advertisement

GRAPH MINING a general overview of some mining techniques presented by Rafal Ladysz PREAMBLE: from temporal to spatial (data) • clustering of time series data was presented (September) in aspect of problems with clustering subsequences • this presentation focuses on spatial data (graphs, networks) • and techniques useful for mining them • in a sense, it is “complementary” to that dealing with temporal data – this can lead to mining spatio-temporal data – more comprehensive and realistic scenario – data collected already (CS 710/IT 864 project)... first: graphs and networks • let assume in this presentation (for the sake of simplicity) that (connected) GRAPHS = NETWORKS • • • • • suggested AGENDA to follow: first: formal definition of GRAPH will be given followed by preview of kinds of NETWORKS and brief history behind that classification finally, examples of mining structured data: – association rules – clustering • • • • • graphs we usually encounter data in relational format, like ER databases or XML documents graphs are example of so called structured data they are used in biology, chemistry, social networks, communication etc. can capture relations between objects far beyond flattened representations here is analogy: relational data OBJECT RELATION graph-based data VERTEX EDGE graph - definitions • graph (G.) definition: set of nodes joined by a set of lines (undirected graphs) or arrows (directed graphs) – planar: can be drawn with no 2 edges crossing. – non-planar: if it is not planar; further subdivision follows: • bipartite: if it is non-planar and the vertex set can be partitioned into S and T so that every edge has one end in S and the other in T • complete: if it is non-planar and each node is connected to every other node • illustration: – connected: is possible to get from any node to any other by following a sequence of adjacent nodes – acyclic: if no cycles exist, where cycle occurs when there is a path that starts at a particular node and returns to that same node; hence special class of Directed Acyclic Graphs - DAG graph – definitions cont. • components: vertices V (nodes) and edges E – vertices: represent objects of interest connected with edges – edges: represented by arcs connecting vertices; can be • directed and represented by an arrow or • undirected represented by a line – hence directed and undirected graphs; we can further define • weighted: represented as lines with a numeric value assigned, indicating the cost to traverse the edge; used in graph-related algorithms (e.g. MST) graph – definitions cont. • degree is the number of edges wrt a node – undirected G: the degree is the number of edges incident to the node; that is all edges of the node – directed G: • indegree - the number of edges coming into the node • outdegree - the number of edges going out of the node • paths: occurs when nodes are adjacent and can be reached through one another; many kinds, but important for this presentation is – shortest path: between two nodes where the sum of the weights of all the edges on the path is minimized – example: the path ABCE costs 8 and path ADE costs 9, hence ABCE would be the shortest path graph representation • adjacency list • adjacency matrix • incidence matrix graph isomorphism subgraph isomorphism maximum common subgraph elementary edit operations example graph matching definition cost function cost function cont. graph matching definition revisited costs description and distance definition networks and link analysis • examples of NETWORKS: – Internet – neural network – social network (e.g. friends, criminals, scientists) – computer network • all elements of the “graph theory” outlined can be now applied to intuitively clear term of networks • mining such structures (graphs, networks) are recently called LINK ANALYSIS networks - overview • first spectacular appearance of SW networks due to Milgram’s experiment: “six degrees of separation” • Erdos, Renyi lattice model: Erdos number – starting with not connected n vertices – equal probability p of making independently any connection between each pair of vertices – p determines if the connectivity is dense or sparse – for n (large) and p ~ 1/N: each vertex expected to have a “small” number of neighbors – shortage: little clustering (independent edging) – hence: limited use as a social networks model networks - overview • Watts, Strogatz: concept of a network somewhere between regular and random • n vertices, k edges per node; some edges cut • rewiring probability (proportion) p • p is uniform: not very realistic! • average path length L(p): measure of separation (globally) • clustering coefficient C(p): measure of cliquishness (locally) • many vertices, sparse connections rewiring networks: from order to randomness REGULAR SMALL WORLD RANDOM small world characteristics • Average Path Length (L): the average distance between any two entities, i.e. the average length of the shortest path connecting each pair of entities (edges are unweighted and undirected) • Clustering Coefficient (C): a measure of how clustered, or locally structured, a graph is; put another way, C is an average of how interconnected each entity's neighbors are rewiring networks cont. network characteristics: they influence clustering coefficient path length ring graph (lattice) Small World random network case study: 9/11 C L contacts 0.41 4.75 contacts & shortcuts 0.42 2.79 comments about shortcuts: they reduced L, and made a clique (clusters) of some members question: how such a structure contributes to the network’s resilience? other associates included networks - overview • Barabasi, Albert: self-organization of complex networks and two principal assumptions: – growth (neglected in the project) – preferential attachment (followed in the project) • power low: P(k) k- implies scale-free (SF) characteristics of real social networks like Internet, citations etc. (e.g. actor 2.3) linear behavior in log-log plots networks - overview • Kleinberg's model: variant of SW model (WS) – regular lattice; build the connection in biased way (rather than uniformly or at random) – connections closer together (Euclidean metric) are more likely to happen (p k-d, d = 2, 3, ...) – probability of having a connection between two sites decays with the square of their distance • this may explain Milgram’s experiment: – in social SW networks (knowledge of geography exists) using only local information one can be very effective at finding short paths in social contacts network – this does not account for long range connections, though networks: four types altogether ring (regular): fully connected a lattice random network power law (scale-free) network frequent subgraph discovery • stems from searching for FREQUENT ITEMS • in ASSOCIATION RULES discovery • basic concepts: – given set of transactions each consisting of a list of items (“market basket analysis”) – objective: finding all rules correlating “purchased” items • e.g. 80% of those who bought new ink printer simultaneously bought spare inks rule measure: support and confidence buys both buys diaper • find all the rules X Y with minimum confidence and support buys beer transaction ID 2000 1000 4000 5000 – support s: probability that a transaction contains {X Y} – confidence c: conditional probability that a transaction having {X} also contains Y items bought let min. support 50% A,B,C and min. confidence 50% A,C A C (50%, 66.6%) A,D C A (50%, 100%) B,E,F mining association rules - example transaction ID 2000 1000 4000 5000 items bought A,B,C A,C A,D B,E,F min. support 50% min. confidence 50% Frequent Itemset Support {A} 75% {B} 50% {C} 50% {A,C} 50% for rule A C: support = support({A C}) = 50% confidence = support({A C})/support({A}) = 66.6% the Apriori principle says that any subset of a frequent itemset must be frequent mining frequent itemsets: the key step • find the frequent itemsets: the sets of items that have minimum support – a subset of a frequent itemset must also be a frequent itemset • i.e., if {AB} is a frequent itemset, both {A} and {B} should be a frequent itemset – iteratively find frequent itemsets with cardinality from 1 to k (k-itemset) • use the frequent itemsets to generate association rules. problem decomposition two phases: • generate all itemsets whose support is above a threshold; call them large (or hot) itemsets. (any other itemset is small.) • how? generate all combinations? (exponential – HARD!) • for a given large itemset Y = I1 I2 … Ik generate (at most k rules) k >= 2 X Ij X = Y - {Ij} confidence = c support(Y)/support (X) so, have a threshold c and decide which ones you keep. (EASY...) examples TID 1 2 3 4 items {a,b,c} {a,b,d} {a,c} {b,e,f} assume s = 50 % and c = 80 % minimum support: 50 % itemsets {a,b} and {a,c} rules: a b with support 50 % and confidence 66.6 % a c with support 50 % and confidence 66.6 % c a with support 50% and confidence 100 % b a with support 50% and confidence 100% Apriori algorithm • Join Step: Ck is generated by joining Lk-1with itself • Prune Step: Any (k-1)-itemset that is not frequent cannot be a subset of a frequent k-itemset • pseudo-code: Ck: Candidate itemset of size k Lk : frequent itemset of size k L1 = {frequent items}; for (k = 1; Lk !=; k++) do begin Ck+1 = candidates generated from Lk; for each transaction t in database do increment the count of all candidates in Ck+1 that are contained in t Lk+1 = candidates in Ck+1 with min_support end return k Lk; Apriori algorithm: example Database D TID 100 200 300 400 itemset sup. C1 {1} 2 {2} 3 Scan D {3} 3 {4} 1 {5} 3 Items 134 235 1235 25 C2 itemset sup L2 itemset sup 2 2 3 2 {1 {1 {1 {2 {2 {3 C3 itemset {2 3 5} Scan D {1 3} {2 3} {2 5} {3 5} 2} 3} 5} 3} 5} 5} 1 2 1 2 3 2 L1 itemset sup. {1} {2} {3} {5} 2 3 3 3 C2 itemset {1 2} Scan D L3 itemset sup {2 3 5} 2 {1 {1 {2 {2 {3 3} 5} 3} 5} 5} candidate generation: example C2 itemset sup {1 2} 1 {1 3} 2 {1 5} 1 {2 3} 2 {2 5} 3 {3 5} 2 itemset L2 {1 3} {2 3} {2 5} {3 5} sup 2 2 3 2 C3 L2 L2 {1 2 3 } {1 3 5} {2 3 5} itemset {2 3 5} since {1,5} and {1,2} do not have enough support back to graphs: transactions apriori-like algorithm for graphs • find frequent 1-subgraphs (subg.) • repeat – candidate generation • use frequent (k-1)-subg. to generate candidate k-sub. – candidate pruning • prune candidate subgraphs with infrequent (k-1)-subg. – support counting • count the support s for each remaining candidate – eliminate infrequent candidate k-subg. a simple example remark: merging 2 frequent k-itemset produces 1 candidate (k+1)-itemset now becomes merging two frequent k-subgraphs may result in more than 1 candidate (k+1)-subgraph multiplicity of candidates graph representation: adjacency matrix REMARK: two graphs are isomorphic if they are topologically equivalent going more formally: Apriori algorithm and graph isomorphism • testing for graph isomorphism is needed for: – candidate generation step to determine whether a candidate has been generated – candidate pruning step to check if (k-1)-subgraphs are frequent – candidate counting to check whether a candidate is contained within another graph FSG algorithm: finding frequent subgraphs • proposed by Kuramochi and Karypis • key features: – uses sparse graph representation (space, time): QUESTION: adjacency list or matrix? – increases size of freq. subg. by adding 1 edge at a time: that allows for effective candidate generating – uses canonical labeling, uses graph isomorphism • objectives: – finding patterns in these graphs – finding groups of similar graphs – building predictive models for the graphs • applications in biology FSG: big picture • problem setting: similar to finding frequent itemsets for association rule discovery • input: database of graph transactions – undirected simple graph (no loops, no multiples edges) – each graph transaction has labeled edges/vertices. – transactions may not be connected • minimum support threshold: s • output – frequent subgraphs that satisfy the support constraint – each frequent subgraph is connected finding frequent subgraphs remark: it’s not clear about how they computed s frequent subgraphs discovery: FSG FSG: the algorithm comment: in graphs some “trivial” operations become very complex/expensive! trivial operations with graphs… • candidate generation: – to determine two candidates for joining, we need to perform subgraph isomorphism for redundancy check • candidate pruning: – to check downward closure property, we need subgraph isomorphism again • frequency counting – subgraph isomorphism once again needed for checking containment of a frequent subgraphs • computational efficiency issue – how to reduce the number of graph/subgraph isomorphism operations? FSG approach to candidate generation candidate generation cont. candidate generation: core detection core detection cont. FSG approach to candidate pruning candidate pruning algorithmically pruning of size k-candidates for all the (k – 1)-subgraphs of a size k- candidate, check if downward closure property holds (canonical labeling is used to speed up computation) build the parent list of (k – 1)-frequent subgraphs for the k-candidate (used later in the candidate generation, if this candidate survives the frequency counting check) FSG approach to frequency counting frequency counting algorithmically frequency counting keep track of the TID lists if a size k-candidate is contained in a transaction, all the size (k – 1)-parents must be contained in the same transaction perform subgraph isomorphism only on the intersection of the TID lists of the parent frequent subgraphs of size k – 1 remarks: – significantly reduces the number of subgraph – isomorphism checks; trade-off between running time and memory FSG: example of experimental results experimental results: scalability scalability cont. back to SMALL WORLD and CLUSTERING • Yutaka Matsuo gives an example of approaching the small world model from clustering point of view • the algorithm is called Small World Clustering (SWC) SWC: optimization problem • given: – graph G = (V,E) where V, E are sets of vertices and edges, respectively – k is a positive integer • Small World Clustering (SWC) is defined as finding a graph G` such that k edges are removed from G so that f = aLG` + bCG` is minimized where a, b are constants, and LG`, CG are L and C for G` • objective: detecting clusters based on SW structure SWC: extended path concept • what we know already about SW networks: – highly clustered (C >> Crand) – with short path length (L Lrand) • introducing extended path length between nodes i, j of graph G: d(i, j) if (i, j) are connected d`(i, j) = n = |V| otherwise • problem to find optimal connection among all pairs of nodes: NP-complete (intractable!) SWC: algorithm • to make it feasible, approximate algorithm for SWC is designed as follows: 1. prune an edge which maximize f iteratively until k edges are pruned 2. add an edge which maximize f • if an edge to be added is the same as the most previously pruned one, terminate 3. prune an edge which maximize f; go to 2 SWC: application example • word co-occurrence; works as follows: – select up to n frequent words as nodes – compute Jaccard J coefficient for each pair of words – if J > Jthreshold add an edge (i.e. a word) • next slides: – a word co-occurrence graph with a single linkage clustering: C = 0.201, L = 12.1 – clusters obtained by SWC; C = 0.689, L = 18.3 REFERENCES • Wu, A.Y. et al.: Mining Scale-free Networks using Geodesic Clustering • Kuramochi, M. et al.: Frequent Subgraph Discovery • presentations of Dr. D. Barbara (INFS 797, spring 2004 and INFS 755, fall 2002) • Wats, Duncan: "Collective dynamics of 'small world' networks“ • Lise Getoor: "Link Mining: A New Data Mining Challenge" "Clustering using Small World Structure“ • Yutaka Matsuo: “Clustering Small World Structure” • Jennifer Jie Xy and Hsinchun Chen: "Using Shortest Path Algorithms to Identify Criminal Associations“ • Valdis E. Krebs: "Mapping Networks of Terrorist Cells" • and more...