Many real-world networks contain structurally-equivalent nodes. These are defined as vertices that share the same set of neighboring nodes, making them interchangeable with a traditional graph layout approach. However, many real-world graphs also have properties associated with nodes, adding additional meaning to them. We present an approach for swapping locations of structurally-equivalent nodes in graph layout so that those with more similar properties have closer proximity to each other. This improves the usefulness of the visualization from an attribute perspective without negatively impacting the visualization from a structural perspective. We include an algorithm for finding these sets of nodes in linear time, as well as methodologies for ordering nodes based on their attribute similarity, which works for scalar, ordinal, multidimensional, and categorical data.

How data is encoded in a knowledge graph directly influences what can be done with that data. A common problem with many encodings is that they have difficulty representing ambiguity and evolution inherent in many real-world data sets. The data encoding represented in this paper (called CARAT) is a graph-level description of our attempt to capture data that is contradictory, ambiguous and evolves over time (including deleting information). The data encoding relies on tracking assertions about subjects rather than directly tracking states. This encoding decision resolves many issues our team had experienced using other data encodings but produces a a larger graph. This is a preliminary presentation of our CARAT data encoding and our experience using it.

The Data and Graph Generation for Modeling Adversary Activity (MAA) project developed a methodology along with scalable graph modeling and generation tools to produce realistic large-scale background activity graphs with embedded adversarial activity pathways. The technical report presents PNNL methodology, released datasets, lessons learned, and recommendations to develop graph analytic algorithms for structure-only and attributed knowledge graphs.

A graph is a natural and flexible modeling approach to represent entities and relationships between them in the real world. A Knowledge Graph (KG) is a specialized graph with formal and structured representations of facts, relationships, annotated with semantic descriptions. Subgraph matching is one of the fundamental graph problems to identify relationships, interactions, and activities of interest within a large graph. A query specification is a collection of abstract components, operations, and constraints to express a pattern. The specification can be implemented in different ways based on the underlying data model. Various graph query specifications have been developed over the years that has led to the development of different open-sourced and vendor-specific query languages. Such specifications are modeled as an extension of relational algebra used in relational query languages such as SQL. Such approaches do not inherently support graph queries. There is a need to represent graph queries in terms of graph-based components to expedite the query construction by non-database experts. We present a graph-based query approach QLiG (pronounced cleeg), to perform subgraph matching in a Labeled Property Graph (LPG). QLiG provides required expressivity to represent a query graph in a natural way using high-level concepts such as path, structure, and constraints. We present the query specification, salient features, and a real-world use case to show functional examples.

A Knowledge Graph (KG) is a formal and structured representation of entities, relationships, and their semantic descriptions. Traditionally, KGs are used to describe metadata about entities and provide additional context to a target application. Many real-world domains also involve temporal interactions between entities, in addition to the metadata. Modeling these attributed transactions is a critical requirement when using KGs in complex real-world applications, such as modeling adversarial activities. Adversarial activity modeling requires methodology and tools to produce realistic large-scale background graphs that include embedded Weapons of Mass Destruction (WMD) activity patterns [1]. We present a novel framework for constructing transactional knowledge graphs from a diverse set of sources. We present cloud-scale architecture of the framework, core components, and a real-world use case to demonstrate the generation of a background knowledge graph and WMD activity templates to evaluate network alignment and subgraph matching algorithms.

When searching for adversarial activity within multiple networks, one of the greatest challenges is how to accurately align entities across different channels of information. This task becomes increasingly difficult when minimal additional information is known about each individual besides a name. Within this study, we analyze name rarity and how it can be used to align people on three distinct data channels: Venmo financial transactions, Reddit online discussions, and a bibliographic data source of academic writings. We explore how the uniqueness of a name can be used to decide if a person is likely the same as another across networks, in the absence of any additional ground truth. While 100 percent confidence cannot be gained, we can use this information to clarify when a possible alignment is more or less likely to be the same individual, increasing our confidence of accurately detecting adversarial behavioral patterns. From the data collected, we found that 0.1% of people had the same name across data sets, and 22.5% of those names are considered rare by our threshold. In our study, we also examine the accuracy of our method and show how real names can be extracted from account usernames, and compared in a similar manner.

In the real world, data does not come neatly packaged. Instead, it typically comes as small updates from many sources with different conventions. Building a single, cohesive knowledge-base to work from requires merging small updates from many different sources. This paper outlines methods we have investigated for scoring merging routines. Given a challenge problem consisting of a large knowledge-base and a set of smaller documents, algorithms are asked to identify alignment points between the smaller document and the knowledge base. This paper surveys options for evaluating such algorithms, providing notes on strengths, weaknesses and considerations for interpretation.

Network simulation is essential to test adversarial search problems for privacy preservation and benchmarking purposes. Different generative models have been developed for single-channel, homogeneous networks that model social networks, communication, and co-authorship. Modeling multichannel networks simultaneously with correlated channel attributes at scale compounds complexity, and including adversarial signals across channels creates a second set of burdens. We present a methodology to employ a suite of generation tools to produce realistic large-scale synthetic activity graphs with embed an adversarial activity. We describe our technical process and how we employ subject matter experts (SMEs) to improve the adversarial signal. We discuss challenges in multi-channel modeling and scalability. We also discuss challenges for high fidelity multi-channel network generation at billion-edges scale.

A useful technique for adversary activity graph analytics is to perform subgraph isomorphism; searching for a specific graph pattern within a larger graph. Many of the networks that may be useful for adversary activity analysis are temporal networks, in which the chronological ordering of the edges has importance to the meaning of the data. Performing temporal subgraph matching requires the edges in the subgraphs to match the order of the temporal graph motif we are searching for. Previous methods for solving this rely on the use of static subgraph matching to find potential matches first, before filtering them based on edge order to find the true temporal matches. We present a new algorithm for temporal subgraph isomorphism that performs the subgraph matching directly on the chronologically sorted edges. By restricting our search to only the subgraphs with chronologically correct edges, we can improve the performance of the algorithm significantly in many cases. We present experimental timing results to show significant performance improvements on publicly available datasets for a number of different temporal query graph motifs with four or more nodes. We also demonstrate a practical example of how temporal subgraph isomorphism can produce more meaningful results than traditional static subgraph searches.

In recent years k-means++ has become a popular initialization technique for improved k-means clustering. To date, most of the work done to improve its performance has involved parallelizing algorithms that are only approximations of k-means++. In this paper we present a parallelization of the exact k-means++ algorithm, with a proof of its correctness. We develop implementations for three distinct shared-memory architectures: multicore CPU, high performance GPU, and the massively multithreaded Cray XMT platform. We demonstrate the scalability of the algorithm on each platform. In addition we present a visual approach for showing which platform performed k-means++ the fastest for varying data sizes.

Contingency analysis employs different measures to model scenarios, analyze them, and then derive the best response to any threats. A proposed visual-analytics pipeline for power grid management can transform approximately 100 million contingency scenarios to a manageable size and form. Grid operators can examine individual scenarios and devise preventive or mitigation strategies in a timely manner. Power grid engineers have applied the pipeline to a Western Electricity Coordinating Council power grid model.

Given a query graph that represents a pattern of interest, the emerging pattern detection problem can be viewed as a continuous query problem on a dynamic graph. We present an incremental algorithm for continuous query processing on dynamic graphs. The algorithm is based on the concept of query decomposition; we decompose a query graph into smaller subgraphs and assemble the result of sub-queries to find complete matches with the specified query. The novelty of our work lies in using the subgraph distributional statistics collected from the dynamic graph to generate the decomposition. We introduce a Lazy Search algorithm where the search strategy is decided on a vertex-to-vertex basis depending on the likelihood of a match in the vertex neighborhood. We also propose a metric named Relative Selectivity that is used to select between different query decomposition strategies. Our experiments performed on real online news, network traffic stream and a synthetic social network benchmark demonstrate 10-100x speedups over competing approaches.

Clustering is an important data analysis technique with numerous applications in the analysis of electric power grids. Standard clustering techniques are oblivious to the rich structural and dynamic information available for power grids. Therefore, by exploiting the inherent topological and electrical structure in the power grid data, we propose new methods for clustering with applications to model reduction, locational marginal pricing, phasor measurement unit (PMU or synchrophasor) placement, and power system protection. We focus our attention on model reduction for analysis based on time-series information from synchrophasor measurement devices, and spectral techniques for clustering. By comparing different clustering techniques on two instances of realistic power grids we show that the solutions are related and therefore one could leverage that relationship for a computational advantage. Thus, by contrasting different clustering techniques we make a case for exploiting structure inherent in the data with implications for several domains including power systems.

The prevailing choices to graphically represent a social network are a node-link graph and an adjacency matrix. Both techniques have unique strengths and weaknesses for different domain applications. This article focuses on how to change adjacency matrices from merely showing pairwise associations among network actors (or graph nodes) to depicting clusters of a social network. Node-link graphs supplement the discussion.

Contingency analysis (CA) is essential in maintaining a stable and secure power grid. Operating standards require that contingency violations are alleviated within 30 minutes. In today's practice, operators normally make decisions based on the information they have with limited support. This paper presents a new feature of suggested actions integrated in the graphical contingency analysis (GCA) tool, developed by the authors to help the operator's decision making process. This paper provides a few examples on showing how the decision support element of the GCA tool is further enhanced by this new feature to alleviate contingency violations for better grid reliability.

We introduce an information visualization technique, known as GreenCurve, for large multivariate sparse graphs that exhibit small-world properties. Our fractal-based design approach uses spatial cues to approximate the node connections and thus eliminates the links between the nodes in the visualization. The paper describes a robust algorithm to order the neighboring nodes of a large sparse graph by solving the Fiedler vector of its graph Laplacian, and then fold the graph nodes into a space-filling fractal curve based on the Fiedler vector. The result is a highly compact visualization that gives a succinct overview of the graph with guaranteed visibility of every graph node. GreenCurve is designed with the power grid infrastructure in mind. It is intended for use in conjunction with other visualization techniques to support electric power grid operations. The research and development of GreenCurve was conducted in collaboration with domain experts who understand the challenges and possibilities intrinsic to the power grid infrastructure. The paper reports a case study on applying GreenCurve to a power grid problem and presents a usability study to evaluate the design claims that we set forth.

We present a parallel implementation of the popular k-means clustering algorithm for massively multithreaded computer systems, as well as a parallelized version of the KKZ seed selection algorithm. We demonstrate that as system size increases, sequential seed selection can become a bottleneck. We also present an early attempt at parallelizing k-means that highlights critical performance issues when programming massively multithreaded systems. For our case studies, we used data collected from electric power simulations and run on the Cray XMT.

A major failure in the electricity infrastructure would almost certainly lead to significant societal disruption and massive economic losses. The reliable operation of the electricity infrastructure is an extremely challenging task because human operators have to consider thousands of possible configurations in near real time to choose the best option. Nevertheless, the operation of the electricity infrastructure is largely based on operator experience with limited real-time decision support. This makes it difficult for operators to anticipate, recognize and respond to anomalies caused by human error, natural disasters or cyber attacks.This paper proposes an advanced decision-support tool for electricity infrastructure operations. The tool converts large amounts of data into actionable information to help operators monitor the power grid status in real time. It performs trend analysis at the regional or system level to enable operators to foresee and discern emergencies; it performs cluster analysis to help operators identify the relationships between system configurations and affected assets; and it interactively assesses candidate actions to assist operators in making effective and timely decisions.