Graph Problems in the Streaming Model Sampath Kannan

Graph Problems in the Streaming Model Sampath Kannan University of Pennsylvania Work done with Joan Feigenbaum, Andrew Mc. Gregor, Siddharth Suri and Jian Zhang

Graph Streaming n G=(V, E), n. V known; |V| = n n E revealed in arbitrary order (e 1, e 2, …) n Space allowed O(n polylog n): Semi streaming

Motivation? n Fundamental problems … help ‘calibrate’ model n Massive graphs such as the webgraph can appear as stream n Recommendation systems… and more generally data mining

Why so much space? Even simple problems need it: Given u, v, and a streamed graph G, is there path of length 2 between u & v? Requires (n) space. More generally … for balanced graph properties …

Balanced Properties v A property is balanced, if there exists stream of edges such that: before seeing last edge: There exists v: last edge is (v, x). . . for Ω(n) x’s, property holds for Ω(n) x’s property doesn’t hold.

Lower Bound for Balanced Props Consider all isomorphic versions of the graph that demonstrates the balance property. Before seeing last edge, streaming algorithm has to remember the subset x of vertices such that the addition of edge (v, x) causes property to hold. As we range over isomorphisms. . . this is an arbitrary subset of the given cardinality. . . and there are exponentially many possibilities.

“Exceptions” Counting Local Structures • Counting triangles (Bar-Yossef et al, Buriol et al) • Counting |E(G 2)| (Ganguly et al) • Duplicate elimination and aggregation (Cormode, Muthukrishnan)

One algorithm design technique Sparsification (Eppstein, Galil, Italiano, Nissenzweig ‘ 97) For graph property P: G’ strong certificate for G if ∀ H: (G ⋃ H) ∈ P ⇔ (G’ ⋃ H) ∈ P. Existence of quickly computable, sparse, strong certificates leads to good semi-streaming algorithms

Sparsification-based algorithms n Bipartiteness, 1 -, 2 -, 3 -vertex connected components, 2 -, 3 -edge connected components: O(a(n)) per edge n MST, 4 -vertex connected comps. , 3 edge connected comps. O(log n) n Higher connectivities: O~(n). (Zelke)

Bipartite Matching (maximal) Augmenting path Approximable with local greed

Constant-pass 2/3 -approx for bip. matching • Maximal matching is. 5 approx: If M’ maximum and M maximal then M matches at least one endpoint of each edge in M’… has |M’|/2 edges. • If M has only a|M| vertex-disjoint 3 -aug-paths => |M| (1 + a) ≥ 2 OPT/3 M’ maximum: M’∆ M – bunch of augmenting paths. Count!

• Can find maximal matching • To go beyond: Need to get most aug. paths of length 3. • Randomly project all free vertices into Layer 0 or Layer 3 • Matched edges go from layer 1 to layer 2. • Expect half the augmenting paths of length 3 to respect layering • Use maximal matchings between successive layers to get constant fraction of these. • Gives constant-pass 2/3 - approximation

To get approximation scheme: Need to find most augmenting paths of length • Again project vertices into k+1 layers to find augmenting paths of length k • Use carefully chosen maximal matchings algorithms between successive layers • Repeat constant number of times Gives streaming linear time approx scheme for unweighted matching in general graphs (Mc. Gregor)

Weighted Matching

A 1/6 Approximation in 1 Pass n At all times we store some matching M. n On seeing edge e =(u, v) we compare the w(e) with the weight W of edges e 1 and e 2 in M incident on u and v. n If w(e) > 2 W then M M {e} {e 1, e 2 }

• To show 1/6 approx: Account for the weight of edges lost in terms of weight of edges that survive • Can improve approx to 1/2 - (Mc. Gregor) in constant number of passes: • Choose an edge if it is (1 + ) times the weight of edges that it kills.

Approximating Distances

The “Sketch” Approach n. A two-stage approach n First stage: While going through the stream, construct a small sketch of the input graph. n Second stage: Compute the distance using the sketch, without further access to the stream. n Perform BFS-like computations in the second stage.

Graph Spanners as Sketches Multiplicative t-spanner: Edge subgraph H of a graph G, s. t. , for any pair of vertices u and v, dist. H(u, v) t·dist. G(u, v). n There is a t-Spanner with O(n 1+1/t) edges. n n Reduce streaming graph distance to streaming spanner construction. n BFS-like subroutines are used in most existing spanner constructions.

Streaming Spanner Construction For each incoming edge, decide whether it should be in the spanner. n If the edge causes a cycle of length t, do not put the edge in the spanner. n This gives a t-spanner, because there is a path P of length < t connecting the two endpoints of any discarded edge. n This spanner is sparse. n Thm [Bollobás 78] : A graph whose girth is larger than k can only have O(n 1+2/(k-1)) edges. n Need to know: For an incoming edge, does a short path exist?

Baswana & Sen show almost linear time non-streaming algorithm for spanners… growing BFS-trees from appropriate nodes. Difficult to do in streaming fashion… Instead we grow a BFS-like tree not just from its root! Clusters: Rooted BFS trees Preclusters: Free floating pieces of BFS trees … will attach to clusters

Summary of the One-Pass Algorithm Use a vertex-labeling scheme to construct clusters. n Structure of the algorithm: n – In the pre-processing phase, generate a multi-level set of labels for the vertices. – Go through the stream; for each edge: • According to the current assignment of labels to vertices, decide whether to put this edge in the spanner. • Depending on the type of edge, possibly assign more labels to one of its endpoints. n Next, an example with t = log n

Labels (2, 2) (1, 2) Level 2 (2, 7) (1, 4) (1, 7) (1, 11) (0, 2) (0, 3) (0, 4) (0, 5) (0, 6) (0, 7) (0, 8) (0, 9)(0, 10) (0, 9) (0, 10) (0, 11) (0, 12) – logn/2 levels – w. h. p. , there are – Semantics of labels: Level 1 Level 0 top-level labels. • The set of vertices assigned the same top-level label forms a cluster. • The set of vertices assigned the same lower-level label forms a “pre-cluster. ”

Initial Label Assignment (2, 2) Level 2 (2, 7) (1, 2) (1, 4) (1, 7) (1, 11) (0, 2) (0, 3) (0, 4) (0, 5) (0, 6) (0, 7) (0, 8) (0, 9) (0, 10)(0, 11) (0, 12) v 1 v 2 v 3 v 4 v 5 v 6 v 7 v 8 v 9 v 10 v 11 v 12 Level 1 Level 0

On arrival of an edge n Already know what to do with: – Intra-cluster/pre-cluster edges – Inter-cluster edges n Edges connecting pre-clusters: the sticky edges – They are added to the spanner. – They may lead to new label assignment and cluster growth.

“Good” Neighbor (1) (3, 2) (2, 2) (1, 6) (1, 2) (0, 6) (0, 2) v u Has marked labels

Good Neighbor (2) C(3, 2) C(2, 2) C(1, 6) C(1, 2) v u

“Bad” Neighbor (1, 6) (3, 2) v u No marked labels

Properties of the Clusters n Small diameter n Number of clusters bounded by n Do not need to cover the whole graph with clusters, but the uncovered subgraph is sparse. . The uncovered subgraph consists of sticky edges, and there are not too many of them.

Sticky Edges are Rare u 1 u 4 v u 2 u 1, u 2, u 3, u 4 … u 3 n A neighbor is good with probability at least ½. After seeing at most logn/2 good neighbors, v will be assigned a top-level label and be included in a cluster. No more sticky edges for v. n The number of sticky edges can be bounded by the length of the shortest prefix in the above sequence that contains logn/2 good neighbors. n

4. Lower Bounds

One-pass diameter lower bound Theorem: For any , any one-pass algorithm that returns a k (slightly better than 1/ ) approx to diameter in weighted graph requires n 1+ ) space. Proof (Sketch): Some properties of random graph G in Gn, p with p = 1/n 1 - • w. h. p. Contains set E’ of edges: |E’| = n 1+ 64 : • no edge in E’ is in a cycle of length k or less. • When all edges in E’ are removed, graph still has diameter < 2/ Fix one such G = (V, E E’)

Sketch (cont’d): Reduce from INDEX (hard for comm. cmplxty) INDEX: Alice has m-bit string x and Bob has index i. One-way comm. complexity for Bob to learn xi is m. Reduction: m edges in E’ enumerated 1. . m. Alice constructs prefix of stream corresponding to multiple copies of H = (V, E E’’) where E’’ E’ are the indices where xi=1. All Alice’s edges have weight 1 Bob constructs rest of stream: If his index corresponds to edge (a, b) in E’ • He connects vertex b in one copy with vertex a in next copy at 0 weight • Also creates source s and sink t and connects s to a in 1 st copy and b in last copy to t at high weight. Properties: If xi = 1 where i is Bob’s index then small diameter; else large diameter. Small space streaming violates comm. lower bound.

Open Problems n Are there interesting subclasses of graphs for which distances and diameters are “easier” in streaming model? n Is there a more generous but reasonable model?

Network Intrusion Detection Systems n Current techniques fairly primitive: – Misuse: Pattern match packets with misuse signatures in database – Anomaly: Look for statistical anomalies in individual packet headers and payload n Needed: – Look across multiple packets for intrusions – Deal with interleaved traffic

An Example: Browsing habits n You read sports and cartoons. You’re equally likely to read both. You do not remember what you read last. n You’d expect a “random” sequence SCSSCSSCSSCCSCCCSSSSCSC…

Two readers n. I like health, entertainment, and politics n I always read entertainment first, health next and politics last n The sequence would be EHPEHPEHPEHP…

Two readers, one log file n If there is one log file… n Assume there is no correlation between us SECHSSPECSHPESCSSHCPCESCHCCPSESHPESSHPE… Is there enough information to tell that there are two people browsing? What are they browsing? How are they browsing?

Clues in stream? n Yes, under model assumptions. SECHSSPECSHPESCSSHCPCESCHCCPSESHPESSHPE… n H, E, P have special relationship. n They cannot belong to different (uncorrelated) people. n Not clear about S and C. . . These could be two people or one person.

Markov Chains as Stochastic Sources. 4 2 1 . 4. 2 . 7 4 6 . 5 . 8 3 . 9 Output sequence: 1 4 7 7 1 2 5 7. . 3 . 5 . 2 7 . 1 1 . 1 5 . 9

Markov chains on S, E, C, H, F 1/2 Modeled by … S 1/2 1 E H 1 1 F C 1/2

Need more realistic generalizations of such analysis to deal with: • Worm detection • Anomaly detection at high traffic links in a network • TCP compliance • BGP policy behavior

Partial Solution: Clusters (1) n. A cluster is a subset of vertices and a small diameter spanning tree built on these vertices. n Intra-cluster edge

Partial Solution: Clusters (2) n Inter-cluster edges Bollobás’s result no longer applies. Need to control the number of clusters (i. e. , make it ).

Open Shortest Path First (OSPF) Packet routing protocol: • Each link broadcasts its weight (initially could be 1/bw. . . ) • To route from A to B, each router sends along shortest path to B, dividing traffic evenly if many shortest paths. Adjustments: • Human operator observing congestion on link could raise wt • Local decisions could lead to oscillation & suboptimality • Link latency: Convex function of its utilization • Goal: Minimize max link latency, total link latency, expected path latency, etc. • Exact optimizations typically NP-hard

Streaming problem • Can we automate the weight adjustments? Simple scenario: • Assume weights have been optimized for current traffic matrix • Assume we now have a new (unknown) traffic matrix observed at routers • Assume some simple goal. . . minimize time to converge to new solution. . . or something. . . Streaming algorithm should itself be allowed to generate traffic for communication between monitors and for diagnostics, but this overhead should be low.

Early Worm Detection Early. Bird System [Singh et al] identifies following characteristics: 1. Substantial volume of identical traffic 2. Rising infection levels (# sources & destinations increasing) 3. Random probing (infected source tries many IP addresses) 1. Top-k type streaming algorithm can identify high volume of identical traffic at one location. Can we do better in distributed fashion? 2. How do we communicate to detect rising inf. levels? 3. Sophisticated worms may not use random probing. What other discriminating tests are possible? 4. Sophisticated worms are polymorphic… not “identical” traffic.