierarchical landmark Index
9/11/2018
Hierarchical landmark Index
Boolean guarded condition (v, vp, v’)
Cost c(v): size of unvisited landmarks in the subtree rooted at v
Potential P(v), total cover size of unvisited landmarks as the children of v
cl4
cl3
cl5
cl6
Cover size
Landmark labels/encoding
Topological rank/range … …
cc1
cl7
cln-1
cl9
cl16
Big picture
Guided search on landmark index

17. Resource-bounded reachability
9/11/2018
Resource-bounded reachability
Preprocessing
dynamic reduction
(compute landmark index)
Approximate query evaluation over landmark index
bi-directed guided traversal
Condition = ?
Cost=9
Potential = 46
Condition = TRUE …
Michael
cl5
cl4
Condition = ?
Cost=2
Potential = 9 …
cl9
“drill down”?
“roll up”
cl3
cl5
cl6
cc1 …
cl4
cl6 … …
cl7
cl3
cl16
cc1
cl7
cln-1
cl9
cl16 …
algorithm
local auxiliary
information
cln-1
Condition = FALSE -
Michael
Eric
Eric
Drill down and roll up

18. Answering queries using views19

19. Data-driven Approximate Query Processing
“Big Data”
Query
Exact Answer
Long Response Times!
Compact
Data Synopses
Views
“Small Data”
Query
KB/MB
Approximate Answer
FAST!!

20. How to make big data small
Input: A class Q of queries
Question: Can we effectively find, given queries Q  Q and any (possibly big) data D, a small DQ such that
Q(D) = Q(DQ)? D
Q( )
Q( ) DQ
Much smaller than D
Data synopsis
Boundedly evaluable queries
Query answering using views
Incremental evaluation
Distributed query processing
Effective methods for making big data small 21

21. Answering queries using views
The cost of query processing: f(|D|, |Q|)
Query answering using views: given a query Q in a language L and a set V views, find another query Q’ such that
Q and Q’ are equivalent
Q’ only accesses V(D )
can we compute Q(G) without accessing G, i.e., independent of |G|?
for any G, Q(G) = Q’(G) D
Q( )
Q’( )
V(D)
Answering pattern queries on big data:
Regardless of how big D is – the cost is “independent” of D
V(D ) is often much smaller than D (4% -- 12% on real-life data)
The complexity is no longer a function of |D| 22 22

22. Answering query using views
9/11/2018
Answering query using views
query A
database D
database
views V(D)
Q(D)
query result
query Q
A(V)
When possible?
What to choose?
How to evaluate?
Challenge:
1995
2000
2011
relational algebra
2002
XPath
2007
XML
2006
tree pattern query
1998
regular path queries
RDF/SPARQL
A classical techniques

23. Views revisited for Relational Data
Views are relations, except that they are not physically stored.
a logical or virtual table based on a query.
useful to think of a view as a stored query.
Views are created through use of a CREATE VIEW
command that incorporates use of the SELECT statement.
Views are queried just like tables.
For presenting different information to different users
Employee(ssn, name, department, project, salary)
Payroll has access to Employee, others only to Developers
CREATE VIEW Developers AS
SELECT name, project
FROM Employee
WHERE department = “Development”

24. Types of Views Virtual views: Materialized views Used in databases
Computed only on-demand – slower at runtime
Always up to date
Materialized views
A view whose tuples are stored in the database is said to be materialized
Provides fast access, like a (very high-level) cache.
Need to maintain the view as the underlying tables change.
Ideally, incremental view maintenance algorithms.
Used in data warehouses
Precomputed offline – faster at runtime

25. A View Definition Person(name, city)
Purchase(buyer, seller, product, store)
Product(name, maker, category)
We have a new virtual table:
Pullman-view(buyer, seller, product, store)
CREATE VIEW Pullman-view AS
SELECT buyer, seller, product, store
FROM Person, Purchase
WHERE Person.city = “Pullman” AND
Person.name = Purchase.buyer

26. Application: Querying the WWW
Assume a virtual schema, e.g.,
Course(number, university, title, prof, quarter)
Every data source on the web contains the answer to a view over the virtual schema:
WSU database: SELECT number, title, prof
FROM Course
WHERE univ=‘WSU’ AND quarter=‘09/15’
Stanford database: SELECT number, title, prof, quarter
WHERE univ=‘Stanford’
User query: find all professors who teach “database systems”

27. Answering Queries Using Views
What if we want to use a set of views to answer a query?
Given a query Q and a set of view definitions V1,…,Vn:
Is it possible to answer Q using only the V’s?
Why?
The obvious reason…
Answering queries vs big variety.
Data integration and knowledge integration
How? Query Rewriting and Query Answering
Query rewriting based on schema information
Query containment and minimization
Query answering without schema information

28. Query answering using views: what can go wrong?
I still have only the result of PullmanView:
SELECT buyer, seller, product, store
FROM Person, Purchase
WHERE Person.city = ‘Pullman’ AND
Person.per-name = Purchase.buyer
but I want to answer the query
SELECT buyer, seller
Person.per-name = Purchase.buyer AND
Person.Phone LIKE ‘ %’.

29. Another example Query: q(X,Z) :- r(X,Y), s(Y,Z), t(X,Z), Y > 5.
What can go wrong?
V1(A,B) :- r(A,C), s(C1,B) (join predicate not applied)
V2(A,B) :- r(A,C), s(C,B), C > 1 (predicate too weak).
V3(A,B) :- r(A,B), r1(A,B) (irrelevant condition).
V4(A) :- r(A,B), s(B,C), t(A,C), B > 5:
needed argument is projected out. Can be recovered
if we have a functional dependency t: A --> C.

30. Dimensions of Query Rewriting Problem
View definition language
Query language
Equivalent or maximally contained rewriting (When?)
Query evaluation (How?)
Selection of views (What to select?)
Completeness/soundness of the views
Output: query execution plan or logical plan.

31. Query Containment and Equivalence: Definitions
Query Q1 contained in query Q2 if for every database D
Q1(D)  Q2(D)
Query Q1 is equivalent to query Q2 if Q1(D)  Q2(D) and Q2(D)  Q1(D)
Original query:
SELECT buyer, seller
FROM Person, Purchase
WHERE Person.city = ‘Pullman’
AND Person.per-name = Purchase.buyer
AND Purchase.product=‘gizmo’
Rewritten query:
SELECT buyer, seller
FROM PullmanView
WHERE product= ‘gizmo’
Note: properties of the queries, not of the database!

32. Query Rewriting: issues
Given a query Q and a set of view definitions V1,…,Vn
Q’ is a rewriting of the query using V’s if it refers only to the views or to interpreted predicates.
Q’ is an equivalent rewriting of Q using the V’s if Q’ is equivalent to Q.
Q’ is a maximally-contained rewriting of Q w.r.t. L using the V’s if there is no other Q’’ such that: Q’’ strictly contains Q’, and Q’’ is contained in Q.
The rewriting problem is NP-hard.

33. Certain Answers Schema: friends(X,Y)
Given: A query Q, View definitions V1,…Vn,
Extensions of the views: v1,…vn i.e. materialized views
Consider the set of databases D that are consistent with
V1,…Vn and v1,…vn.
The tuple t is a certain answer to Q if it would be an answer
in every database in D.
Note: an equivalent rewriting provides all certain answers.
Schema: friends(X,Y)
T1: select X from friends (X,Y): extension: {HarryPotter}
T2: select Y from friends (X,Y): extension: {RonWeasley}
Query: select (x,y) from friends (X,Y)
{HarryPotter,
RonWeasley}

34. Finding All Answers from Views
If a rewriting is equivalent: you definitely get all answers
So what is the complexity of finding all the answers?
[Abiteboul & Duschka, PODS-98],
[Grahne and Mendelzon, ICDT-99]: surprisingly hard!
Certain answers:
Given specific extensions v1,…vn to the view,
is the tuple t is an answer in every database D that is
consistent with the extensions v1,…,vn?

35. Why & When is it Hard? Sources can be: sound (open world assumption)
complete
sound and complete (closed-world assumption)
If sources are either all sound or all complete, then
maximally-contained rewriting exists.
If sources are sound and complete, the problem is NP-complete.
Schema: friends (X,Y)
T1: select X from friends (X,Y): extension: {a}
T2: select Y from friends (X,Y): extension: {b}
Query: select (x,y) from friends (X,Y)
{a, b} ?

36. Query Rewriting Using Views
Original query: SELECT buyer, seller FROM Person, Purchase WHERE Person.city = ‘Pullman’ AND Person.per-name = Purchase.buyer AND Purchase.product=‘gizmo’. Rewritten query: FROM PullmanView WHERE product= ‘gizmo’
Pullman-view(buyer, seller, product, store)

37. Graph pattern matching using views

38. Answering query using views
9/11/2018
Answering query using views
query A
database D
database
views V(D)
Q(D)
query result
query Q
A(V)
When possible?
What to choose?
How to evaluate?
1995
2000
2011
relational algebra
2002
XPath
2007
XML
2006
tree pattern query
1998
regular path queries
RDF/SPARQL
graph pattern query simulation
Challenge:
A classical techniques, but still in their infancy for graphs

39. Graph pattern matching by graph simulation
Input: A directed graph G, and a graph pattern Q
Output: the maximum simulation relation R
Maximum simulation relation: always exists and is unique
If a match relation exists, then there exists a maximum one
Otherwise, it is the empty set – still maximum
Complexity: O((| V | + | VQ |) (| E | + | EQ| )
The output is a unique relation, possibly of size |Q||V|
Using views? Incremental? 40

40. Querying collaborative network
PM 2
PM 1
customer 2
customer 1
developer 2
developer 3
developer 1
customer 3
A collaborative (chat) network
developer k
customer n …
tester
expensive!
customer
developer
project
manager
query 1
Customer
query 2
PM 2
PM 1
customer 2
developer 3
developer 2
customer 3
customer
developer
project
manager
A collaborative pattern
views
Amrit Chintan et al, Information System management, 2010
Detecting Coordination Problems in Collaborative Software Development Environments,

41. patterns and views view 1 (view definition) pattern query
9/11/2018
patterns and views
view definition 2
customer
developer
project
manager
view definition 1
view 1
view 2
view extension 1
view extension 2
customer 2
developer 3
developer 2
customer 3
(view definition)
edges
matches
(project manager, developer)
{(PM 1, developer 2),
(PM 2, developer 3)}
(project manager, customer)
{(PM 1, customer 2),
(PM 2, customer 2),
customer
developer
pattern query
query result
edges
matches
(customer, developer)
{(customer 2, developer 2),
(customer 3, developer 3)}
(developer, customer)
{(developer 2, customer 2),
(developer 2, customer 3),
(developer 3, customer 2)}
edges
matches
(customer, developer)
{(customer 2, developer 2),
(customer 3, developer 3)}
(developer, customer)
{(developer 2, customer 2),
(developer 2, customer 3),
(developer 3, customer 2)}
binary relation
node match: satisfies predicates
edge match: connects two node matches
Theories of answering queries using views, A.Y.Halevy, SIGMOD record.
We are not addressing rich semantics of node label; also we are not addressing integration.
(view extension)

42. When a pattern can be matched using views
9/11/2018
When a pattern can be matched using views
Give a picture here.
A necessary and sufficient condition
Pattern containment: a characterization

43. Pattern containment How to determine the existence of ?
9/11/2018
Pattern containment
(project manager, developer)
(PM 1, developer 2)
(project manager, customer)
(PM 1, customer 2)
(developer, customer)
(developer 2, customer 2)
(customer, developer)
(customer 2, developer 2)
customer
developer
project
manager
Query result
customer
developer
project
manager
View 1
customer
developer
View 2
Give a picture here.
(project manager, developer)
{(PM 1, developer 2),
(PM 2, developer 3)}
(project manager, customer)
{(PM 1, customer 2),
(PM 2, customer 2)}
(customer, developer)
{(customer 2, developer 2),
(customer 3, developer 3)}
(developer, customer)
{(developer 2, customer 2),
(developer 2, customer 3),
(developer 3, customer 2)}
How to determine the existence of ?

44. Determining Pattern containment
NP-complete for relational conjunctive queries, undecidable for relational algebra
A practical characterization: patterns are small in practice

45. Pattern containment: example
customer
developer
project
manager
View 1 λ
customer
project
manager
developer
view matches
customer
developer
project
manager
query
as “data graph”
Query containment: given Q and Q’, it is to determine whether for any graph G, Q(G) is contained in Q’(G)?
A classical problem.
What is its complexity for pattern queries?
customer
developer
View 2
efficient
V: the set of views; Q: query

46. Query evaluation using views
9/11/2018
Query evaluation using views
Input: pattern query Q, graph G, a set of views V and extensions in G, and a mapping λ
Output: Find the query result Q(G)
Algorithm
Collect edge matches for each query edge e and λ(e)
Iteratively remove non-matches until no change happens
Return Q(G)
Recall simulation algorithm
More efficient.
Q(G) can be evaluated in O(|Q||V(G)| + |V(G)|2) time

47. Query evaluation using views
customer
developer
query
project
manager
“bottom-up” strategy
(project manager, developer)
{(PM 1, developer 2),
(PM 2, developer 3)}
(project manager, customer)
{(PM 1, customer 2),
(PM 2, customer 2)}
(developer, customer)
{(developer 2, customer 2),
(developer 2, customer 3),
(developer 3, customer 2)}
(customer, developer)
{(customer 2, developer 2),
(customer 3, developer 3)}
customer
developer
project
manager
View 1
Query result
customer
developer
View 2
(project manager, developer)
{(PM 1, developer 2),
(PM 2, developer 3)}
(project manager, customer)
{(PM 1, customer 2),
(PM 2, customer 2)}
(customer, developer)
{(customer 2, developer 2),
(customer 3, developer 3)}
(developer, customer)
{(developer 2, customer 2),
(developer 2, customer 3),
(developer 3, customer 2)}
4% -- 12% of G
Are we done yet?
Without accessing the underlying big graph G

48. What views to choose? Why do we care? efficiency choose all? query
customer
software
project
manager
customer
developer
project
manager
customer
developer
software
tester
view 1
view 2
query
customer
developer
project
manager
software
customer
developer
project
manager
software
customer
developer
software
tester
developer
software
view 3
view 4
efficiency
view 6
view 5
Why do we care?

49. Minimum containment Minimum containment is NP-complete
9/11/2018
Minimum containment
Minimum containment is NP-complete
APX-hard as optimization
- no PTIME algorithm that gives approx. ratio within arbitrarily given constant factor
two options
What can we do?

50. An log|Ep|-approximation
Idea: greedily select views V that “cover” more query edges
Ec: already covered
To decide whether to include a particular view V
Approximation: performance guarantees

51. Minimum containment: exampleEc
project
manager
customer
software
customer
developer
project
manager
customer
developer
software
tester
view 1
view 2
query
customer
developer
project manager
software
customer
developer
project manager
software
customer
developer
software
tester
developer
software
view 3
view 4
view 5
view 6
Greedy: based on the metric

52. Minimal containment O(|Q|2 card(V) + |V|2 + |Q| |V|) time Algorithm
9/11/2018
Minimal containment
O(|Q|2 card(V) + |V|2 + |Q| |V|) time
Algorithm
Computes view match for each view
Iteratively selects a view that extends Ec
Repeats until Ec= Ep or return empty set
new addition
Minimal containment is in PTIME

53. Minimal containment: example
project
manager
customer
developer
project
manager
customer
software
customer
developer
software
view 1
tester
view 2
query
customer
developer
project manager
software
customer
developer
project manager
software
customer
developer
software
tester
developer
software
view 3
view 4
view 5
view 6
Eliminate redundant views

54. The study is still in its infancy for graph queries
9/11/2018
Putting together
Problem
Complexity
Algorithm
containment
PTIME
O(card(V)|Q|2+|V|2+|Q||V|)
minimum
NP-c/APX-hard
log|Ep|-approximable
O(card(V)|Q|2+|V|2+|Q||V|+|Q|card(V)3/2)
minimal
evaluation
O(|Q||V(G)| + |V(G)|2)
characterization: sufficient and necessary condition for deciding whether a query can be answered using a set of views
evaluation: how to evaluate queries using views
view section: what views to choose for answering queries
Subgraph isomorphism?
View maintenance?
The study is still in its infancy for graph queries

55. Summing up 57

56. Combinations of these are more effective
Making big data small
Yes, it is doable!
Approximate query models (query-driven approximation)
Data synopsis: property preserving (data-driven approximation)
Bounded evaluable queries: dynamic reduction (principled search scheme)
Query answering using views: (make big data small)
query evaluation by only accessing views
Incremental query answering: (coping with dynamic data)
depending on the size of the changes rather than the size of the original big data
. . .
Combinations of these are more effective 58

57. Summary and review What is query answering using views?
What is query containment? What is the complexity of deciding query containment for relations? For XML? Graph pattern queries via graph simulation?
What questions do we have to answer for answering graph queries using views?
What is incremental query evaluation? What are the benefits?
What is a unit update? Batch updates?
When can we say that an incremental problem is bounded? Semi-bounded?
How to show that an incremental problem is bounded? How to disprove it?

58. Papers for you to review
W. Le, S. Duan, A. Kementsietsidis, F. Li, and M. Wang. Rewriting queries on SPARQL views. In WWW, 2011.
D. Saha. An incremental bisimulation algorithm. In FSTTCS, pdf
S. K. Shukla, E. K. Shukla, D. J. Rosenkrantz, H. B. H. Iii, and R. E. Stearns. The polynomial time decidability of simulation relations for finite state processes: A HORNSAT based approach. In DIMACS Ser. Discrete, (search Google Scholar)
W. Fan, X. Wang, and Y. Wu. Answering Graph Pattern Queries using Views, ICDE (query answering using views)
W. Fan, X. Wang, and Y. Wu. Incremental Graph Pattern Matching, TODS 38(3), (bounded incremental query answering)

59. Papers to read
Shoubridge P., Kraetzl M., Wallis W. D., Bunke H. Detection of Abnormal Change in a Time Series of Graphs. Journal of Interconnection Networks (JOIN) 3(1-2):85-101, 2002.
Shoubridge, P. Kraetzl, M. Ray, D. Detection of abnormal change in dynamic networks. Information, Decision and Control, 1999.
Kelly Marie Kapsabelis, Peter John Dickinson, Kutluyil Dogancay.
Investigation of graph edit distance cost functions for detection of network
anomalies. ANZIAM J. 48 (CTAC2006) pp.436–449, 2007.
Panagiotis Papadimitriou, Ali Dasdan, Hector Garcia-Molina. Web graph similarity for anomaly detection. J. Internet Services and Applications (JISA) 1(1): (2010)
B. Pincombe. Anomaly Detection in Time Series of Graphs using ARMA Processes. ASOR BULLETIN, 24(4):2, 2005.
Gao, Xinbo and Xiao, Bing and Tao, Dacheng and Li, Xuelong. A survey of graph edit distance. Pattern Anal. and App.s 13 (1), pp
Horst Bunke, Peter J. Dickinson, Andreas Humm, Christophe Irniger, Miro Kraetzl: Computer Network Monitoring and Abnormal Event Detection Using Graph Matching and Multidimensional Scaling. Industrial Conference on
Data Mining 2006:

60. Papers to read
C.E. Priebe, J.M. Conroy, D.J. Marchette, and Y. Park. Scan Statistics on Enron Graphs. Computational & Mathematical Organization Theory, 11(3):229–247, 2005.
Ide, T. and Kashima, H., Eigenspace-Based Anomaly Detection in Computer Systems. KDD, 2004.
L. Akoglu, M. McGlohon, C. Faloutsos. Event Detection in Time Series of
Mobile Communication Graphs. Army Science Conference, 2010.
Sun, Jimeng and Xie, Yinglian and Zhang, Hui and Faloutsos, Christos. Less is more: Compact matrix representation of large sparse graphs. ICDM 2007.
Sun, Jimeng and Tao, Dacheng and Faloutsos, Christos. Beyond streams
and graphs: dynamic tensor analysis. KDD 2006:
Sun J., Faloutsos C., Papadimitriou S., Yu P. S. GraphScope: parameter-free mining of large time-evolving graphs. KDD, 2007.
R. Rossi, B. Gallagher, J. Neville, and K. Henderson. Role-Dynamics: Fast Mining of Large Dynamic Networks. 1st Workshop on Large Scale Network Analysis, WWW, 2012.
Cemal Cagatay Bilgin , Bülent Yener . Dynamic Network Evolution: Models, Clustering, Anomaly Detection. Survey, 2008.