Graph-Based Feature Engineering

These are fundamental, hand-crafted numerical features derived directly from a node's position and connections within the graph. They provide a quantitative summary of a node's local and global structural role.

• Degree Centrality: The number of connections (edges) a node has. A high degree often indicates a hub or a popular entity.
• Betweenness Centrality: Measures how often a node lies on the shortest path between other nodes, identifying bridges or bottlenecks in the network.
• Closeness Centrality: Calculates the average shortest path distance from a node to all other reachable nodes, indicating how centrally located a node is.
• Clustering Coefficient: Quantifies the tendency of a node's neighbors to be connected to each other, measuring local "cliquishness."
• PageRank: An iterative algorithm that measures node importance based on the quantity and quality of incoming links, originally for web pages.

Example: In a social network, a user's degree centrality (number of friends) and clustering coefficient (how interconnected their friends are) can be powerful features for predicting influence or churn.

Graph embedding algorithms learn low-dimensional, dense vector representations for nodes that preserve their graph structural context. These vectors serve as rich, continuous feature inputs for downstream models.

• DeepWalk: Uses random walks on the graph to generate sequences of nodes, which are then fed into a Skip-gram model (like Word2Vec) to learn embeddings. It treats nodes as "words" and random walks as "sentences."
• Node2Vec: An extension of DeepWalk that uses a biased random walk strategy, offering a flexible balance between exploring local neighborhoods (Breadth-First Sampling) and broader network structures (Depth-First Sampling).
• Key Property: Nodes that are structurally similar or close in the graph will have similar embedding vectors in the latent space.

Use Case: In an e-commerce knowledge graph, product nodes can be embedded. A query for "running shoes" can retrieve products with similar embedding vectors, even if they are not directly linked, by performing a nearest-neighbor search in the embedding space.

This technique creates features for a target node by statistically summarizing the attributes of its direct neighbors or multi-hop neighborhood. It explicitly encodes relational context.

• Basic Aggregators: Compute statistics like the mean, sum, maximum, minimum, or standard deviation of a specific feature across a node's neighbors.
• Example Features:
  • For a customer node: avg_income_of_friends, max_credit_score_in_household.
  • For a transaction node: std_amount_of_connected_transactions (for fraud detection).
• Multi-Hop Aggregation: Extends the aggregation beyond immediate neighbors (e.g., 2-hop or 3-hop) to capture a wider network influence, though this can dilute signal.

This method is deterministic and highly interpretable, making it a cornerstone of feature engineering for graph-based models like basic Graph Neural Networks (GNNs).

This advanced technique involves identifying and counting small, recurring subgraph patterns (motifs) centered on a node or within a local neighborhood. These motifs capture higher-order structural patterns beyond simple edges.

• Motif: A small, induced subgraph pattern (e.g., a triangle, a star, a feed-forward loop).
• Process: For each node, count how many times it participates in specific predefined motif patterns. These counts become numerical features.
• Significance: Different motifs signify different functional roles. For example, a high count of triangles around a node indicates a tightly-knit community, while a star pattern indicates a central hub.

Application: In protein-protein interaction networks, the presence of specific network motifs around a protein node can be a strong feature for predicting its biological function or essentiality.

These features capture the relational context and semantic proximity between two nodes by analyzing the paths that connect them. They are crucial for tasks like link prediction or measuring entity relatedness.

• Shortest Path Length: The minimum number of edges required to traverse from a source to a target node. A fundamental measure of proximity.
• Katz Index: A measure that counts all paths between two nodes, exponentially dampened by path length, giving more weight to shorter paths. It captures not just the shortest path but the overall connectivity.
• Personalized PageRank: Measures the importance of other nodes from the perspective of a specific source node, computed by running PageRank with a teleportation set focused on the source. It identifies nodes within the source's "influence sphere."

Example: In a knowledge graph, the Katz index between "Albert Einstein" and "Theory of Relativity" would be high due to multiple connecting paths (authored, developed, is-topic-of), providing a richer relatedness signal than a simple edge.

For dynamic graphs where nodes, edges, or their attributes change over time, temporal features encode the evolution of a node's structural properties or its interaction history.

• Temporal Aggregates: Compute rolling statistics (mean, trend, volatility) of a node's metrics over time windows (e.g., degree centrality over the last 7 days).
• Lifespan & Activity: Features like node_age_since_first_edge, time_since_last_interaction, or interaction_frequency_last_month.
• Sequence of Events: Represent a node's history as a sequence of timestamped events (edge additions/deletions, attribute changes) which can be fed into sequence models like RNNs or Transformers.

Real-World Use: In financial transaction networks, a sudden spike in a node's betweenness centrality or a change in its clustering coefficient over a short timeframe can be a critical feature for real-time fraud detection systems.

In transaction networks, engineered graph features are critical for identifying sophisticated fraud rings. Node-level features like degree centrality flag accounts with unusually high transaction volumes. Clustering coefficient and community membership identify tightly-knit groups of accounts that exhibit circular payment patterns, a hallmark of coordinated fraud. Edge features, such as the Jaccard similarity of two accounts' transaction partners, can reveal collusion. These structural signals, combined with traditional transactional data, allow models to detect non-linear fraud patterns that rule-based systems miss.

E-commerce and content platforms use graph features to move beyond simple co-occurrence. A user-item interaction graph enables the creation of powerful features:

• Personalized PageRank scores items based on a user's historical engagement, propagating preference through the network.
• Metapath-based features capture complex relationships (e.g., User->Item<-User->Item) to model "users who bought X also bought Y."
• Node2Vec embeddings of items create a dense vector representation that encodes item similarity based on random walk co-visitation patterns. These graph-derived features significantly improve recommendation relevance and diversity compared to matrix factorization alone.

Enterprise knowledge graphs that unify customer data from CRM, support tickets, and product usage become a rich source for churn prediction features. Engineers create features that quantify a customer's embeddedness in the enterprise ecosystem:

• Relationship strength (weighted degree) across all touchpoints.
• Centrality within a product adoption network among colleagues.
• Temporal graph features showing declining interaction density over recent time windows. A customer who is a central, well-connected node is less likely to churn than an isolated one, even if their recent usage metrics are similar. This structural context provides a decisive predictive edge.

Modeling a multi-tier supply chain as a directed graph (Supplier->Manufacturer->Distributor) allows for the engineering of propagation risk features. Key engineered features include:

• Single-point-of-failure identification via high betweenness centrality scores.
• Upstream/downstream dependency depth from a critical node.
• Subgraph resilience metrics (e.g., connectivity) for a supplier's regional cluster. If a natural disaster disrupts a port, models using these features can instantly predict the cascading delay impact on downstream manufacturers by simulating the disruption's propagation through the network, enabling proactive mitigation.

In IT network graphs (devices, users, applications), anomalous behavior is often structural. Feature engineering focuses on deviation from baseline graph patterns:

• Egonet features: Sudden changes in the number of connections (degree) or the clustering of a device's immediate neighborhood.
• Role-based features: Comparing a user's current graph embedding to their historical profile embedding to detect account compromise.
• Temporal motif counts: Identifying unusual frequencies of specific small subgraph sequences (e.g., rapid, sequential access to multiple servers) that match attack patterns. These features allow ML models to detect novel, polymorphic threats that signature-based systems cannot recognize.

Graph embedding is a foundational technique for feature engineering that maps nodes, edges, or entire subgraphs into low-dimensional vector spaces. These dense vector representations preserve the structural and semantic properties of the original graph, enabling them to be used as direct input features for standard machine learning models like classifiers and regressors.

• Examples: Node2Vec, DeepWalk, and GraphSAGE generate embeddings that capture network neighborhoods.
• Use Case: Converting a social network of customers into feature vectors that encode community membership and influence for a churn prediction model.

A Graph Neural Network (GNN) is a deep learning architecture designed to learn directly from graph-structured data. Unlike embedding techniques that produce static features, GNNs perform an end-to-end transformation, iteratively aggregating and transforming feature information from a node's neighbors through a process called message passing.

• Mechanism: Each layer computes updated node representations by combining a node's features with an aggregation of features from its connected nodes.
• Output: The final node, edge, or graph-level representations are highly task-optimized features, used for classification, regression, or link prediction.

Centrality metrics are scalar values calculated for each node that quantify its importance or influence within the network's topology. These metrics are classic, interpretable features engineered directly from graph structure.

Key centrality measures include:

• Degree Centrality: Count of a node's direct connections.
• Betweenness Centrality: Frequency with which a node lies on the shortest path between other nodes.
• Closeness Centrality: Average shortest-path distance from a node to all other reachable nodes.
• Eigenvector & PageRank: Measure influence based on the quality of connections (influential neighbors).

Application: In a transaction graph, high betweenness centrality could flag an account as a critical payment hub for fraud detection.

Community detection algorithms identify clusters or modules within a graph—groups of nodes that are more densely connected to each other than to nodes in other groups. The resulting community assignments are powerful categorical or structural features.

• Algorithms: Louvain, Leiden, and Label Propagation are common methods.
• Feature Types: The community ID itself, the size of the community, or the node's embeddedness within its community can be used as features.
• Business Insight: In a customer-product graph, communities reveal market segments or product affinities, providing features for cross-selling models.

Subgraph aggregation is a feature engineering method where statistical summaries are computed over the local neighborhood of a node or edge. This transforms the complex relational context into simple, tabular features.

Common aggregations include:

• Counts: Number of neighbors, number of incoming/outgoing edges.
• Sums/Averages: Aggregate values of a property (e.g., average transaction amount among connected entities).
• Existence Checks: Presence of a specific node type or edge label within a k-hop radius.

Example: For a user in a social network, features could be avg_friend_age, max_friend_connections, or has_connection_to_influencer.

Path-based features are derived from the sequences of nodes and edges connecting entities in a graph. They capture relational depth and indirect connections that are not evident from immediate neighbors.

• Types: Includes shortest path length, count of all possible paths (weighted by length), and features of nodes along the path (e.g., min/max/avg of a property).
• Algorithm Foundation: Relies on graph traversal algorithms like Breadth-First Search (BFS) or all-pairs shortest path computations.
• Application: In a knowledge graph of diseases and symptoms, the shortest path length between a patient's symptom and a potential diagnosis can be a critical feature for a diagnostic assistant model.