An attempt at demystifying graph deep learning | Hacker News Reader

An attempt at demystifying graph deep learning

ericmjl.github.io

87 pointsjonathanbgn20 comments

In case you're interested in learning about graph deep learning, and are familiar with standard DL, I strongly recommend these two very good, recent books (freely available):

[1] Graph Representation Learning - William L. Hamilton https://www.cs.mcgill.ca/~wlh/grl_book/

[2] Deep Learning on Graphs - Yao Ma, Jilian Tang https://cse.msu.edu/~mayao4/dlg_book/

A good survey paper is here (Jan 2021) by Chami, Abu-El-Haifa, Perozzi, Re and Murphy

[2005.03675] Machine Learning on Graphs: A Model and Comprehensive Taxonomy https://arxiv.org/abs/2005.03675

Super dumb question, when we talk about graph deep learning are we talking about deep learning with graphs is input? Or is it the use of graphs as the underlying architecture for a deep learning system.

I work in the field of information security and in my head I can see a scenario of using what I would call time series graphs, in which something like an attack or basic system behavior could be modeled as an evolution of relationships over time (implying some causality). Or maybe more precisely, they are a set of discrete graphs in which some edges are temporal proximity rather than a concrete relationship. My problem is I’m so illiterate when it comes to machine learning that I’m having trouble translating it into a basic context that I could start tinkering with to learn.

Part of the challenge comes from the fact that nearly every relationship or metric is discrete/categorical in nature, there are very few continous/scaler values when it comes to information that would be processed. As a result, most of the introductory tutorials and training around image classification or speech recognition or clustering are difficult to apply. I want to watch a billion events per hour to find instances where there are atypical relationships between system events in one log to network connection events in another. These graphs are extremely simple to compute, but categorizing them and analyzing them is proving difficult for my lay brain.

Generally means graphs as either input or output or both. Discrete values and relationships aren't an issue and can be easily dealt with using embeddings.

>Discrete values and relationships aren't an issue and can be easily dealt with using embeddings.

This is good to hear even though I don't know what it means. Is there some kind of canonical example of this that I could use to learn how to apply it?

yes, this is a good example!

We model events this way: endpoint, network, web logs, click streams, anything with entities like pids/IPs/users/files/urls and supporting metadata like hashes and timestamps. Connections can be discrete like "same hash" and trickier, fuzzy like "similar shape" or "time-correlated". Microsoft's Matt Swann has a great talk on how they do that at BlueHat, and Graphistry's talk there gives a bunch more examples (see our site + pinned on Twitter.)

Emerging GCNs from last ~year can mix many discrete + continuous attributes, and for why graph vs tabular, better pull in connected data ("process recently accessed a file and communicated to another process, who also recently made an outbound with similar bytes to another server that few others use.") Before, GNN tools struggled on either the heterogeneity or scale of most event data tasks, so were mostly academic research or super specialized like protein folding. Imagine 100K+ events, or distinguishing connections like someone positively chatting with a colleague vs negatively blocking them. Recent algs have been solving these scenarios at scale, tho tools are still hard even for most data scientists, and still a time suck for folks not already breathing GPU neural networks.

The Graphistry team has been trying to make graph tech easier and more snap in, initially by doing GPU-accelerated visual graph analytics + visual graph investigation templating for teams here, such as if you are on an ir/hunt team using a logs DB or even a graph DB. Ex: You can use directly from splunk queries, drag-and-drop with csv extracts, or data science notebooks with dataframes. That can be a nice launching point for seeing event data as graphs and the types of graph-enabled insights you get that are hard with just log dumps and bar charts. We are now in R&D with sec/fraud/etc teams and our GPU partners to bring GNNs into workflows w hopefully similar ease

If anyone is interested, Leo@graphistry.com or swing by our Slack. Very cool time for graph + GPU tech!

I checked internally, looks like we already have a demo coming up. Looking at your site it seems like you've taken a bit of a pivot towards infosec since the last time I poked about. Nice.

What's the current killer app of GNNs? By that I mean, in which tasks is using a GNN-based approach obviously better?

Conceptually, just by framing the graph as a mxm matrix I assume the most obvious comparison would be against some sort of dimensionality reduction for node embedding. Should I see graph(node) embedding as an alternative to e.g. PCA, LDA, t-SNE and UMAP and variants?

It’s pretty clearly the current best way to do deep learning on molecules in chemistry. Transformers do really well in predicting reaction outcomes but GCNNs are still better when it comes to “is this a good molecule according to this label” type questions. That said, we have added attention layers to GCNNs so I think the lines get blurry.

The Stanford Open Graph Benchmark shows the current best performers on some different tasks: https://ogb.stanford.edu/docs/leader_graphprop/

when your input makes more sense as a graph, or your desired output resembles predicting node labels or edges?

Fraud detection as well as Facebook haha

Alphafold. And generally any problem where you care about symmetries in space, like 3D point cloud representation.

Tangential — Curious how the author made those diagrams

Looks like Notability colours/lines/shapes to me!

Yes makes sense!

If you understand transformers, you understand the basics behind any neural "graph network" method. They are exceedingly simple

Oh! Is that what I've been missing for two years?

Well, when you phrase it like that... Hmm. Yup, I'm an idiot.

A monad is just a monoid in the category of endofunctors

This annoys me. If you understand the last two words, it’s very likely you understand the first. Just like OP above.

Reply on news.ycombinator.com