1. A method comprising: collecting, by at least one processing unit, multiple graphs corresponding to a network, the network evolving over time, each graph representing a snapshot reflecting a state of the network at a time the snapshot was taken; forming, by the at least one processing unit, one graph by merging the multiple graphs representing the multiple snapshots of the network, the formed graph comprising a set of nodes and a set of edges, each edge connecting two nodes from the set of nodes and having a temporal label; mining, by the at least one processing unit, the formed graph to identify multiple patterns, each pattern being a subgraph in the formed graph, each pattern having an associated support; selecting a pattern from the identified patterns; identifying, by the at least one processing unit, a child pattern of the selected pattern, the child pattern of the pattern includes all but one of the edges of the pattern and the identified child pattern having a support that is at least equal to the support of the selected pattern in the formed graph and missing a portion of pattern, the missing portion of the pattern including at least one edge of the pattern wherein the missing edge has a temporal label that has a greatest value of the temporal labels assigned to edges of the selected pattern; creating, by the at least one processing unit, a graph evolution rule, the rule indicating that any occurrence of the child pattern implies a corresponding occurrence of the pattern, the corresponding occurrence of the pattern being formed with the addition of the portion missing from the child pattern at a time indicated by the missing edge's temporal label.