Subgraph isomorphism can be determined by means of a brute-force tree-search enumeration procedure. In this paper a new algorithm is introduced that attains efficiency by inferentially eliminating successor nodes in the tree search. To assess the time actually taken by the new algorithm, subgraph isomorphism, clique detection, graph isomorphism, and directed graph isomorphism experiments have been carried out with random and with various nonrandom graphs. A parallel asynchronous logic-in-memory implementation of a vital part of the algorithm is also described, although this hardware has not actually been built. The hardware implementation would allow very rapid determination of isomorphism.

/pdf/an-algorithm-for-subgraph-isomorphism-1t0qre6b4v.pdf

An Algorithm for Subgraph Isomorphism

A method to determine a distance measure between two nonhierarchical attributed relational graphs is presented. In order to apply this distance measure, the graphs are characterised by descriptive graph grammars (DGG). The proposed distance measure is based on the computation of the minimum number of modifications required to transform an input graph into the reference one. Specifically, the distance measure is defined as the cost of recognition of nodes plus the number of transformations which include node insertion, node deletion, branch insertion, branch deletion, node label substitution and branch label substitution. The major difference between the proposed distance measure and the other ones is the consideration of the cost of recognition of nodes in the distance computation. In order to do this, the principal features of the nodes are described by one or several cost functions which are used to compute the similarity between the input nodes and the reference ones. Finally, an application of this distance measure to the recognition of lower case handwritten English characters is presented.

A distance measure between attributed relational graphs for pattern recognition

The pattern deformational model proposed by Tsai and Fu [11] is extended so that numerical attributes and probability or density distributions can be introduced into primitives and relations in a nonhierarchical relational graph. Conventional graph isomorphisms are then generalized to include error-correcting capability for matching deformed patterns represented by such attributed relational graphs. An ordered-search algorithm is proposed for determining error-correcting isomorphisms. Finally, a pattern classification approach using graph isomorphisms is described, which can be considered as a combination of structural and statistical techniques.

http://www.asia.edu.tw/Main_pages/about/Former_president_TsaiWH_publications/Journal%20Paper%20PDFs/Tsai_&_Fu_IEEETSMC_1979.pdf

Error-Correcting Isomorphisms of Attributed Relational Graphs for Pattern Analysis

An approach to fault-tolerant design is described in which a computing system S and an algorithm A to be executed by S are both defined by graphs whose nodes represent computing facilities. A is executable by S if A is isomorphic to a subgraph of S.A k-fault is the removal of k nodes (facilities) from S.S is a k-fault tolerant (k-FT) realization of A if A can be executed by S with any k-fault present in S. The problem of designing optimal k-FT systems is considered where A is equated to a 0-FT system. Techniques are described for designing optimal k-FT realizations of single-loop systems; these techniques are related to results in Hamiltonian graph theory. The design of optimal k-FT realizations of certain types of tree systems is also examined. The advantages and disadvantages of the graph model are discussed.

A Graph Model for Fault-Tolerant Computing Systems

Understanding strategies of attacks is crucial for security applications such as computer and network forensics, intrusion response, and prevention of future attacks. This paper presents techniques to automatically learn attack strategies from correlated intrusion alerts. Central to these techniques is a model that represents an attack strategy as a graph of attacks with constraints on the attack attributes and the temporal order among these attacks. To learn the intrusion strategy is then to extract such a graph from a sequences of intrusion alerts. To further facilitate the analysis of attack strategies, which is essential to many security applications such as computer and network forensics, this paper presents techniques to measure the similarity between attack strategies. The basic idea is to reduces the similarity measurement of attack strategies into error-tolerant graph/subgraph isomorphism problem, and measures the similarity between attack strategies in terms of the cost to transform one strategy into another. Finally, this paper presents some experimental results, which demonstrate the potential of the proposed techniques.

/pdf/learning-attack-strategies-from-intrusion-alerts-52jvc0z9qt.pdf

Learning attack strategies from intrusion alerts

A reasonably efficient procedure for testing pairs of directed graphs for isomorphism is important in information retrieval and other application fields in which structured data have to be matched. One such procedure, a backtrack procedure based on a representation of directed graphs by linear formulas, is described. A procedure for finding a partial subdigraph of a digraph that is isomorphic to a given digraph is also described.

A. T. Berztiss

Papers

A Backtrack Procedure for Isomorphism of Directed Graphs