1. A method of identifying a sub-graph in a network by comparing the sub-graph with a sample sub-graph, the method comprising: identifying, from the sample sub-graph, at least one sample key node, the sample key node topology relationships, and the sample key node semantic attributes; selecting at least one key node similar to the at least one sample key node based on the topology relationships and semantic attributes, wherein the network includes the at least one key node; forming at least one group, wherein the key nodes in each formed group have similar topology relationships and semantic attributes as the key nodes in the sample sub-graph; expanding at least one formed group into a corresponding sub-graph candidate, wherein the expanding adds at least one node to each formed group to produce each corresponding sub-graph candidate; and comparing each sub-graph candidate with the sample sub-graph; wherein at least one of the steps is carried out using a computer device.