1. CMU SCS Graph Mining - surprising patterns in real graphs Christos Faloutsos CMU

2. CMU SCS Graph Analytics wkshpC. Faloutsos (CMU) 2 Workshop overview TueWeThu 9:00-10:30ToolsLaplaciansParallelism 11:00-12:30NELLRich graphsCommunities 1:30-3:00ExercisesPanelScalability 3:30-5:00Graph. modelsPostersGraph ‘Laws’ Reception

3. CMU SCS C. Faloutsos (CMU) 3 Resource Open source system for mining huge graphs: PEGASUS project (PEta GrAph mining System) www.cs.cmu.edu/~pegasus code and papers Graph Analytics wkshp

4. CMU SCS C. Faloutsos (CMU) 4 Roadmap Introduction – Motivation Problem#1: Patterns in graphs Problem#2: Tools Problem#3: Scalability Conclusions Graph Analytics wkshp

5. CMU SCS C. Faloutsos (CMU) 5 Graphs - why should we care? Internet Map [lumeta.com] Food Web [Martinez ’91] >$10B revenue >0.5B users Graph Analytics wkshp

6. CMU SCS C. Faloutsos (CMU) 6 Graphs - why should we care? IR: bi-partite graphs (doc-terms) web: hyper-text graph... and more: D1D1 DNDN T1T1 TMTM... Graph Analytics wkshp

7. CMU SCS C. Faloutsos (CMU) 7 Graphs - why should we care? ‘viral’ marketing web-log (‘blog’) news propagation computer network security: email/IP traffic and anomaly detection.... Graph Analytics wkshp

8. CMU SCS C. Faloutsos (CMU) 8 Outline Introduction – Motivation Problem#1: Patterns in graphs –Static graphs –Weighted graphs –Time evolving graphs Problem#2: Tools Problem#3: Scalability Conclusions Graph Analytics wkshp

9. CMU SCS C. Faloutsos (CMU) 9 Problem #1 - network and graph mining What does the Internet look like? What does FaceBook look like? What is ‘normal’/‘abnormal’? which patterns/laws hold? Graph Analytics wkshp

10. CMU SCS C. Faloutsos (CMU) 10 Problem #1 - network and graph mining What does the Internet look like? What does FaceBook look like? What is ‘normal’/‘abnormal’? which patterns/laws hold? –To spot anomalies (rarities), we have to discover patterns Graph Analytics wkshp

11. CMU SCS C. Faloutsos (CMU) 11 Problem #1 - network and graph mining What does the Internet look like? What does FaceBook look like? What is ‘normal’/‘abnormal’? which patterns/laws hold? –To spot anomalies (rarities), we have to discover patterns –Large datasets reveal patterns/anomalies that may be invisible otherwise… Graph Analytics wkshp

12. CMU SCS C. Faloutsos (CMU) 12 Graph mining Are real graphs random? Graph Analytics wkshp

13. CMU SCS C. Faloutsos (CMU) 13 Laws and patterns Are real graphs random? A: NO!! –Diameter –in- and out- degree distributions –other (surprising) patterns So, let’s look at the data Graph Analytics wkshp

14. CMU SCS C. Faloutsos (CMU) 14 Solution# S.1 Power law in the degree distribution [SIGCOMM99] log(rank) log(degree) internet domains att.com ibm.com Graph Analytics wkshp

15. CMU SCS C. Faloutsos (CMU) 15 Solution# S.1 Power law in the degree distribution [SIGCOMM99] log(rank) log(degree) -0.82 internet domains att.com ibm.com Graph Analytics wkshp

16. CMU SCS C. Faloutsos (CMU) 16 Solution# S.2: Eigen Exponent E A2: power law in the eigenvalues of the adjacency matrix E = -0.48 Exponent = slope Eigenvalue Rank of decreasing eigenvalue May 2001 Graph Analytics wkshp

17. CMU SCS C. Faloutsos (CMU) 17 Solution# S.2: Eigen Exponent E [Mihail, Papadimitriou ’02]: slope is ½ of rank exponent E = -0.48 Exponent = slope Eigenvalue Rank of decreasing eigenvalue May 2001 Graph Analytics wkshp

18. CMU SCS C. Faloutsos (CMU) 18 But: How about graphs from other domains? Graph Analytics wkshp

19. CMU SCS C. Faloutsos (CMU) 19 More power laws: web hit counts [w/ A. Montgomery] Web Site Traffic in-degree (log scale) Count (log scale) Zipf users sites ``ebay’’ Graph Analytics wkshp

20. CMU SCS C. Faloutsos (CMU) 20 epinions.com who-trusts-whom [Richardson + Domingos, KDD 2001] (out) degree count trusts-2000-people user Graph Analytics wkshp

21. CMU SCS And numerous more # of sexual contacts Income [Pareto] –’80-20 distribution’ Duration of downloads [Bestavros+] Duration of UNIX jobs (‘mice and elephants’) Size of files of a user … ‘Black swans’ Graph Analytics wkshpC. Faloutsos (CMU) 21

22. CMU SCS C. Faloutsos (CMU) 22 Roadmap Introduction – Motivation Problem#1: Patterns in graphs –Static graphs degree, diameter, eigen, triangles cliques –Weighted graphs –Time evolving graphs Problem#2: Tools Graph Analytics wkshp

23. CMU SCS C. Faloutsos (CMU) 23 Solution# S.3: Triangle ‘Laws’ Real social networks have a lot of triangles Graph Analytics wkshp

24. CMU SCS C. Faloutsos (CMU) 24 Solution# S.3: Triangle ‘Laws’ Real social networks have a lot of triangles –Friends of friends are friends Any patterns? Graph Analytics wkshp

25. CMU SCS C. Faloutsos (CMU) 25 Triangle Law: #S.3 [Tsourakakis ICDM 2008] ASNHEP-TH Epinions X-axis: # of participating triangles Y: count (~ pdf) Graph Analytics wkshp

26. CMU SCS C. Faloutsos (CMU) 26 Triangle Law: #S.3 [Tsourakakis ICDM 2008] ASNHEP-TH Epinions Graph Analytics wkshp X-axis: # of participating triangles Y: count (~ pdf)

27. CMU SCS C. Faloutsos (CMU) 27 Triangle Law: #S.4 [Tsourakakis ICDM 2008] SNReuters Epinions X-axis: degree Y-axis: mean # triangles n friends -> ~n 1.6 triangles Graph Analytics wkshp

28. CMU SCS C. Faloutsos (CMU) 28 Triangle Law: Computations [Tsourakakis ICDM 2008] But: triangles are expensive to compute (3-way join; several approx. algos) Q: Can we do that quickly? details Graph Analytics wkshp

29. CMU SCS C. Faloutsos (CMU) 29 Triangle Law: Computations [Tsourakakis ICDM 2008] But: triangles are expensive to compute (3-way join; several approx. algos) Q: Can we do that quickly? A: Yes! #triangles = 1/6 Sum ( i 3 ) (and, because of skewness (S2), we only need the top few eigenvalues! details Graph Analytics wkshp

30. CMU SCS C. Faloutsos (CMU) 30 Triangle Law: Computations [Tsourakakis ICDM 2008] 1000x+ speed-up, >90% accuracy details Graph Analytics wkshp

31. CMU SCS Triangle counting for large graphs? Anomalous nodes in Twitter(~ 3 billion edges) [U Kang, Brendan Meeder, +, PAKDD’11] 31 Graph Analytics wkshp 31 C. Faloutsos (CMU)

32. CMU SCS Triangle counting for large graphs? Anomalous nodes in Twitter(~ 3 billion edges) [U Kang, Brendan Meeder, +, PAKDD’11] 32 Graph Analytics wkshp 32 C. Faloutsos (CMU)

33. CMU SCS Triangle counting for large graphs? Anomalous nodes in Twitter(~ 3 billion edges) [U Kang, Brendan Meeder, +, PAKDD’11] 33 Graph Analytics wkshp 33 C. Faloutsos (CMU)

34. CMU SCS Triangle counting for large graphs? Anomalous nodes in Twitter(~ 3 billion edges) [U Kang, Brendan Meeder, +, PAKDD’11] 34 Graph Analytics wkshp 34 C. Faloutsos (CMU)

35. CMU SCS EigenSpokes B. Aditya Prakash, Mukund Seshadri, Ashwin Sridharan, Sridhar Machiraju and Christos Faloutsos: EigenSpokes: Surprising Patterns and Scalable Community Chipping in Large Graphs, PAKDD 2010, Hyderabad, India, 21-24 June 2010. C. Faloutsos (CMU) 35 Graph Analytics wkshp

36. CMU SCS EigenSpokes Eigenvectors of adjacency matrix  equivalent to singular vectors (symmetric, undirected graph) 36 C. Faloutsos (CMU)Graph Analytics wkshp

37. CMU SCS EigenSpokes Eigenvectors of adjacency matrix  equivalent to singular vectors (symmetric, undirected graph) 37 C. Faloutsos (CMU)Graph Analytics wkshp N N details

38. CMU SCS EigenSpokes Eigenvectors of adjacency matrix  equivalent to singular vectors (symmetric, undirected graph) 38 C. Faloutsos (CMU)Graph Analytics wkshp N N details

39. CMU SCS EigenSpokes Eigenvectors of adjacency matrix  equivalent to singular vectors (symmetric, undirected graph) 39 C. Faloutsos (CMU)Graph Analytics wkshp N N details

40. CMU SCS EigenSpokes Eigenvectors of adjacency matrix  equivalent to singular vectors (symmetric, undirected graph) 40 C. Faloutsos (CMU)Graph Analytics wkshp N N details

41. CMU SCS EigenSpokes EE plot: Scatter plot of scores of u1 vs u2 One would expect –Many points @ origin –A few scattered ~randomly C. Faloutsos (CMU) 41 u1 u2 Graph Analytics wkshp 1 st Principal component 2 nd Principal component

42. CMU SCS EigenSpokes EE plot: Scatter plot of scores of u1 vs u2 One would expect –Many points @ origin –A few scattered ~randomly C. Faloutsos (CMU) 42 u1 u2 90 o Graph Analytics wkshp

43. CMU SCS EigenSpokes - pervasiveness Present in mobile social graph  across time and space Patent citation graph 43 C. Faloutsos (CMU)Graph Analytics wkshp

44. CMU SCS EigenSpokes - explanation Near-cliques, or near- bipartite-cores, loosely connected 44 C. Faloutsos (CMU)Graph Analytics wkshp

45. CMU SCS EigenSpokes - explanation Near-cliques, or near- bipartite-cores, loosely connected 45 C. Faloutsos (CMU)Graph Analytics wkshp

46. CMU SCS EigenSpokes - explanation Near-cliques, or near- bipartite-cores, loosely connected 46 C. Faloutsos (CMU)Graph Analytics wkshp

47. CMU SCS EigenSpokes - explanation Near-cliques, or near- bipartite-cores, loosely connected So what?  Extract nodes with high scores  high connectivity  Good “communities” spy plot of top 20 nodes 47 C. Faloutsos (CMU)Graph Analytics wkshp

48. CMU SCS Bipartite Communities! magnified bipartite community patents from same inventor(s) `cut-and-paste’ bibliography! 48 C. Faloutsos (CMU)Graph Analytics wkshp

49. CMU SCS C. Faloutsos (CMU) 49 Roadmap Introduction – Motivation Problem#1: Patterns in graphs –Static graphs degree, diameter, eigen, triangles cliques –Weighted graphs –Time evolving graphs Problem#2: Tools Graph Analytics wkshp

50. CMU SCS C. Faloutsos (CMU) 50 Observations on weighted graphs? A: yes - even more ‘laws’! M. McGlohon, L. Akoglu, and C. Faloutsos Weighted Graphs and Disconnected Components: Patterns and a Generator. SIG-KDD 2008 Graph Analytics wkshp

51. CMU SCS C. Faloutsos (CMU) 51 Observation W.1: Fortification Q: How do the weights of nodes relate to degree? Graph Analytics wkshp

52. CMU SCS C. Faloutsos (CMU) 52 Observation W.1: Fortification More donors, more $ ? $10 $5 Graph Analytics wkshp ‘Reagan’ ‘Clinton’ $7

53. CMU SCS Edges (# donors) In-weights ($) C. Faloutsos (CMU) 53 Observation W.1: fortification: Snapshot Power Law Weight: super-linear on in-degree exponent ‘iw’: 1.01 < iw < 1.26 Orgs-Candidates e.g. John Kerry, $10M received, from 1K donors More donors, even more $ $10 $5 Graph Analytics wkshp

54. CMU SCS C. Faloutsos (CMU) 54 Roadmap Introduction – Motivation Problem#1: Patterns in graphs –Static graphs –Weighted graphs –Time evolving graphs Problem#2: Tools … Graph Analytics wkshp

55. CMU SCS C. Faloutsos (CMU) 55 Problem: Time evolution with Jure Leskovec (CMU -> Stanford) and Jon Kleinberg (Cornell – sabb. @ CMU) Graph Analytics wkshp

56. CMU SCS C. Faloutsos (CMU) 56 T.1 Evolution of the Diameter Prior work on Power Law graphs hints at slowly growing diameter: –diameter ~ O(log N) –diameter ~ O(log log N) What is happening in real data? Graph Analytics wkshp

57. CMU SCS C. Faloutsos (CMU) 57 T.1 Evolution of the Diameter Prior work on Power Law graphs hints at slowly growing diameter: –diameter ~ O(log N) –diameter ~ O(log log N) What is happening in real data? Diameter shrinks over time Graph Analytics wkshp

58. CMU SCS C. Faloutsos (CMU) 58 T.1 Diameter – “Patents” Patent citation network 25 years of data @1999 –2.9 M nodes –16.5 M edges time [years] diameter Graph Analytics wkshp

59. CMU SCS C. Faloutsos (CMU) 59 T.2 Temporal Evolution of the Graphs N(t) … nodes at time t E(t) … edges at time t Suppose that N(t+1) = 2 * N(t) Q: what is your guess for E(t+1) =? 2 * E(t) Graph Analytics wkshp

60. CMU SCS C. Faloutsos (CMU) 60 T.2 Temporal Evolution of the Graphs N(t) … nodes at time t E(t) … edges at time t Suppose that N(t+1) = 2 * N(t) Q: what is your guess for E(t+1) =? 2 * E(t) A: over-doubled! –But obeying the ``Densification Power Law’’ Graph Analytics wkshp

61. CMU SCS C. Faloutsos (CMU) 61 T.2 Densification – Patent Citations Citations among patents granted @1999 –2.9 M nodes –16.5 M edges Each year is a datapoint N(t) E(t) 1.66 Graph Analytics wkshp

62. CMU SCS C. Faloutsos (CMU) 62 Roadmap Introduction – Motivation Problem#1: Patterns in graphs –Static graphs –Weighted graphs –Time evolving graphs Problem#2: Tools … Graph Analytics wkshp

63. CMU SCS C. Faloutsos (CMU) 63 More on Time-evolving graphs M. McGlohon, L. Akoglu, and C. Faloutsos Weighted Graphs and Disconnected Components: Patterns and a Generator. SIG-KDD 2008 Graph Analytics wkshp

64. CMU SCS C. Faloutsos (CMU) 64 Observation T.3: NLCC behavior Q: How do NLCC’s emerge and join with the GCC? (``NLCC’’ = non-largest conn. components) –Do they continue to grow in size? – or do they shrink? – or stabilize? Graph Analytics wkshp

65. CMU SCS C. Faloutsos (CMU) 65 Observation T.3: NLCC behavior Q: How do NLCC’s emerge and join with the GCC? (``NLCC’’ = non-largest conn. components) –Do they continue to grow in size? – or do they shrink? – or stabilize? Graph Analytics wkshp

66. CMU SCS C. Faloutsos (CMU) 66 Observation T.3: NLCC behavior Q: How do NLCC’s emerge and join with the GCC? (``NLCC’’ = non-largest conn. components) –Do they continue to grow in size? – or do they shrink? – or stabilize? Graph Analytics wkshp YES

67. CMU SCS C. Faloutsos (CMU) 67 Observation T.3: NLCC behavior After the gelling point, the GCC takes off, but NLCC’s remain ~constant (actually, oscillate). IMDB CC size Time-stamp Graph Analytics wkshp

68. CMU SCS C. Faloutsos (CMU) 68 Timing for Blogs with Mary McGlohon (CMU->Google) Jure Leskovec (CMU->Stanford) Natalie Glance (now at Google) Mat Hurst (now at MSR) [SDM’07] Graph Analytics wkshp

69. CMU SCS C. Faloutsos (CMU) 69 T.4 : popularity over time Post popularity drops-off – exponentially? lag: days after post # in links 1 2 3 @t @t + lag Graph Analytics wkshp

70. CMU SCS C. Faloutsos (CMU) 70 T.4 : popularity over time Post popularity drops-off – exponentially? POWER LAW! Exponent? # in links (log) days after post (log) Graph Analytics wkshp

71. CMU SCS C. Faloutsos (CMU) 71 T.4 : popularity over time Post popularity drops-off – exponentially? POWER LAW! Exponent? -1.6 close to -1.5: Barabasi’s stack model and like the zero-crossings of a random walk # in links (log) -1.6 days after post (log) Graph Analytics wkshp

72. CMU SCS Graph Analytics wkshpC. Faloutsos (CMU) 72 -1.5 slope J. G. Oliveira & A.-L. Barabási Human Dynamics: The Correspondence Patterns of Darwin and Einstein. Nature 437, 1251 (2005). [PDF]PDF Response time (log) Prob(RT > x) (log)

73. CMU SCS T.5: duration of phonecalls Surprising Patterns for the Call Duration Distribution of Mobile Phone Users Pedro O. S. Vaz de Melo, Leman Akoglu, Christos Faloutsos, Antonio A. F. Loureiro PKDD 2010 Graph Analytics wkshpC. Faloutsos (CMU) 73

74. CMU SCS Probably, power law (?) Graph Analytics wkshpC. Faloutsos (CMU) 74 ??

75. CMU SCS No Power Law! Graph Analytics wkshpC. Faloutsos (CMU) 75

76. CMU SCS ‘TLaC: Lazy Contractor’ The longer a task (phonecall) has taken, The even longer it will take Graph Analytics wkshpC. Faloutsos (CMU) 76 Odds ratio= Casualties(<x): Survivors(>=x) == power law

77. CMU SCS 77 Data Description Data from a private mobile operator of a large city 4 months of data 3.1 million users more than 1 billion phone records Over 96% of ‘talkative’ users obeyed a TLAC distribution (‘talkative’: >30 calls) Graph Analytics wkshpC. Faloutsos (CMU)

78. CMU SCS Outliers: Graph Analytics wkshpC. Faloutsos (CMU) 78

79. CMU SCS C. Faloutsos (CMU) 79 Roadmap Introduction – Motivation Problem#1: Patterns in graphs Problem#2: Tools –OddBall (anomaly detection) –Belief Propagation –Immunization Problem#3: Scalability Conclusions Graph Analytics wkshp

80. CMU SCS OddBall: Spotting A nomalies in Weighted Graphs Leman Akoglu, Mary McGlohon, Christos Faloutsos Carnegie Mellon University School of Computer Science PAKDD 2010, Hyderabad, India

81. CMU SCS Main idea For each node, extract ‘ego-net’ (=1-step-away neighbors) Extract features (#edges, total weight, etc etc) Compare with the rest of the population C. Faloutsos (CMU) 81 Graph Analytics wkshp

82. CMU SCS What is an egonet? ego 82 egonet C. Faloutsos (CMU)Graph Analytics wkshp

83. CMU SCS Selected Features  N i : number of neighbors (degree) of ego i  E i : number of edges in egonet i  W i : total weight of egonet i  λ w,i : principal eigenvalue of the weighted adjacency matrix of egonet I 83 C. Faloutsos (CMU)Graph Analytics wkshp

84. CMU SCS Near-Clique/Star 84 Graph Analytics wkshpC. Faloutsos (CMU)

85. CMU SCS Near-Clique/Star 85 C. Faloutsos (CMU)Graph Analytics wkshp

86. CMU SCS Near-Clique/Star 86 C. Faloutsos (CMU)Graph Analytics wkshp

87. CMU SCS Andrew Lewis (director) Near-Clique/Star 87 C. Faloutsos (CMU)Graph Analytics wkshp

88. CMU SCS C. Faloutsos (CMU) 88 Roadmap Introduction – Motivation Problem#1: Patterns in graphs Problem#2: Tools –OddBall (anomaly detection) –Belief Propagation –Immunization Problem#3: Scalability Conclusions Graph Analytics wkshp

89. CMU SCS Graph Analytics wkshpC. Faloutsos (CMU) 89 E-bay Fraud detection w/ Polo Chau & Shashank Pandit, CMU [www’07]

90. CMU SCS Graph Analytics wkshpC. Faloutsos (CMU) 90 E-bay Fraud detection

91. CMU SCS Graph Analytics wkshpC. Faloutsos (CMU) 91 E-bay Fraud detection

92. CMU SCS Graph Analytics wkshpC. Faloutsos (CMU) 92 E-bay Fraud detection - NetProbe

93. CMU SCS Popular press And less desirable attention: E-mail from ‘Belgium police’ (‘copy of your code?’) Graph Analytics wkshpC. Faloutsos (CMU) 93

94. CMU SCS C. Faloutsos (CMU) 94 Roadmap Introduction – Motivation Problem#1: Patterns in graphs Problem#2: Tools –OddBall (anomaly detection) –Belief Propagation – antivirus app –Immunization Problem#3: Scalability Conclusions Graph Analytics wkshp

95. CMU SCS Polo Chau Machine Learning Dept Carey Nachenberg Vice President & Fellow Jeffrey Wilhelm Principal Software Engineer Adam Wright Software Engineer Prof. Christos Faloutsos Computer Science Dept Polonium: Tera-Scale Graph Mining and Inference for Malware Detection PATENT PENDING SDM 2011, Mesa, Arizona

96. CMU SCS Polonium: The Data 60+ terabytes of data anonymously contributed by participants of worldwide Norton Community Watch program 50+ million machines 900+ million executable files Constructed a machine-file bipartite graph (0.2 TB+) 1 billion nodes (machines and files) 37 billion edges Graph Analytics wkshp 96 C. Faloutsos (CMU)

97. CMU SCS Polonium: Key Ideas Use Belief Propagation to propagate domain knowledge in machine-file graph to detect malware Use “guilt-by-association” (i.e., homophily) –E.g., files that appear on machines with many bad files are more likely to be bad Scalability: handles 37 billion-edge graph Graph Analytics wkshp 97 C. Faloutsos (CMU)

98. CMU SCS Polonium: One-Interaction Results 84.9% True Positive Rate 1% False Positive Rate True Positive Rate % of malware correctly identified False Positive Rate % of non-malware wrongly labeled as malware 98 Ideal Graph Analytics wkshpC. Faloutsos (CMU)

99. CMU SCS C. Faloutsos (CMU) 99 Roadmap Introduction – Motivation Problem#1: Patterns in graphs Problem#2: Tools –OddBall (anomaly detection) –Belief propagation –Immunization Problem#3: Scalability -PEGASUS Conclusions Graph Analytics wkshp

100. CMU SCS Immunization and epidemic thresholds Q1: which nodes to immunize? Q2: will a virus vanish, or will it create an epidemic? Graph Analytics wkshpC. Faloutsos (CMU) 100

101. CMU SCS Q1: Immunization: ? ? Given a network, k vaccines, and the virus details Which nodes to immunize? Graph Analytics wkshp 101 C. Faloutsos (CMU)

102. CMU SCS Q1: Immunization: ? ? Given a network, k vaccines, and the virus details Which nodes to immunize? Graph Analytics wkshp 102 C. Faloutsos (CMU)

103. CMU SCS Q1: Immunization: ? ? Given a network, k vaccines, and the virus details Which nodes to immunize? Graph Analytics wkshp 103 C. Faloutsos (CMU)

104. CMU SCS Q1: Immunization: ? ? Given a network, k vaccines, and the virus details Which nodes to immunize? A: immunize the ones that maximally raise the `epidemic threshold’ [Tong+, ICDM’10] Graph Analytics wkshp 104 C. Faloutsos (CMU)

105. CMU SCS Q2: will a virus take over? Flu-like virus (no immunity, ‘SIS’) Mumps (life-time immunity, ‘SIR’) Pertussis (finite-length immunity, ‘SIRS’) Graph Analytics wkshpC. Faloutsos (CMU) 105 ? ?  : attack prob  : heal prob

106. CMU SCS Q2: will a virus take over? Flu-like virus (no immunity, ‘SIS’) Mumps (life-time immunity, ‘SIR’) Pertussis (finite-length immunity, ‘SIRS’) Graph Analytics wkshpC. Faloutsos (CMU) 106 ? ?  : attack prob  : heal prob  depends on connectivity (avg degree? Max degree? variance? Something else?

107. CMU SCS Graph Analytics wkshpC. Faloutsos (CMU) 107 Epidemic threshold  What should  depend on? avg. degree? and/or highest degree? and/or variance of degree? and/or third moment of degree? and/or diameter?

108. CMU SCS Graph Analytics wkshpC. Faloutsos (CMU) 108 Epidemic threshold [Theorem] We have no epidemic, if β/δ <τ = 1/ λ 1,A

109. CMU SCS Graph Analytics wkshpC. Faloutsos (CMU) 109 Epidemic threshold [Theorem] We have no epidemic, if β/δ <τ = 1/ λ 1,A largest eigenvalue of adj. matrix A attack prob. recovery prob. epidemic threshold Proof: [Wang+03] (for SIS=flu only)

110. CMU SCS A2: will a virus take over? For all typical virus propagation models (flu, mumps, pertussis, HIV, etc) The only connectivity measure that matters, is  1 the first eigenvalue of the adj. matrix [Prakash+, ‘10, arxiv] Graph Analytics wkshpC. Faloutsos (CMU) 110 ? ?

111. CMU SCS 111 C. Faloutsos (CMU)Graph Analytics wkshp Thresholds for some models s = effective strength s < 1 : below threshold Models Effective Strength (s) Threshold (tipping point) SIS, SIR, SIRS, SEIR s = λ. s = 1 SIV, SEIV s = λ. (H.I.V.) s = λ.

112. CMU SCS A2: will a virus take over? Graph Analytics wkshpC. Faloutsos (CMU) 112 Fraction of infected Time ticks Below: exp. extinction Above: take-over Graph: Portland, OR 31M links 1.5M nodes

113. CMU SCS Q1: Immunization: ? ? Given a network, k vaccines, and the virus details Which nodes to immunize? A: immunize the ones that maximally raise the `epidemic threshold’ [Tong+, ICDM’10] Graph Analytics wkshp 113 C. Faloutsos (CMU)

114. CMU SCS Q1: Immunization: ? ? Given a network, k vaccines, and the virus details Which nodes to immunize? A: immunize the ones that maximally raise the `epidemic threshold’ [Tong+, ICDM’10] Graph Analytics wkshp 114 C. Faloutsos (CMU) Max eigen-drop  for any virus!

115. CMU SCS C. Faloutsos (CMU) 115 Roadmap Introduction – Motivation Problem#1: Patterns in graphs Problem#2: Tools –OddBall (anomaly detection) –Belief propagation –Immunization –Visualization Problem#3: Scalability -PEGASUS Conclusions Graph Analytics wkshp

116. CMU SCS Apolo Making Sense of Large Network Data: Combining Rich User Interaction & Machine Learning CHI 2011, Vancouver, Canada Polo ChauProf. Niki Kittur Prof. Jason Hong Prof. Christos Faloutsos Graph Analytics wkshp 116 C. Faloutsos (CMU)

117. CMU SCS Main Ideas of Apolo Provides a mixed-initiative approach (ML + HCI) to help users interactively explore large graphs Users start with small subgraph, then iteratively expand: 1.User specifies exemplars 2.Belief Propagation to find other relevant nodes User study showed Apolo outperformed Google Scholar in making sense of citation network data Graph Analytics wkshp 117 C. Faloutsos (CMU)

118. CMU SCS Exemplars Rest of the nodes are considered relevant (by BP); relevance indicated by color saturation. Note that BP supports multiple groups Graph Analytics wkshp 118 C. Faloutsos (CMU)

119. CMU SCS C. Faloutsos (CMU) 119 Roadmap Introduction – Motivation Problem#1: Patterns in graphs Problem#2: Tools –OddBall (anomaly detection) –Belief propagation –Immunization Problem#3: Scalability -PEGASUS Conclusions Graph Analytics wkshp

120. CMU SCS Graph Analytics wkshpC. Faloutsos (CMU) 120 Scalability Google: > 450,000 processors in clusters of ~2000 processors each [ Barroso, Dean, Hölzle, “Web Search for a Planet: The Google Cluster Architecture” IEEE Micro 2003 ] Yahoo: 5Pb of data [Fayyad, KDD’07] Problem: machine failures, on a daily basis How to parallelize data mining tasks, then? A: map/reduce – hadoop (open-source clone) http://hadoop.apache.org/ http://hadoop.apache.org/

121. CMU SCS C. Faloutsos (CMU) 121 CentralizedHadoop/PEG ASUS Degree Distr. old Pagerank old Diameter/ANF old HERE Conn. Comp old HERE TrianglesdoneHERE Visualizationstarted Roadmap – Algorithms & results Graph Analytics wkshp

122. CMU SCS HADI for diameter estimation Radius Plots for Mining Tera-byte Scale Graphs U Kang, Charalampos Tsourakakis, Ana Paula Appel, Christos Faloutsos, Jure Leskovec, SDM’10 Naively: diameter needs O(N**2) space and up to O(N**3) time – prohibitive (N~1B) Our HADI: linear on E (~10B) –Near-linear scalability wrt # machines –Several optimizations -> 5x faster C. Faloutsos (CMU) 122 Graph Analytics wkshp

123. CMU SCS ???? 19+ [Barabasi+] 123 C. Faloutsos (CMU) Radius Count Graph Analytics wkshp ~1999, ~1M nodes

124. CMU SCS YahooWeb graph (120Gb, 1.4B nodes, 6.6 B edges) Largest publicly available graph ever studied. ???? 19+ [Barabasi+] 124 C. Faloutsos (CMU) Radius Count Graph Analytics wkshp ?? ~1999, ~1M nodes

125. CMU SCS YahooWeb graph (120Gb, 1.4B nodes, 6.6 B edges) Largest publicly available graph ever studied. ???? 19+? [Barabasi+] 125 C. Faloutsos (CMU) Radius Count Graph Analytics wkshp 14 (dir.) ~7 (undir.)

126. CMU SCS YahooWeb graph (120Gb, 1.4B nodes, 6.6 B edges) 7 degrees of separation (!) Diameter: shrunk ???? 19+? [Barabasi+] 126 C. Faloutsos (CMU) Radius Count Graph Analytics wkshp 14 (dir.) ~7 (undir.)

127. CMU SCS YahooWeb graph (120Gb, 1.4B nodes, 6.6 B edges) Q: Shape? ???? 127 C. Faloutsos (CMU) Radius Count Graph Analytics wkshp ~7 (undir.)

128. CMU SCS 128 C. Faloutsos (CMU) YahooWeb graph (120Gb, 1.4B nodes, 6.6 B edges) effective diameter: surprisingly small. Multi-modality (?!) Graph Analytics wkshp

129. CMU SCS Radius Plot of GCC of YahooWeb. 129 C. Faloutsos (CMU)Graph Analytics wkshp

130. CMU SCS 130 C. Faloutsos (CMU) YahooWeb graph (120Gb, 1.4B nodes, 6.6 B edges) effective diameter: surprisingly small. Multi-modality: probably mixture of cores. Graph Analytics wkshp

131. CMU SCS 131 C. Faloutsos (CMU) YahooWeb graph (120Gb, 1.4B nodes, 6.6 B edges) effective diameter: surprisingly small. Multi-modality: probably mixture of cores. Graph Analytics wkshp EN ~7 Conjecture: DE BR

132. CMU SCS 132 C. Faloutsos (CMU) YahooWeb graph (120Gb, 1.4B nodes, 6.6 B edges) effective diameter: surprisingly small. Multi-modality: probably mixture of cores. Graph Analytics wkshp ~7 Conjecture:

133. CMU SCS Running time - Kronecker and Erdos-Renyi Graphs with billions edges. details

134. CMU SCS C. Faloutsos (CMU) 134 CentralizedHadoop/PEG ASUS Degree Distr. old Pagerank old Diameter/ANF old HERE Conn. Comp old HERE Triangles HERE Visualizationstarted Roadmap – Algorithms & results Graph Analytics wkshp

135. CMU SCS Generalized Iterated Matrix Vector Multiplication (GIMV) C. Faloutsos (CMU) 135 PEGASUS: A Peta-Scale Graph Mining System - Implementation and ObservationsSystem - Implementation and Observations. U Kang, Charalampos E. Tsourakakis, and Christos Faloutsos. (ICDM) 2009, Miami, Florida, USA. Best Application Paper (runner-up).ICDM Graph Analytics wkshp

136. CMU SCS Generalized Iterated Matrix Vector Multiplication (GIMV) C. Faloutsos (CMU) 136 PageRank proximity (RWR) Diameter Connected components (eigenvectors, Belief Prop. … ) Matrix – vector Multiplication (iterated) Graph Analytics wkshp details

137. CMU SCS 137 Example: GIM-V At Work Connected Components – 4 observations: Size Count C. Faloutsos (CMU) Graph Analytics wkshp

138. CMU SCS 138 Example: GIM-V At Work Connected Components Size Count C. Faloutsos (CMU) Graph Analytics wkshp 1) 10K x larger than next

139. CMU SCS 139 Example: GIM-V At Work Connected Components Size Count C. Faloutsos (CMU) Graph Analytics wkshp 2) ~0.7B singleton nodes

140. CMU SCS 140 Example: GIM-V At Work Connected Components Size Count C. Faloutsos (CMU) Graph Analytics wkshp 3) SLOPE!

141. CMU SCS 141 Example: GIM-V At Work Connected Components Size Count 300-size cmpt X 500. Why? 1100-size cmpt X 65. Why? C. Faloutsos (CMU) Graph Analytics wkshp 4) Spikes!

142. CMU SCS 142 Example: GIM-V At Work Connected Components Size Count suspicious financial-advice sites (not existing now) C. Faloutsos (CMU) Graph Analytics wkshp

143. CMU SCS 143 GIM-V At Work Connected Components over Time LinkedIn: 7.5M nodes and 58M edges Stable tail slope after the gelling point C. Faloutsos (CMU)Graph Analytics wkshp

144. CMU SCS C. Faloutsos (CMU) 144 Roadmap Introduction – Motivation Problem#1: Patterns in graphs Problem#2: Tools Problem#3: Scalability Conclusions Graph Analytics wkshp

145. CMU SCS C. Faloutsos (CMU) 145 OVERALL CONCLUSIONS – low level: Several new patterns (fortification, triangle-laws, conn. components, etc) New tools: –anomaly detection (OddBall), belief propagation, immunization Scalability: PEGASUS / hadoop Graph Analytics wkshp

146. CMU SCS C. Faloutsos (CMU) 146 OVERALL CONCLUSIONS – high level BIG DATA: Large datasets reveal patterns/outliers that are invisible otherwise Graph Analytics wkshp

147. CMU SCS ML & Stats. Comp. Systems Theory & Algo. Biology Econ. Social Science Physics 147 Graph Analytics Graph Analytics wkshpC. Faloutsos (CMU)

148. CMU SCS C. Faloutsos (CMU) 148 References Leman Akoglu, Christos Faloutsos: RTG: A Recursive Realistic Graph Generator Using Random Typing. ECML/PKDD (1) 2009: 13-28 Deepayan Chakrabarti, Christos Faloutsos: Graph mining: Laws, generators, and algorithms. ACM Comput. Surv. 38(1): (2006) Graph Analytics wkshp

149. CMU SCS C. Faloutsos (CMU) 149 References Deepayan Chakrabarti, Yang Wang, Chenxi Wang, Jure Leskovec, Christos Faloutsos: Epidemic thresholds in real networks. ACM Trans. Inf. Syst. Secur. 10(4): (2008) Deepayan Chakrabarti, Jure Leskovec, Christos Faloutsos, Samuel Madden, Carlos Guestrin, Michalis Faloutsos: Information Survival Threshold in Sensor and P2P Networks. INFOCOM 2007: 1316-1324 Graph Analytics wkshp

150. CMU SCS C. Faloutsos (CMU) 150 References Christos Faloutsos, Tamara G. Kolda, Jimeng Sun: Mining large graphs and streams using matrix and tensor tools. Tutorial, SIGMOD Conference 2007: 1174 Graph Analytics wkshp

151. CMU SCS C. Faloutsos (CMU) 151 References T. G. Kolda and J. Sun. Scalable Tensor Decompositions for Multi-aspect Data Mining. In: ICDM 2008, pp. 363-372, December 2008. Graph Analytics wkshp

152. CMU SCS C. Faloutsos (CMU) 152 References Jure Leskovec, Jon Kleinberg and Christos Faloutsos Graphs over Time: Densification Laws, Shrinking Diameters and Possible Explanations, KDD 2005 (Best Research paper award). Jure Leskovec, Deepayan Chakrabarti, Jon M. Kleinberg, Christos Faloutsos: Realistic, Mathematically Tractable Graph Generation and Evolution, Using Kronecker Multiplication. PKDD 2005: 133-145 Graph Analytics wkshp

153. CMU SCS C. Faloutsos (CMU) 153 References Jimeng Sun, Yinglian Xie, Hui Zhang, Christos Faloutsos. Less is More: Compact Matrix Decomposition for Large Sparse Graphs, SDM, Minneapolis, Minnesota, Apr 2007. Jimeng Sun, Spiros Papadimitriou, Philip S. Yu, and Christos Faloutsos, GraphScope: Parameter- free Mining of Large Time-evolving Graphs ACM SIGKDD Conference, San Jose, CA, August 2007 Graph Analytics wkshp

154. CMU SCS References Jimeng Sun, Dacheng Tao, Christos Faloutsos: Beyond streams and graphs: dynamic tensor analysis. KDD 2006: 374- 383 Graph Analytics wkshpC. Faloutsos (CMU) 154

155. CMU SCS C. Faloutsos (CMU) 155 References Hanghang Tong, Christos Faloutsos, and Jia-Yu Pan, Fast Random Walk with Restart and Its Applications, ICDM 2006, Hong Kong. Hanghang Tong, Christos Faloutsos, Center-Piece Subgraphs: Problem Definition and Fast Solutions, KDD 2006, Philadelphia, PA Graph Analytics wkshp

156. CMU SCS C. Faloutsos (CMU) 156 References Hanghang Tong, Christos Faloutsos, Brian Gallagher, Tina Eliassi-Rad: Fast best-effort pattern matching in large attributed graphs. KDD 2007: 737-746 Graph Analytics wkshp

157. CMU SCS C. Faloutsos (CMU) 157 Project info Akoglu, Leman Chau, Polo Kang, U McGlohon, Mary Tong, Hanghang Prakash, Aditya Graph Analytics wkshp Thanks to: NSF IIS-0705359, IIS-0534205, CTA-INARC ; Yahoo (M45), LLNL, IBM, SPRINT, Google, INTEL, HP, iLab www.cs.cmu.edu/~pegasus Koutra, Danae

158. CMU SCS Thank you! Foils & material of workshop –www.cs.cmu.edu/~epapalex/gmc/www.cs.cmu.edu/~epapalex/gmc/ PDF of book on graph mining (internal to CMU) www.cs.cmu.edu/~epapalex/gmc/book/prepub_book.pdf Contact info: –christos@cs.cmu.edu –www.cs.cmu.edu/~christoswww.cs.cmu.edu/~christos Graph Analytics wkshpC. Faloutsos (CMU) 158