On Clustering Graph Streams

On Clustering Graph Streams

Charu C. Aggarwal∗ Yuchen Zhao† Philip S. Yu‡

AbstractIn this paper, we will examine the problem of clustering massivegraph streams. Graph clustering poses significant challenges be-cause of the complex structures which may be present in the under-lying data. The massive size of the underlying graph makes explicitstructural enumeration very difficult. Consequently, most tech-niques for clustering multi-dimensional data are difficult to gen-eralize to the case of massive graphs. Recently, methods have beenproposed for clustering graph data, though these methods are de-signed for static data, and are not applicable to the case of graphstreams. Furthermore, these techniques are especially not effec-tive for the case of massive graphs, since a huge number of dis-tinct edges may need to be tracked simultaneously. This resultsin storage and computational challenges during the clustering pro-cess. In order to deal with the natural problems arising from theuse of massive disk-resident graphs, we will propose a techniquefor creating hash-compressed micro-clusters from graph streams.The compressed micro-clusters are designed by using a hash-basedcompression of the edges onto a smaller domain space. We willprovide theoretical results which show that the hash-based com-pression continues to maintain bounded accuracy in terms of dis-tance computations. We will provide experimental results whichillustrate the accuracy and efficiency of the underlying method.

1 IntroductionIn recent years, there has been a renewed focus on graphmining algorithms because of applications involving theweb, bio-informatics, social networking and communitydetection. Numerous algorithms have been designed forgraph mining applications such as clustering, classification,and frequent pattern mining [1, 4, 11, 10, 20]. A detaileddiscussion of graph mining algorithms may be found in [4].

The problem of clustering has been studied extensivelyin the data mining literature [13, 14, 22]. Recently, theproblem has also been examined in the context of graphdata [4, 11, 18]. The problem of clustering graphs hastraditionally been studied in node clustering of individualgraphs, in which we attempt to determine groups of nodesbased on the density of linkage behavior. This problem hastraditionally been studied in the context of graph-partitioning[15], minimum-cut determination [19] and dense subgraph

∗IBM T. J. Watson Research Center, [email protected]†University of Illinois at Chicago, [email protected]‡University of Illinois at Chicago, [email protected]

determination [12, 21].Recently, the problem has also been studied in the

context of object clustering, which we attempt to clustermany different individual graphs (as objects) [1, 10], whichare defined on a base domain. This is distinct from theproblemof node clustering in which the nodes are the entitiesto be clustered rather than the graphs themselves. However,the available techniques [1, 10] are designed for the moststraight-forward case, in which the graphs are defined overa limited domain. Furthermore, it is assumed that the graphdata sets are available on disk. This scenario arises in thecontext of certain kinds of XML data [1, 10], computationalbiology, or chemical compound analysis.

We study a much more challenging case in which thegraphs are defined over a massive domain of distinct nodes.Furthermore, these graphs are not available at one timeon disk, but are continuously received in the form of astream. The node labels are typically drawn over a universeof distinct identifers, such as the URL addresses in a webgraph [17], an IP-address in a network application, or auser-id in a social networking application. Typically, theindividual graphs constitute some kind of activity on thelarger graph, such as the click-graph in a user web-session,the set of interactions in a particular time window in asocial network, or the authorship graphs in a dynamicallyupdated literature site. Often such graphs may individuallybe of modest size, though the number of distinct edgesmay be very large on the aggregate data. This propertyis referred to as that of sparsity, and is often encounteredin a variety of real applications. This makes the problemmuch more challenging, because most clustering algorithmswould require tracking the behavior of different nodes andedges. Since the number of possible edges may be ofthe order of the square of the number of nodes, it mayoften be difficult to explicitly store even modest summaryinformation about the edges for all the incoming graphs.Clearly, such a problem becomes even more challenging inthe stream scenario. Examples of such graph streams are asfollows:

• The click-graph derived from a proxy-log in a user-session is typically a sparse graph on the underlyingweb graph.

• The interactions between users in a particular time-window in a social network will typically be a collec-

478 Copyright © by SIAM. Unauthorized reproduction of this article is prohibited.

tion of disjointed graphs.

• The authorship graphs of individual articles in a largescientific repository will be small graphs drawn acrossmillions of possible authors.

The currently available algorithms are designed eitherfor the case of node-entity clustering, or for the case inwhich we have disk-resident data sets over a limited domain[1, 10]. Such algorithms require multiple passes over thedata [1, 10], and are not applicable to the case of datastreams. Furthermore, these algorithms do not scale verywell with the underlying domain size. While the problemof stream clustering has been studied extensively in thecontext of multi-dimensional data [2, 7], there are no knownalgorithms for the case of clustering graph streams. In thispaper, we will propose the first algorithm for clusteringgraph streams. We use a model in which a large numberof graphs are received continuously by the data stream. Itis also assumed that the domain size of the nodes is verylarge, and this makes the problem much more challenging.Thus, the large domain size of the stream and the structuralcharacteristics of graphs data pose additional challengesover those which are caused by the data stream scenario.

In summary, the problem of clustering graph streams isparticularly difficult because of the following reasons:

• Most graph mining algorithms use sub-structural analy-sis in order to perform the clustering. This may be diffi-cult in the case of data streams because of the one-passconstraint.

• The number of possible edges scales up quadraticallywith the number of nodes. As a result, it may be difficultto explicitly hold the summary information about themassive graphs for intermediate computations.

• The individual graphs from the stream may exhibit thesparsity property. In other words, the graphs maybe drawn from a large space of nodes and edges,but each individual graph in the stream may containonly a very small subset of the edges. This leads torepresentational problems, since it may be difficult tokeep even summary statistics on the large number ofedges. This also makes it difficult to compare graphson a pair-wise basis.

In this paper, we propose the concept of sketch-based micro-clusters for graph data. The broad idea in sketch-basedmicro-clusters is to combine the idea of sketch-based com-pression with micro-cluster summarization. This approachhelps in reducing the size of the representation of the under-lying micro-clusters, so that they are easy to store and use.We will also show that the approach continues to maintainbounded accuracy for the underlying computations.

This paper is organized as follows. The remainder ofthis section discusses related work and contributions. In thenext section, we will introduce the graph clustering problem,and the broad frameworkwhich is used to solve this problem.We will introduce the concept of graph micro-clusters, andhow they can be used for the clustering process. Section 3discusses the extension of these techniques with the use ofsketch-based structures. Section 4 contains the experimentalresults. Section 5 contains the conclusions and summary.

1.1 Related Work and Contributions Graph clusteringalgorithms can be either of the node clustering variety inwhich we have single large graph and we attempt to clusterthe nodes into groups of densely connected nodes. Thesecond class of algorithms is the object clustering variety,wherein we have many graphs which are drawn from a basedomain, and these different graphs are clustered togetherbased on their structural similarity. In this paper, we willfocus on the latter class of problems.

The case of node-clustering algorithms traditionallybeen studied in the context of the minimum cut problem[19], graph partitioning [15], network structure clustering[8, 16, 18], and dense subgraph determination [12, 21]. Inparticular, the techniques for dense subgraph determination[6, 12] use min-hash techniques in order to summarize mas-sive graphs, and then use these summaries in order to clusterthe underlying nodes. However, these techniques are lim-ited to node clustering of individual graphs, rather than theclustering of a stream of many graph objects.

Recently, methods have been studied for clusteringgraphs as objects in the context of XML data [1, 10]. How-ever these techniques have two shortcomings: (1) Thesetechniques are not designed for the case when the nodes aredrawn from a massive domain of possibilities. When thenumber of nodes is very large, the number of distinct edgesmay be too large to track effectively. (2) The available tech-niques are designed for disk-resident data, rather than graphstreams in which the individual objects are continuously re-ceived over time. This paper will achieve both goals. Thispaper provides the first time- and space-efficient algorithmfor clustering graph streams.

Space-efficiency is an important concern in the case ofmassive graphs, since the intermediate clustering data cannotbe easily stored for massive graphs. This goal is achievedby performing a hash-compression of the underlying micro-clusters. We will show that the hash-compression techniquedoes not lose significant effectiveness during the clusteringprocess. We will show that the additional process of hashcompression does not lose any effectiveness for the cluster-ing process. We will illustrate the effectiveness of the ap-proach on a number of real and synthetic data sets.


2 Graph Stream Clustering FrameworkIn this section, we will introduce the GMicro frameworkwhich is used for clustering graph streams. We assume thatwe have a node set N over which the different graphs aredefined. We note that each graph in the stream is typicallyconstructed over only a small subset of the nodes. Weassume that each element in N is a string which definesthe label of the corresponding node. For example, in thecase of an intrusion application, each of the strings in Ncorrespond to the IP-addresses. The nodes of the incominggraphs G1 . . . Gk . . . are each drawn on the subset of nodesN .

For purposes of notation, we assume that the set ofdistinct edges across all graphs are denoted by (X1, Y1). . . (Xi, Yi) . . . respectively. Each Xi and Yi is a nodelabel drawn from the set N . We note that this notationimplicitly assumes directed graphs. In the event of anundirected graph, we assume that lexicographic orderingon node labels is used in order to convert the undirectededge into a directed edge. Thus, the approach can also beapplied to undirected graphs by using this transformation.We also assume that the frequency of the edge (X i, Yi) ingraph Gr is denoted by F (Xi, Yi, Gr). For example, in atelecommunication application, the frequencymay representthe number of minutes of phone conversation between theedge-pair (Xi, Yi). In many applications, this frequencymay be implicitly assumed to be 1, though we work withthe more general case of arbitrary frequencies. We notethat when the node set N is very large, the total numberof distinct edges received by the data stream may be toolarge to even enumerate on disk. For example, for a nodeset of 107 nodes, the number of distinct edges may bemore than 1013. This may be too large to explicitly storewithin current disk resident constraints. The graph clusteringframework requires us to cluster the graphs into a group of kclusters C1 . . . Ck, such that each graph from the data streamis dynamically assigned to one of the clusters in real time.

While micro-clustering [2] has been used in order tocluster multi-dimensional data, we will construct micro-clusters which are specifically tailored to the problem ofgraph data. In this paper, we will use a sketch-based ap-proach in order to create hash-compressed micro-cluster rep-resentations of the clusters in the underlying graph stream.First, we will discuss a more straightforward representa-tion of the uncompressed micro-clusters, and the storage andcomputational challenges in maintaining these representa-tions. Then, we will discuss how the sketch-based techniquescan be used in order to effectively deal with these challenges.We will show that the sketch-based techniques can be used incombinationwith the micro-clusters to construct the distancefunctions approximately over the different clusters.

Next, we will introduce a more straightforward anddirect representation of graph-based micro-clusters. Let us

consider a cluster C containing the graphs {G1 . . . Gn}. Weassume that the implicit graph defined by the summation ofthe graphs {G1 . . . Gn} is denoted byH(C). Then, we definethe micro-clusterGCF (C) as follows:DEFINITION 1. The micro-cluster GCF (C) is defined asthe set (L(C), GCF2(C), GCF1(C),n(C), T (C)), with size(3·|L(C)|+2), whereL(C) is the set of edges in micro-clusterC. The individual components of GCF (C) are defined asfollows:

• L(C) is a set which contains a list of all the distinctedges in any of the graphsGi in C.

• GCF2(C) is a vector of second moments of the edgesin L(C). Consider an edge (Xq, Yq) ∈ L(C). Then thecorresponding second moment for that edge is definedas

∑nr=1 F (Xq, Yq, Gr)

2. We note that the value ofF (Xq, Yq, Gr) is implicitly assumed to be zero, when(Xq, Yq) is not present in the graphGr. We refer to thesecond moment value for (Xq, Yq) as J(Xq, Yq, H(C)).

• GCF1(C) is a vector of first moments of the edges inL. Consider an edge (Xq, Yq) ∈ L(C). Then the cor-responding first moment for that edge can be computedas F (Xq, Yq, H(C)) =

∑nr=1 F (Xq, Yq, Gr). This is

because the first moment is simply the same as the def-inition of the frequency of the edge, except that the un-derlying graph (final argument of the function F ()) isH(C).

• The number of graphs in the micro-cluster C is denotedby n(C).

• The time stamp is of the last graph which was added tothe cluster C is denoted by T (C).

One observation about micro-clusters is that for two clustersC1 and C2, the value of GCF (C1 ∪ C2) can be computed asa function of GCF (C1) and GCF (C2). This is because thelist L(C1 ∪ C2)) is the union of the lists L(C1) and L(C2).Similarly, the frequencies may be obtained by pairwiseaddition, and n(C1 ∪ C2) may be determined by examiningthe size of the setL(C1∪C2). The value of T (C1∪C2)may bedetermined by computing the minimum of T (C 1) and T (C2).We refer to this property as additive separability.

PROPERTY 2.1. The graph micro clusters satisfy the addi-tive separability property. This means that the micro-clusterstatistics for GCF (C1 ∪ C2) can be computed as a functionof GCF (C1) andGCF (C2).We note that graph micro-clusters also satisfy a limitedversion of the subtractivity property. All components ofGCF (C1 − C2) can be computed as a function of GCF (C1)andGCF (C2). We summarize as follows:


Algorithm GMicro(Number of Clusters: k)beginM = {};{ M is the set of micro-cluster statistics }repeatReceive the next stream graph Gr;If less than k clusters currently exist, thencreate micro-cluster statistics for singletongraph Gr , and insert it into set ofmicro-clustersM;if k micro-clusters exist, then computeedge structure similarity ofGr to each micro-clusterinM;if graph Gr lies outside the structure spread ofclosest micro-cluster then replace theleast recently updated cluster with newsingleton cluster containing only Gr ;else add Gr to thestatistics of the closest micro-cluster;

until data stream ends;end

Figure 1: The GMicro Algorithm

PROPERTY 2.2. The graph micro-clusters satisfy a limitedversion of the subtractivity property.

We note that the size of graph micro-clusters may in-crease over time. This is different from the multidimensionalcase. This difference is because the number of edges in thelist L(C) will grow as more and more graphs are added tothe data stream. As the size of L(C) increases, the space-requirements increase as well. Furthermore, the compu-tational complexity of distance computations also dependsupon L(C). Since the number of possible distinct edges inL(C) is large, this will result in unmanageable space- andtime-complexity with progression of the data stream. There-fore, we need a technique to further reduce the size of themicro-cluster representation. However, for simplicity, wewill first describe the technique without the use of the com-pressed representation. This broad framework is retainedeven when sketch based compression is used. Therefore, wewill first describe the use of the rawmicro-cluster statistics inorder to cluster the incoming graphs. Then, we will describehow sketch methods are used in order to make changes tospecific portions of the micro-cluster representation and cor-responding computations.

The micro-clustering algorithm uses the number ofmicro-clusters as input. We refer to the the Graph MICRO-clustering algorithm as the GMicro method. Initially, theclustering algorithm starts off with the null set of micro-clusters. As new graphs arrive from the data stream, theyare added to the data as singleton micro-clusters. Thus, thefirst k graph records are created as singleton micro-clusters.While this may not distinguish well between the records in

the initial clustering, the steady state behavior is impacted bythe subsequent steps of the clustering process. Subsequently,when the next graph Gr arrives, the distance to each micro-cluster centroid is computed. The distance measure that wecompute is constructed as a variant on the L2-distance mea-sure for multi-dimensional data and can be computed withthe use of micro-cluster statistics. We assign the incomingrecordGr to the closest centroid based on this structural dis-tance computation. However, in some cases, an incomingdata point in an evolving data stream may not fit well in anycluster. In order to handle this case, we check if the struc-tural spread of the picked micro-cluster is less than the dis-tance of Gr to that micro-cluster. The structural spread isdefined as a factor1 of the mean-square radius S(C) of theelements of micro-cluster C from its centroid. We also applythe spread criterion to only clusters which contain at leastmin init points. As in the case of the structural similaritymeasure, we will see that the spread can also be computedas a function of the micro-cluster statistics. If the structuralspread is less than the distance of Gr to the closest micro-cluster, then we create a new singleton micro-cluster con-taining only Gr. This micro-cluster replaces the most stale(least recently updated) micro-cluster. The information onthe last update time of the micro-clusters is available fromthe corresponding time stamps in the micro-cluster statistics.The overall algorithm is illustrated in Figure 1.

2.1 Computing Edge Structural Similarity and SpreadSince we are dealing with the case of sparse structural data,we need to normalize for the frequency of edges included inboth the incoming record and the centroid to which the sim-ilarity is being computed. We note that a micro-cluster canalso be considered a pseudo-graph for which the frequenciesof the corresponding edges are defined as the sum of the cor-responding frequencies of the edges from which the micro-cluster was created. Therefore, we simply need to define adistance (similarity) function between two graphs in order tocompute the similarity betweenmicro-clusters and centroids.Let C be a given micro-cluster which contains the graphsG1 . . . Gn. Let the implicit graph for the micro-cluster C(corresponding to the summation of the graphsG 1 . . . Gn) bedenoted by H(C). Let the corresponding normalized graph(by dividing each edge frequency of H(C) by n(C)) be de-noted byH(C).) Thus,H(C) represents the centroid graph ofall the graphs in the micro-cluster. Let the edges in L(C) bedenoted by (X1, Y1) . . . (Xm, Ym). Let Gt be the incominggraph. Then, the L2-distance L2Dist(Gt, H(C)) betweenthe graphsGt andH(C) is defined as follows:

L2Dist(Gt, H(C)) =m∑i=1

(F (Xi, Yi, Gt)− F (Xi, Yi,H(C))

n(C))2

1We pick this factor to be 3 by normal distribution assumption.


A second possibility for the computation of the similar-ity function is the dot product. Unlike, the L2-distance func-tion, higher values imply greater similarity. The dot productDot(Gt, H(C)) between the graphsGt andH(C) is definedas follows:

Dot(Gt,H(C)) =m∑i=1

F (Xi, Yi, Gt).F (Xi, Yi, H(C))

n(C)

Next, we will define the structural spread of a givencluster. Since the structural spread is defined as a function ofthe mean-square radius, we will first define the mean squareradius of the micro-cluster C. Then, the mean-square radiusS(C) of C is defined as follows:

S(C) = 1

n

n∑j=1

L2Dist(Gj ,H(C))

=1

n·

n∑j=1

m∑i=1

(F (Xi, Yi, Gj)− F (Xi, Yi,H(C))

n(C))2

The spread is defined as a factor2 t multiplied withS(C). Both the structural distance measure and the structuralspread can be computed as a function of the micro-clusterstatistics. This is because the value of F (Xq, Yq, H(C))is directly available from the first-order statistics of micro-cluster C. Similarly, the value of n(C) is included inthe micro-cluster statistics. Therefore, we summarize asfollows:

LEMMA 2.1. The structural similarity measures denoted byL2dist(Gt, H(C)) and Dot(Gt, H(C)) between Gt and thecentroid graphH(C) for cluster C can be computed from themicro-cluster statistics.

The spread S(C) can also be directly computed from themicro-cluster statistics. The corresponding value can beobtained by simplifying the expression for S(C).LEMMA 2.2. The structural spread S(C) can be computedfrom the micro-cluster statistics.

Proof. Let us denote F (Xi, Yi, H(C))/n(C) by pi. Thisrepresents the average frequency of the edges for the centroidof the micro-cluster. As discussed earlier, this can becomputed directly from the micro-cluster statistics. Bysubstituting in the expression for S(C), we get the following:

(2.1) S(C) = 1

n(C)n∑

j=1

m∑

i=1

(F (Xi, Yi, Gj)− pi)2

2We use t = 3 in accordance with the normal distribution assumption.

By expanding the expression for S(C), we can simplify asfollows:

S(C) =

=

∑mi=1 J(Xi, Yi,H(C))

n(C) − 2m∑i=1

pi ·∑n

j=1 F (Xi, Yi, Gj)

n(C) +

+m∑i=1

p2i

=

∑mi=1 J(Xi, Yi,H(C))

n(C) − 2 ·m∑i=1

·pi · pi +m∑i=1

p2i

=

∑mi=1 J(Xi, Yi, H(C))

n(C) −m∑i=1

p2i

We note that all the terms in the above definition aredrawn from the micro-cluster definition. Therefore, thespreadS(C) can be computed directly from the micro-clusterstatistics.

3 Sketch Based Micro-cluster CompressionThe storage and computational requirements for updating themicro-clusters depend upon the number of edges in them.The number of edges in the micro-clusters will typicallyincrease as new graphs arrive in the stream. As the size ofthe micro-cluster increase, so does the time for computingthe distance functions of incoming data points from theclusters. When the domain size is extremely large, thenumber of distinct edges can be too large for the micro-cluster statistics to be maintained explicitly. For example,consider the case when the number of possible nodes is107. This is often the case in many real applications suchas IP-network data. Since the number of possible edges maybe as large as 1013, the size of the micro-cluster statisticsmay exceed the disk limitations, after a sufficient number ofgraphs are received. This leads to challenges in storage andcomputational efficiency.

Sketch based approaches [5, 9] were designed for enu-meration of different kinds of frequency statistics of datasets. A commonly-used sketch is the count-min method [9].In this sketch, we use w = �ln(1/δ)� pairwise independenthash functions, each of which map onto uniformly randomintegers in the range h = [0, e/ε], where e is the base ofthe natural logarithm. The data structure itself consists ofa two dimensional array with w · h cells with a length ofh and width of w. Each hash function corresponds to oneof w 1-dimensional arrays with h cells each. In standardapplications of the count-min sketch, the hash functions areused in order to update the counts of the different cells inthis 2-dimensional data structure. For example, consider a1-dimensional data stream with elements drawn from a mas-sive set of domain values. When a new element of the datastream is received, we apply each of the w hash functions to


map onto a number in [0 . . . h− 1]. The count of each of theset of w cells is incremented by 1. In the event that each itemis associated with a frequency, the count of the correspond-ing cell is incremented by the corresponding frequency. Inorder to estimate the count of an item, we determine theset of w cells to which each of the w hash-functions map,and determine the minimum value among all these cells. Letct be the true value of the count being estimated. We notethat the estimated count is at least equal to ct, since we aredealing with non-negative counts only, and there may be anover-estimation because of collisions among hash cells. Asit turns out, a probabilistic upper bound to the estimate mayalso be determined. It has been shown in [9], that for a datastream with T arrivals, the estimate is at most ct + ε · T withprobability at least 1 − δ. The sketch can also be used inorder to estimate the frequencies of groups of items by usingthese same approach. The count-min sketch can be used inorder to estimate the frequency behavior of individual edgesby treating each edge as an item with a unique string value.We note that each edge (Xi, Yi) can be treated as the stringXi ⊕ Yi where ⊕ is the concatenation operator on the nodelabel stringsXi and Yi. This string can be hashed into the ta-ble in order to maintain the statistics of different edges. Thecorresponding entry in incremented by the frequency of thecorresponding edge.

We can use the sketch based approach in order to con-struct the sketched micro-cluster. The idea is that the por-tions of the micro-cluster whose size is proportional to thenumber of edges are not stored explicitly, but implicitly inthe form of sketch table counts. We will then see how wellthe individual components of the micro-cluster representa-tion are approximated. Since all clustering computations canbe performed in terms of micro-cluster statistics, it followsthat the clustering computations can be effectively performedas long as the underlying micro-cluster statistics can be ap-proximated. The compressed micro-clusters are defined asfollows:

DEFINITION 2. Themicro-clusterGCF (C) is defined as theset (GSketch(C), R(C), n(C), T (C)) of size (e/ε)·ln(1/δ)+3. The individual components of GCF (C) are defined asfollows:

• The data structure GSketch(C), contains a sketch-table of all the frequency-weighted graphs which areincluded in the micro-cluster. This requires a table withsize (e/ε) · ln(1/δ). The actual micro-cluster update isperformed as follows. For each edge (Xi, Yi) for anincoming graph, we compute the concatenation stringXi ⊕ Yi, and hash it into the table with the use of whash functions. We add the frequency of the incomingedge to the corresponding w entries.

• We maintain R(C) = ∑mi=1 J(Xi, Yi, H(C)) explicitly.

This is done by adding the square of the frequency of

the incoming edge to R(C).• The number of graphs in the micro-cluster C is denotedby n(C).

• The time stamp is of the last graph which was added tothe cluster C is denoted by T (C).

The above definition implies that a separate sketch-table ismaintained with each micro-cluster. It is important to notethat we use the same set of corresponding hash functionsfor each sketch table. This is important in order to computeimportant statistics about the micro-clusters such as the dot-product.

The GMicro algorithms can be used with this new def-inition of micro-clusters except that the intermediate com-putations may need to be performed as sketch-based esti-mates. In the remaining portion of this section, we will dis-cuss how these estimates are computed, and the accuracy as-sociated with such computation. We note that the first-orderand second-order statistics are implicitly coded in the sketchtable. LetW (C) be the sum of the edge frequencies inH(C).The sketch encodes implicit information about the micro-clusters. The first-order and second-order statistics can beestimated as follows:

• F (Xi, Yi, H(C)) can be estimated by hashing Xi ⊕ Yi

into the hash table with the use of the w hash func-tions, and computing the minimum of the correspond-ing entries. It can be directly shown [9] that the cor-responding estimate F̂ (Xi, Yi, H(C)) lies in the range[F (Xi, Yi, H(C)), F (Xi, Yi, H(C)) + ε · W (C)] withprobability at least 1− δ.

• We note that J(Xi, Yi, H(C)) cannot be estimated ef-fectively. One possibility is to compute an estimateon J(Xi, Yi, H(C)) by computing the minimum of thesquare of the corresponding entries for X i ⊕ Yi in thesketch table. The bound on this estimate is quite loose,and therefore we will not use the approach of esti-mating J(Xi, Yi, H(C)). The additional informationR(C) =

∑mi=1 J(Xi, Yi, C) (maintained in the sketch

statistics) is sufficient to perform the intermediate com-putations for clustering.

The above observations emphasize that intermediate in-formation on the micro-cluster statistics can be constructedapproximately with the sketch technique. This is useful,since all the important properties of the clusters are encodedin the micro-cluster statistics. For example, if the behaviorof the different portions of the graph (or specific edges) needto be examined in the context of different clusters, the cor-responding micro-cluster statistics need to be derived. Next,we will discuss the estimation of important quantitative com-putations which are performed during the clustering process.


3.1 Distance estimations We will expand the expressionfor L2Dist in order to express it in terms of sketch-basedmicro-cluster statistics:

L2Dist(Gt, H(C)) =m∑i=1

(F (Xi, Yi, Gt)− F (Xi, Yi,H(C))

n(C))2

=m∑i=1

F (Xi, Yi, Gt)2 − 2

m∑i=1

F (Xi, Yi, Gt) · F (Xi, Yi,H(C))n(C) +

+m∑i=1

F (Xi, Yi, H(C))2n(C)2

All of the three expressions in the above expansionare dot products. Of these dot products, the value of theexpression

∑mi=1 F (Xi, Yi, Gt)

2 can be computed exactly,by using the statistics of the incoming graph Gt. The othertwo dot products are estimated using the technique discussedfor [9]. Specifically, in the second term, F (X i, Yi, Gt)can be computed exactly, while F (Xi, Yi, H(C)) can becomputed directly from the sketch table GSketch(C). Weperform a pairwise multiplication for each edge appearedin the incoming graph Gt, and use the sum to estimate∑m

i=1 F (Xi, Yi, Gt) · F (Xi, Yi, H(C)) in the second term.The value of the third term (

∑mi=1 F (Xi, Yi, H(C))2) can be

estimated by performing the dot product between two copiesof GSketch(C). There is a one-to-one correspondenceamong the cells of both copies. We perform pairwise dotproducts for the w different rows in the sketch table, andpick the minimum of these values as the estimate.

Next, we will bound the quality of the distance estima-tion. Since the distance estimation is expressed as a func-tion of individual dot-products (which can themselves bebounded), this also helps in bounding the overall quality ofthe estimation. Let V (Gt) be the sum of the frequencies ofthe edges in Gt. Then, we can show the following:

LEMMA 3.1. With probability at least (1 − 2 · δ), the esti-mate of L2Dist(Gt, H(C)) with the use of the sketch-basedapproach lies in the range [L2Dist(Gt, H(C))−2·ε·V (Gt)·W (C)/n(C), L2Dist(Gt, H(C)) + ε ·W (C)2/n(C)2].

Proof. We note that the computation of L2Dist requires theestimation of two terms, which have opposite effects on theoverall estimate. Each extreme case is when one of the termsis estimated as exactly as possible, and the other is overesti-mated as much as possible. We deal with these cases below:Extreme Case I:

∑mi=1 F (Xi, Yi, H(C))2 is exactly es-

timated, but F (Xi, Yi, H(C)) · F (Xi, Yi, Gt) is over-estimated: This forms the lower bound for the range, sincethe over-estimated term has a negative sign attached beforeit. We know from [9], that the over-estimation of this dotproduct is no more than ε · V (Gt) · W (C) with probabilityat least (1 − δ). Scaling by the constant 2/n(C) to accountfor the constant factor in front of the term, we derive that thelower bound is at least L2Dist(Gt, H(C)) − 2 · ε · V (Gt) ·

W (C)/n(C) with probability at least 1− δ.ExtremeCase II: F (Xi, Yi, H(C))·F (Xi, Yi, Gt) is exactlyestimated, but

∑mi=1 F (Xi, Yi, H(C))2 is over-estimated:

This forms the upper bound for the range. As in the pre-vious case, we can show that the level of over-estimation isat most ε · W (C)2 with probability at least 1 − δ. Scalingby the factor 1/n(C)2 to account for the constant factor infront of the term, we derive that the upper bound is at mostL2Dist(Gt, H(C)) + ε · W (C)2/n(C)2 with probability atleast 1− δ.

Since the bounds for either of the two cases are violatedwith probability at most δ, the probability of neither boundbeing violated is at least 1− 2 · δ. This proves the result.

The above result can also be used for dot-product estimation.

LEMMA 3.2. With probability at least (1 − δ), the estimateofDot(Gt, H(C)) with the use of the sketch-based approachlies in the range [Dot(Gt, H(C), Dot(Gt, H(C))+ε·V (Gt)·W (C)/n(C)].

Proof. This follows directly from the dot product results in[9].

3.2 Estimation of Spread In this section, we will discussthe estimation of the spread S(C) with the sketch-basedapproach. It was shown earlier that the value of S(C) isestimated as follows:

S(C) =∑m

i=1 J(Xi, Yi, H(C))n(C) −

m∑

i=1

p2i

=R(C)n(C) −

m∑

i=1

p2i

The above expression can be estimated directly from thesketch statistics. BothR(C) and n(C) are maintained directlyin the sketched micro-cluster statistics. Next, we discuss thecomputation of the second term. The value of

∑mi=1 p

2i can

be estimated as the sum of the squares of the sketch compo-nents in each row. We compute the minimum value acrossw rows, and denote this value by Pmin. The correspond-ing term is estimated as Pmin/n(C)2. Next, we will boundthe quality of the estimation with the use of the sketch-basedapproach.

LEMMA 3.3. With probability at least 1−δ, the sketch basedestimation of S(C) lies in the range [S(C) − ε · ∑m

i=1 p2i ,

S(C)].

Proof. We note that S(C) is expressed using two terms, thefirst of which is known exactly. The only source of inaccu-racy is in the estimation of

∑ni=1 p

2i , which is computed as

a self dot-product, and therefore over-estimated. Since thisterm adds negatively to the overall estimation, it follows that


the overall computation is always under-estimated. There-fore, the upper bound on the estimation is the true value ofS(C).

In order to compute the lower bound, we consider thecase when the second term

∑mi=1 p

2i is over-estimated as

much as possible. In order to estimate this value, we considera hypothetical graph Q(C) in which all edges of H(C) arereceived exactly once, and the frequency of the ith edgeis F (Xi, Yi, H(C)). We note that the sketch of this graphis exactly the same as that of H(C), since the aggregatefrequencies are the same. Therefore, the dot product ofQ(C) with itself will estimate ∑m

i=1 F (Xi, Yi, H(C))2 =n(C)2 · ∑n

i=1 p2i . The dot-product estimation for the graph

Q(C) is exactly equal to Pmin. Therefore, the value ofPmin/n(C)2 is an estimate of

∑mi=1 p

2i . By using the bounds

discussed in [9], it can be shown that this over-estimate isat most ε · ∑m

i=1 p2i with probability at least 1 − δ. This

establishes the lower bound.

4 Experimental ResultsIn this section, we will present the experimental results fromthe use of this approach. We will test the techniques forboth efficiency and effectiveness. We will test both the exactclustering approach and the compression-based clusteringapproach. We will show that the two techniques are almostequally good in terms of quality, but the compression-basedtechnique is significantly superior in terms of efficiency. Thisis because the size of the underlying micro-clusters in thedisk-based technique increases with progression of the datastream. This results in a slow down of the exact clusteringtechnique with progression of the data stream.

4.1 Data Sets We used a combination of real and syn-thetic data sets in order to test our approach. The real datasets used were as follows:

(1) DBLP Data Set: The DBLP data set contains sci-entific publications in the computer science domain. Wefurther processed the data set in order to compose author-pair streams from it. All conference papers ranging from1956 to March 15th, 2008 were used for this purpose. Thereare 595, 406 authors and 602, 684 papers in total. We notethat the authors are listed in a particular order for each paper.Let us denote the author-order by a1, a2, . . . , aq . An authorpair 〈ai, aj〉 is generated if i < j, where 1 ≤ i, j ≤ q. Thereare 1, 954, 776 author pairs in total. Each conference paperalong with its edges was considered a graph. We used aclustering input parameter of k = 2000 clusters.

(2) IBM Sensor Data Set: This data contained infor-mation about local traffic on a sensor network which issueda set of intrusion attack types. Each graph constituted alocal pattern of traffic in the sensor network. The nodes

correspond to the IP-addresses, and the edges correspondto local patterns of traffic. We note that each intrusiontypically caused a characteristic local pattern of traffic, inwhich there were some variations, but also considerablecorrelations. We used two different data sets with thefollowing characteristics:Igraph0103-07: The data set Igraph0103-07 contained astream of intrusion graphs from June 1, 2007 to June 3,2007. The data stream contained more than 1.57 ∗ 106 edgesin the aggregate, which were distributed over approximately2250 graphs. We note that this graph was much densercompared to the DBLP data set, since each individualgraph was much larger. Thus, even though the number ofgraphs do not seem very large, the size of the underlyingedge streams were huge, since each graph occupies a largeamount of space. We intentionally chose a graph structurewhich was very different from the DBLP data set, sincethis helps in evaluating our algorithm on different kinds ofgraphs.Igraph0406-07: The data set Igraph0406-07 contained astream of intrusion graphs from June 4, 2007 to June 6,2007. The data stream contained more than 1.54 ∗ 106 edgesin the aggregate, which were distributed over approximately2760 graphs. We used a clustering input parameter ofk = 120 clusters.

(3) Synthetic Data Set: We used the R-Mat data gen-erator in order to generate a base template for the edges fromwhich all the graphs are drawn. The input parameters forthe R-Mat data generator were a = 0.5, b = 0.2, c = 0.2,S = 17, and E = 508960 (using the CMU NetMinenotations). If an edge is not present between two nodes,then the edge will also not be present in any graph in thedata set. Next, we generate the base clusters. Suppose thatwe want to generate κ base clusters. We generate κ differentzipf distributions with distribution function 1/iθ. These zipfdistributions will be used to define the probabilities for thedifferent nodes. The base probability for an edge (whichis present on the base graph) is equal to the product of theprobabilities of the corresponding nodes. However, we needto adjust these base probabilities in order to add furthercorrelations between different graphs.

Next, we determine the number of edges in each graph.The number of edges in each of the generated graph is de-rived from a normal distribution with mean μ = 100 andstandard deviation σ = 10. The proportional number ofpoints in each cluster is generated using a uniform distri-bution in [α, β]. We used α = 1, and β = 2. In order togenerate a graph, we first determine which cluster it belongsto by using a biased die, and then use the probability distri-butions to generate the edges. The key here is that the differ-ent node distributions be made to correlate with one another.One way of doing so is as follows. Let Z1 . . .Zκ be the κ


different Zipf distributions. In this case, we used k − 20 inorder to generate the data set. In order to add correlations,we systematically add the probabilities for some of the otherdistributions to the ith distribution. In other words, we pickr other distributions and add them to the ith distribution afteradding a randomly picked scale factor. We define the distri-bution Si from the original distribution Zi as follows:

Si = Zi + α1 · (randomly picked Zj)+ . . .

. . .+ αr · (randomly picked Zq)

α1...αr are small values generated from a uniform dis-tribution in [0, 0.1]. The value of r is picked to be 2 or3 with equal probability. We use S1 . . . Sr to define thenode probabilities. We used a clustering input parameter ofk = 20.

For all data sets (unless otherwise mentioned), the de-fault length of the hash table was 500, and the defaultnumber of hash functions was 15.

4.2 Evaluation Metrics We used a variety of metrics forthe purposes of evaluation. For the case of the synthetic datasets, we used the cluster purity measure. For each generatedcluster, we determined the dominant cluster id (based onthe synthetic generation identifier), and reported the averagecluster purity over the different clusters. The higher thecluster purity, the better the quality of the clustering. Onthe other hand, this is not an effective metric for the caseof real data sets. This is because the “correct” definitionof an unsupervised cluster is unknown in real data sets.Thereforewe rely on two criteria to test the effectiveness: (1)We explicitly examine the clusters anecdotally to illustratetheir coherence and interpretability. (2) A possible sourceof error can be the use of the sketch-based approximation.Therefore, we test the percentage of time that the sketch-based approximation results in a different assignment thanone which is achieved by using the exact representation ofthe micro-clusters.

Therefore, for the purposes of evaluation only, we alsoretain the exact representations of the micro-clusters whichare constructed on the clusters maintained with the approxi-mate sketch-based approach. We note that this option is foreffectiveness evaluation purposes only and is disabled dur-ing efficiency measurements. Then, we compute the assign-ment using the exact as well as sketch-based computation.We compute the fraction of time that the two assignmentsare the same. A perfect situation would be one in which thevalue of this fraction is 1.

4.3 Clustering Evaluation We first present results on ef-fectiveness. For the case of real data sets, no realistic“ground-truth” can be inferred for an unsupervised problem.Therefore, we will intuitively examine some anecdotal evi-

0

0.2

0.4

0.6

0.8

1

2000 4000 6000 8000 10000

CLU

STE

R P

UR

ITY

GRAPHS PROCESSED

a) QUALITY

DISK-BASEDSKETCH-BASED

0

1000

2000

3000

4000

5000

6000

20 40 60 80 100 120 140 160

PR

OC

ES

SIN

G R

ATE

(ED

GE

S/S

EC

)

TIME (SECONDS)

b) PROCESSING RATE


0

0.2

0.4

0.6

0.8

1

200 300 400 500 600 700 800

CLU

STE

R P

UR

ITY

LENGTH OF SKETCH TABLE

c) EFFECTIVENESS SENSITIVITY (TABLE LENGTH)


0

500

1000

1500

2000

2500

200 300 400 500 600 700 800

TIM

E (S

EC

ON

DS

)


d) EFFICIENCY SENSITIVITY(TABLE LENGTH)


0

0.2

0.4

0.6

0.8

1

10 12 14 16 18 20

CLU

STE

R P

UR

ITY

WIDTH OF SKETCH TABLE

e) EFFECTIVENESS SENSITIVITY(TABLE WIDTH)


0

500

1000

1500

2000

2500

10 12 14 16 18 20

TIM

E (S

EC

ON

DS

)


f) EFFICIENCY SENSITIVITY(TABLE WIDTH)


Figure 2: Performance on Synthetic Data Set

0

0.2

0.4

0.6

0.8

1

300 600 900 1200 1500 1800AS

SIG

NM

EN

T A

CC

UR

AC

Y

GRAPHS PROCESSED

a) ASSIGNMENT ACCURACY(SKETCH APPROX.)

SKETCH-BASED 0

300

600

900

1200

40 60 80 100 120 140

PR

OC

ES

SIN

G R

ATE

(ED

GE

S/S

EC

)

TIME (SECONDS)

b) PROCESSING RATE


0

0.2

0.4

0.6

0.8

1

100 200 300 400 500 600AS

SIG

NM

EN

T A

CC

UR

AC

Y


c) EFFECTIVENESS SENSITIVITY(TABLE LENGTH)

SKETCH-BASED 0

80

160

240

320

100 200 300 400 500 600

TIM

E (S

EC

ON

DS

)




0

0.2

0.4

0.6

0.8

1

10 12 14 16 18 20AS

SIG

NM

EN

T A

CC

UR

AC

Y



SKETCH-BASED 0

80

160

240

320

10 12 14 16 18 20

TIM

E (S

EC

ON

DS

)




Figure 3: Performance on IGRAPH0103-07 Data Set


0

0.2

0.4

0.6

0.8

1

300 600 900 1200 1500 1800AS

SIG

NM

EN

T A

CC

UR

AC

Y

GRAPHS PROCESSED


SKETCH-BASED 0

300

600

900

1200

1500

40 60 80 100 120 140

PR

OC

ES

SIN

G R

ATE

(ED

GE

S/S

EC

)

TIME (SECONDS)

b) PROCESSING RATE


0

0.2

0.4

0.6

0.8

1

100 200 300 400 500 600AS

SIG

NM

EN

T A

CC

UR

AC

Y



SKETCH-BASED 0

200

400

600

800

100 200 300 400 500 600

TIM

E (S

EC

ON

DS

)




0

0.2

0.4

0.6

0.8

1

10 12 14 16 18 20AS

SIG

NM

EN

T A

CC

UR

AC

Y



SKETCH-BASED 0

200

400

600

800

10 12 14 16 18 20

TIM

E (S

EC

ON

DS

)




Figure 4: Performance on IGRAPH0406-07 Data Set

0

0.2

0.4

0.6

0.8

1

5000 10000 15000 20000AS

SIG

NM

EN

T A

CC

UR

AC

Y

GRAPHS PROCESSED


SKETCH-BASED 0

10 20 30 40 50 60 70

80 160 240 320 400

PR

OC

ES

SIN

G R

ATE

(ED

GE

S/S

EC

)

TIME (SECONDS)

b) PROCESSING RATE


0

0.2

0.4

0.6

0.8

1

100 200 300 400 500 600AS

SIG

NM

EN

T A

CC

UR

AC

Y



SKETCH-BASED 0

800

1600

2400

3200

100 200 300 400 500 600

TIM

E (S

EC

ON

DS

)




0

0.2

0.4

0.6

0.8

1

10 12 14 16 18 20AS

SIG

NM

EN

T A

CC

UR

AC

Y



SKETCH-BASED 0

800

1600

2400

3200

10 12 14 16 18 20

TIM

E (S

EC

ON

DS

)




Figure 5: Performance on DBLP Data Set

dence about the clusters in order to explore their natural co-herence. Then, we will examine the accuracy of the sketch-based approximation with quantitative comparisons of thesketch based assignments with those that use the originaldata.

We will first present some summary results for a groupof clusters obtained by the algorithm in the case of the DBLPdata set. The most frequently occurring authors in these clus-ters are as follows:Cluster A: Frequent Authors: Jiawei Han, Umeshwar Dayal, Jian Pei, KeWangCluster A: Description: Sequential Pattern Mining Papers Published be-tween 2000 and 2004Cluster B: Frequent Authors: Herbert Edelsbrunner, Bernard Chazelle,Leonidas J. Guibas, John Hershberger, Micha Sharir, Jack Snoeyink, EmoWelzlCluster B: Description: The cluster contains a group of papers on compu-tational geometry.Cluster C: Frequent Authors: Mahmut T. Kandemir, Alok N. Choudhary,J. Ramanujam, Prithviraj BanerjeeCluster C: Description: The cluster contains papers on parallel computingwritten between 1999 and 2003.It is clear that in each case, the clusters contain a coherent setof authors together with papers on the same subject matter.This was generally the case across all the clusters. The aimof the above examples is to simply provide an intuitive ideaof the meaningfulness of the underlying clusters. We willprovide some quantitative measures slightly later.

Next, we will compare the effectiveness of the exactclustering approach with one that uses hash-compressedmicro-clusters. The effectiveness for both the exact andcompression-based clustering approach for the different datasets are illustrated in Figures 2(a), 3(a), 4(a) and 5(a). Inthe case of the synthetic data set, we use cluster purityas the measure, whereas in the case of the real data sets,we used the fraction of time that the same assignment wasperformed by both the two approaches. In the case ofreal data sets, we computed the assignment with the useof both exact and sketch-based statistics, and we checkedif they were the same. For the synthetic data set, we notethat the quality of the two approaches is almost identical.The purity of the compression-based clustering approach isonly slightly lower than the purity of the exact clusteringapproach. For the real data sets, the percentage of timethat the two approaches result in the same assignment ofan incoming data point to a given cluster was typicallyover 90%. Some cases in which the distance differenceswere small between the first and second choices resultedin a different ordering of assignments. However, suchdifferences do not typically result in qualitative differencesin the underlying clustering process. This suggests that thesketch-based approximation of the micro-clusters maintainsthe accuracy of the clustering process.


We also tested the efficiency of the two methods. Allresults were tested on a Debian GNU/Linux server (dou-ble dual-core 2.4 GHz Opteron processors, 4GB RAM). InFigures 2(b), 3(b), 4(b) and 5(b) we have illustrated theefficiency of the clustering method on different data sets.The progression of the stream is illustrated on the X-axis,whereas the stream processing rate (the number of edges pro-cessed per second) is illustrated on the Y -axis. Since the ex-act clustering approach uses a disk-based scheme to handlethe large space requirements of data sets, its processing rateis significantly lower than the sketch-based approach. Fur-thermore, the size of the micro-clusters increases with pro-gression of the stream, since the number of edges tracked byeachmicro-cluster increases with stream progression. There-fore, the technique slows down further with stream progres-sion. On the other hand, the processing rate of the sketch-based approach is significantly faster than the exact cluster-ing approach, and it is not affected by the progression of thestream. This is because the size and update of the memory-resident sketch table remains unaffected with the progres-sion of the data stream. On the other hand, the number ofdistinct edges increases with progression of the data stream.This slows down the disk-based approach significantly. Theefficiency results with stream progression are illustrated inFigures 3(b) and 4(b). It is evident that the processing rateof the disk-based approach is heavily influenced by the dis-tribution of the incoming graphs, while the sketch-based ap-proach maintains a relatively stable performance with timeprogression. The low variability of the processing rate of thesketch-based method is a clear advantage from the perspec-tive of practical applications.

We also tested the sensitivity of the clustering approachwith sketch-table parameters. From the estimation analysisin section 3, it is evident that we can obtain better qualityresults by increasing the number of hash functions w andthe range h. On the other hand, it is also not advantageousto increase the sketch table size unnecessarily, since thisresults in inefficiency on account of poor cache locality. It isdesirable that a high quality clustering can be obtained withthe use of a reasonably small sketch table. In this section,we will conduct sensitivity analysis of the effectiveness andefficiency with sketch table size.

The effectiveness and efficiency results of the two meth-ods on the DBLP data set are illustrated in Figures 5(a) and(b). It is evident that the two approaches resulted in a verysimilar assignment, and the processing rate of the sketch-based approach is significantly higher than the disk-basedapproach. Since the disk-based approach requires too muchtime to process the whole DBLP data set, we will use onlythe first 5,000 graphs for sensitivity analysis.

Figures 2(c) and (d) illustrate the impact of sketch ta-ble length on effectiveness and efficiency of the cluster-ing process. We use the results of the exact clustering ap-

proach as the baseline. These results are constant across therange of sketch-table parameters, because the exact cluster-ing approach does not use the sketch table. We can see thatthe clustering quality improves with increasing sketch tablelength. This is because collisions are more likely to occur insmaller hash tables. On the other hand, the efficiency is notaffected much by the sketch table length due to the constantlookup time of hash tables. We also reported the sensitivityanalysis of sketch table length on the real data sets in Fig-ures 3(c), (d), 4(c), (d) and 5(c), (d). As the case of syntheticdata sets, when the length of the sketch table is larger than500, the similarity of assignment between the two methods ismore than 90%. Thus, for modestly large sketch-table sizes,the approach is able to closely mimic the behavior of the ex-act clustering approach.

We also tested the sensitivity of the approach to thenumber of hash functions. The number of hash functionswas varied from 10 to 20. The results for the synthetic datasets are illustrated in Figures 2(e), and (f), and those forthe real data sets are illustrated in 3(e), (f), 4(e), (f) and5(e), (f). As in the previous case, we present the resultsof the exact clustering approach as the baseline in eachfigure. The processing time increases linearly when thenumber of hash functions increases. That is because theprocess of determining the minimum value among all thecells requires us to look up each hash function once. Wealso note that the quality is not affected very significantly bythe number of hash functions. While increasing the numberof hash functions improves the robustness, its effect on theabsolute quality is relatively small. This implies that we canuse a small number of hash-functions in order to maintainefficiency, while retaining effectiveness.

It is also valuable to test the efficiency of the proposedapproach over varying numbers of clusters. The results forsynthetic and real data sets are illustrated in Figures 6 (a),(b), (c) and (d), respectively. As a comparison, we presentthe results of the exact clustering approach for each data set.In all figures, the X-axis illustrates the number of clusters,and the Y -axis represents the running time in seconds. TheDBLP data set contains many authors and papers whichtend to have numerous underlying clusters. Because of thischaracteristic of the DBLP data set, we vary the numberof clusters from 2000 to 3000. We vary the number ofclusters from 30 to 130 for the synthetic data set, and varythe number from 120 to 220 for the two sensor data sets.Other settings are the same as the previous figures. FromFigures 6, it is evident that our approach scales linearlywith increasing number of clusters for all data sets. Thisis because the number of sketch tables and the distancefunction computations scale linearly with increasing numberof clusters.


0

500

1000

1500

2000

2500

3000

40 60 80 100 120

TIM

E (S

EC

ON

DS

)

NUMBER OF CLUSTERS

a) SYNTHETIC DATA SET


0

100

200

300

400

120 140 160 180 200 220

TIM

E (S

EC

ON

DS

)

NUMBER OF CLUSTERS

b) IGRAPH0102-07 DATA SET


0

200

400

600

800

1000

120 140 160 180 200 220

TIM

E (S

EC

ON

DS

)

NUMBER OF CLUSTERS

c) IGRAPH0406-07 DATA SET


0

800

1600

2400

3200

2000 2200 2400 2600 2800 3000

TIM

E (S

EC

ON

DS

)

NUMBER OF CLUSTERS

d) DBLP DATA SET


Figure 6: Sensitivity Analysis to the Number of Clusters

5 Conclusions and SummaryIn this paper, we presented a new algorithm for cluster-ing massive graph streams. While the problem of cluster-ing graph data has been discussed in the literature, the cur-rently available techniques are not designed for fast datastreams. Furthermore, available methods are not designedfor the case of massive graphs. In such cases, the numberof distinct edges is too large to manage effectively. Thiscase leads to unique challenges because it is no longer pos-sible to efficiently hold even summary information. In thispaper, we address these challenges with the use of a novelhash-compressed micro-cluster technique. The goal of thistechnique is to use a summarized micro-cluster representa-tion which can be efficiently maintained in limited space(and therefore in main memory). This technique continuesto maintain the effectiveness of the method without losingefficiency. We present experimental results illustrating theeffectiveness and efficiency of the method.

AcknowledgementThis work is partially supported by the National ScienceFoundation under Grants No. IIS- 0905215.

References

[1] C. Aggarwal, N. Ta, J. Feng, J. Wang, and M. J. Zaki, XProj:A Framework for Projected Structural Clustering of XMLDocuments, KDD Conference Proceedings (2007), pp. 46–55.

[2] C. Aggarwal, J. Han, J. Wang, and P. Yu, A Frameworkfor Clustering Evolving Data Streams, VLDB ConferenceProceedings (2003), pp. 81–92.

[3] C. Aggarwal, Data Streams: Models and Algorithms,Springer (2007).

[4] C. Aggarwal, and H. Wang, Managing and Mining GraphData, Springer (2010).

[5] N. Alon, Y. Matias, and M. Szegedy, The Space Complexityof Approximating the Frequency Moments, ACM Symposiumon Theory of Computing (1996), pp. 20–29.

[6] A. Z. Broder, M. Charikar, A. Frieze, and M. Mitzenmacher,Syntactic clustering of the Web, WWW Conference, Com-puter Networks (1997), 29(8–13), pp. 1157–1166.

[7] L. O’Callaghan, N. Mishra, A. Meyerson, S. Guha, andR. Motwani, Streaming-Data Algorithms For High-QualityClustering, ICDE Conference Proceedings (2002), pp. 685.

[8] D. Chakrabarti, R. Kumar, and A. Tomkins, Evolutionaryclustering, KDD Conference Proceedings, (2006) pp. 554–560.

[9] G. Cormode, and S. Muthukrishnan, An Improved Data-Stream Summary: The Count-min Sketch and its Applications,Journal of Algorithms (2005), 55(1), pp. 58–75.

[10] T. Dalmagas, T. Cheng, K.-J.Winkel, and T. Sellis,ClusteringXML Documents using Structural Summaries, in LectureNotes in Computer Science (2005), Vol. 3268, pp. 547–556.

[11] G. Flake, R. Tarjan, and M. Tsioutsiouliklis, Graph Cluster-ing and Minimum Cut Trees, Internet Mathematics (2003),1(4), pp. 385–408.

[12] D. Gibson, R. Kumar, and A. Tomkins, Discovering LargeDense Subgraphs in Massive Graphs, VLDB ConferenceProceedings (2005), pp. 721–732.

[13] A. Jain, and R. Dubes, Algorithms for Clustering Data ,Prentice Hall, New Jersey, (1998).

[14] L. Kaufmann, and P. J. Rousseeuw, Finding Groups in Data:An Introduction to Cluster Analysis, John Wiley & Sons, Inc.,NY, (1990).

[15] B. W. Kernighan, and S. Lin, An efficient heuristic for parti-tioning graphs, Bell Systems Technical Journal, (1970), 49,pp. 291–307.

[16] M. S. Kim, and J. Han, A Particle-and-Density Based Evo-lutionary Clustering Method for Dynamic Networks, PVLDB(2009), 2(1), pp. 622–633.

[17] S. Raghavan, and H. Garcia-Molina, Representing webgraphs. ICDE Conference Proceedings (2003), pp. 405–416.

[18] M. Rattigan, M. Maier, and D. Jensen, Graph Clustering withNetwork Sructure Indices, ICML Conference Proceedings(2007), pp. 783–790.

[19] A. A. Tsay, W. S. Lovejoy, and D. R. Karger, Random Sam-pling in Cut, Flow, and Network Design Problems, Mathe-matics of Operations Research (1999), 24(2), pp. 383–413.

[20] M. J. Zaki, and C. C. Aggarwal, XRules: An EffectiveStructural Classifier for XML Data, ACM KDD ConferenceProceedings (2003), pp. 316–325.

[21] Z. Zeng, J. Wang, L. Zhou, and G. Karypis, Out-of-coreCoherent Closed Quasi-Clique Mining from Large DenseGraph Databases, ACM Transactions on Database Systems(2007), Vol 31(2), pp. 13.

[22] T. Zhang, R. Ramakrishnan, and M. Livny, BIRCH: AnEfficient Data Clustering Method for Very Large Databases,ACM SIGMOD Conference Proceedings (1996), pp. 103–114.
