Line-graph for large graph problem

[matt498]

I'm working on an edge classification task to classify malicious network flows. These flows are characterized by source and destination IP/Port and other 80 features. I also assume that nodes are featureless and they are indexed by the IP:Port combination. I'm am using CIC-IDS2017 dataset with 225745 entries selected from Benign and DDoS flows.

In IT networks there are usually a few nodes generating a lot of flows (edges), so the network has nodes with high degree. Considering that I want to perform the classification on those flows using a node-classification model, so I compute the Line Graph first and then I perform the classification.

The data object represents the entire network and is directed. When I use LineGraph() on the data object I obtain millions of edge pairs in the new edge_index attribute. My model use 2 GCNconv layer to generate the embedding of the graph and then classification is performed by a binary-classifier on it.

The problem is the explosion of the edge_index vector dimension after LineGraph() is applied because the GCNconv layer now deals with millions of edge and it is very slow.

I was wondering if it was a good idea to reduce the edge_index vector by eliminating a fraction of the equal pairs (edge1-> edge2) to lighten the starting graph and then calculate the line graph.

The model that generates the embedding is based on ARGA example, but I removed the clustering part to perform binary classification on the nodes of the Line Graph (edges of the starting graph).

Thanks

[rusty1s]

Do you desperately need to make use of LineGraph? In theory, you should be able to learn features for each IP, and then do your final edge classification based on the representations of source and destination IP/Port:

h = model(x=None, edge_index, edge_attr)
edge_feat = torch.cat([h[edge_index[0]], edge_attr, h[edge_index[1]]], dim=-1)
return classifier(edge_feat)

The only challenge is to write a model that works with featureless input node features and can incorporate edge features.

[matt498]

First of all thanks for the reply.

I understand what you mean, but considering that I am using GCNconv and according to the cheatsheet this layer do not consider edge_attr.

I am using the Line Graph so that ARVGA can output the embedding (NxF N: flows F: features) and in this case the GCNconv layer works because now the edges become nodes with their respective features. Then I perform binary classification.

I could try to replace the GCNconv layers of ARVGA with other layers that consider edge_attr if this make sense, for example TransformerConv... but then I have to deal with a matrix representing all the node embeddings (after encoding). I could also initialize node features with a ones vector. Now how do I perform edge classification?

In my model I only use the couples source IP:Port and dest IP:Port obtained from the single flow to build the edge_index in COO format.

2 other questions about your example:

• what is 'h' in your example?
• are you suggesting me to apply my model to learn nodes embedding and then concat source and dest nodes embedding with the respective edge features to finally perform the classification on this new flow embedding?

[rusty1s]

Yes, that's what I meant. h represents the learned node representations from a GNN (named model), which are then used to perform edge classification.

[matt498]

Thank you, I will investigate this approach