Abstract-The growing popularity of dynamic applications such as social networks provides a promising way to detect valuable information in real time. These applications create highspeed data that can be easily modeled as streaming graph. Efficient analysis over these data is of great significance. In this paper, we study the subgraph (isomorphism) search over streaming graph data that obeys timing order constraints over the occurrence of edges in the stream. We propose a solution to efficiently answer subgraph search, introduce optimizations to greatly reduce the space cost, and design concurrency management to improve system throughput. Extensive experiments on real network traffic data and synthetic social streaming data confirms the efficiency and effectiveness of our solution. Keywords-Streaming Graphs, Subgraph, Timing Order I. INTRODUCTION A recent development is the proliferation of high throughput, dynamic graph-structured data in many applications, such as social media streams and computer network traffic data. Efficient analysis of such streaming graph data is of great significance for tasks such as detecting anomalous events (e.g., in Twitter) and detecting adversarial activities in computer networks. Various types of queries over streaming graphs have been investigated, such as subgraph search, path computation, and triangle counting [1] . Among these, subgraph search is one of the most fundamental problems, especially subgraph isomorphism that provides an exact topological structure constraint for the search. In this paper, we study subgraph (isomorphism) search over streaming graph data that obeys timing order constraints over the occurrence of edges in the stream. Specifically, in a query graph, there exist some timing order constraints between different query edges specifying that one edge in the match is required to come before (i.e., have a smaller timestamp than) another one in the match. The timing aspect of streaming data is important for queries where sequential order between the query edges is significant. The following examples demonstrate the usefulness of subgraph (isomorphism) search with timing order constraints over streaming graph data. Example 1. Cyber-attack pattern. Figure 1 demonstrates the pipeline of the information exfiltration attack pattern. A victim browses a compromised website (at time t 1 ), which leads to downloading malware scripts (at time t 2 ) that establish communication with the botnet C&C server (at times t 3 and t 4 ). The victim registers
Li et al., REF proposed a solution to efficiently answer subgraph search in streaming graph data.
Time Constrained Continuous Subgraph Search Over Streaming Graphs
2019 IEEE 35th International Conference on Data Engineering (ICDE)
2019 IEEE 35th International Conference on Data Engineering (ICDE)
Computer Science