Comment by ianbicking | Hacker News Reader

Comment by ianbicking | Hacker News Reader

Parent Full thread

I feel like I should understand the purpose of knowledge graphs, but I just... don't.

Like the example "CocoIndex supports Incremental Processing" becomes the subject/predicate/object triple (CocoIndex, supports, Incremental Processing)... so what? Are you going to look up "Incremental Processing" and get a list of related entities? That's not a term that is well enough defined to be meaningful across a variety of subjects. I can incrementally process my sandwich by taking small bites.

I guess you could actually expand "Incremental Processing" to some full definition. But then it's not really a knowledge graph because the only entity ever associated with that new definition will be CocoIndex, and you are back to a single sentence that contains the information, you've just pretended it's structured. ("Supports" hardly a well-defined term either!)

I can _kind of_ see how knowledge graphs can be used for limited relationships. If you want to map companies to board members, and board members to family members, etc. Very clearly and formally defined entities (like a person or company), with clearly defined relationships (board member, brother, etc). I still don't know how _useful_ the result is, but at least I can understand the validity of the model. But for everything else... am I missing something?

IMO knowledge graphs are a must have for security use-cases because of how well they handle many-to-many relationships. Who has access to read each storage bucket? Via which IAM policies? Who owns each bucket? What is the shortest possible role-assumption path available from internet-exposed compute instances to read this bucket? What is the effective blast radius from a vulnerability that allows remote code execution on an internet exposed compute instance?

Or, I have a docker container image that is built from multiple base images owned by different teams in my organization. Who is responsible for fixing security vulnerabilities introduced by each layer?

We really could model these as tables but getting into all those joins makes things so cumbersome. Plus visualizing these things in a graph map is very compelling for presentation and persuading stakeholders to make security decisions.

Are there existing tools that model security stuff like this? For a few years I've wanted to build a model like this and search for vulnerabilities using something like GOAP (Goal-Oriented Action Planning)

I built an open source one (https://github.com/cartography-cncf/cartography) and am building commercial support around it (https://subimage.io)

> I feel like I should understand the purpose of knowledge graphs, but I just... don't.

Like RAG, it decouples KG size from context size, but unlike RAG, a KG offers deduplication and relational traversal. Some searches based on just similarity or keywords fail when the relation is functional. Both KG and RAG work better when the LLM is planning the search process, doing multiple searches, basing each one off the previous one. In the last few months LLMs have gotten great at exploration with search tools.

I implemented my own KG recently and I put both search and node generation in the hands of the LLM, as MCP tools. The cool trick is that when I instruct the LLM to generate a node it links to previous nodes using inline references (like @45). So I get the graph structure for free. I think coupling RAG with a KG allows for both breadth and precise control. The RAG is assimilating unstructured chunks, the KG is mapping the corpus. All done with human in the loop to guide the process.

In my understanding, there are two kinds of use cases potentially can be explored with knowledge graph.

- Structured data - this is probably more close to the use case you mention

- Unstructure data and extract relationship and build KG with natural language understanding - which is this article trying to explore. Here is a paper discussing about this https://arxiv.org/abs/2409.13731

In general it is an alternative way to establish connections with entities easily. And these relationships could help with discovery, recommendation and retrieval. Thanks @alexchantavy for sharing use-cases in security.

Would love to learn more from the community :)

For context, the subject-predicate-object pattern is known as a semantic triple or Resource Description Framework (RDF) triple:

https://en.wikipedia.org/wiki/Semantic_triple

They're useful for storing social network graph data, for example, and can be expressed using standards like Open Graph and JSONAPI:

https://jsonapi.org

I've stored RDF triples in database tables and experimented with query concepts from neo4j:

https://neo4j.com/docs/getting-started/data-modeling/tutoria...

These are straightforward to translate to SQL but the syntax can get messy due to not always having foreign keys available and hitting limitations with polymorphic relationships. Some object-relational mapping (ORM) frameworks help with this:

https://laravel.com/docs/12.x/eloquent-relationships#polymor...

I feel that document-oriented databases like MongoDB jumped the gun a bit, and would have preferred to have had graph-oriented or key-value-oriented databases providing row/column/document oriented queries and views. Going the other way feels a bit kludgy to me:

https://www.mongodb.com/resources/basics/databases/mongodb-g...

Basically Set Theory internally with multiple query languages externally and indexed by default.

Oh and have all writes generate an event stream like Firebase does so we can easily build reactive apps.

Well, in my hobby of genealogy it's all about building a knowledge graph. Not just the obvious of who are children to which parents etc, but also where great-grandpa was in 1920.

People reach for a database, and of course you need that, but for one thing the data certainly doesn't always come in a nice tabular format, and moreover you often don't know which piece of knowledge will become relevant for a question you care about - maybe two people worked together at the Kings Bay Mining Company, and then the was there accident in 1962, but uncle Hans was inspector at Wilhelmsen etc. Often you make progress because you remember niche geographical or historical information.

Reply on news.ycombinator.com