1. A method comprising: collecting, by at least one processing unit, multiple graphs corresponding to a network, the network evolving over time, each graph representing a snapshot reflecting a state of the network; forming, by the at least one processing unit, one graph by merging the multiple graphs representing the multiple snapshots of the network, the formed graph comprising a set of nodes and a set of edges, each edge connecting two nodes from the set of nodes and having a temporal label; mining, by the at least one processing unit, the formed graph to identify multiple patterns, each pattern being a subgraph in the formed graph, each pattern having an associated support; selecting a pattern from the identified patterns; identifying, by the at least one processing unit, a child pattern of the selected pattern, the identified child pattern having a support that is at least equal to the support of the selected pattern and missing a portion of pattern, the missing portion of the pattern including at least one edge of the pattern; creating, by the at least one processing unit, a graph evolution rule, the rule indicating that any occurrence of the child pattern implies a corresponding occurrence of the pattern, the corresponding occurrence of the pattern being formed with the addition of the portion missing from the child pattern at a time indicated by the missing edge's temporal label; and assigning, by the at least one processing unit, a confidence to the graph evolution rule, the assigned confidence is equal to a ratio of the support of the pattern to the support of the child pattern.