Advanced Search Techniques for Large Scale Data Analytics Pavel Zezula and Jan Sedmidubsky Masaryk University http://disa.fi.muni.cz ¡In many data mining situations, we do not know the entire data set in advance ¡ ¡Stream Management is important when the input rate is controlled externally: §Google queries §Twitter or Facebook status updates ¡We can think of the data as infinite and non-stationary (the distribution changes over time) § Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) 2 3 Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) 4 Processor Limited Working Storage . . . 1, 5, 2, 7, 0, 9, 3 . . . a, r, v, t, y, h, b . . . 0, 0, 1, 0, 1, 1, 0 time Streams Entering. Each is stream is composed of elements/tuples Ad-Hoc Queries Output Archival Storage Standing Queries Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) 5 ¡Sensor Networks §Many sensors feeding into a central controller ¡Telephone call records §Data feeds into customer bills as well as settlements between telephone companies ¡IP packets monitored at a switch §Gather information for optimal routing §Detect denial-of-service attacks ¡ Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) 6 ¡Types of queries one wants on answer on a data stream: §Sampling data from a stream §Construct a random sample §Queries over sliding windows §Number of items of type x in the last k elements of the stream §Filtering a data stream §Select elements with property x from the stream §Counting distinct elements §Number of distinct elements in the last k elements of the stream Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) 7 As the stream grows the sample also gets bigger ¡Since we can not store the entire stream, one obvious approach is to store a sample ¡Two different problems: §(1) Sample a fixed proportion of elements in the stream (say 1 in 10) §(2) Maintain a random sample of fixed size over a potentially infinite stream §At any “time” k we would like a random sample of s elements §What is the property of the sample we want to maintain? For all time steps k, each of k elements seen so far has equal prob. of being sampled Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) 9 ¡Problem 1: Sampling fixed proportion ¡Scenario: Search engine query stream §Stream of tuples: (user, query, time) §Answer questions such as: How often did a user run the same query in a single days §Have space to store 1/10th of query stream ¡Naïve solution: §Generate a random integer in [0..9] for each query §Store the query if the integer is 0, otherwise discard ¡ Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) 10 Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) 11 d/100 appear twitece: 1^st query gets sampled with prob. 1/10, 2^nd also with 1/10, there are d such queries: d/100 18d/100 appear once. 1/10 for first to get selection and 9/10 for the second to not get selected. And the other way around so 18d/100 Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) 12 Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) 13 Hash table with b buckets, pick the tuple if its hash value is at most a. How to generate a 30% sample? Hash into b=10 buckets, take the tuple if it hashes to one of the first 3 buckets As the stream grows, the sample is of fixed size ¡Problem 2: Fixed-size sample ¡Suppose we need to maintain a random sample S of size exactly s tuples §E.g., main memory size constraint ¡Why? Don’t know length of stream in advance ¡Suppose at time n we have seen n items §Each item is in the sample S with equal prob. s/n § Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) 15 How to think about the problem: say s = 2 Stream: a x c y z k c d e g… At n= 5, each of the first 5 tuples is included in the sample S with equal prob. At n= 7, each of the first 7 tuples is included in the sample S with equal prob. Impractical solution would be to store all the n tuples seen so far and out of them pick s at random Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) 16 ¡We prove this by induction: §Assume that after n elements, the sample contains each element seen so far with probability s/n §We need to show that after seeing element n+1 the sample maintains the property §Sample contains each element seen so far with probability s/(n+1) ¡Base case: §After we see n=s elements the sample S has the desired property §Each out of n=s elements is in the sample with probability s/s = 1 Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) 17 ¡Sliding window on a single stream: Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) 20 q w e r t y u i o p a s d f g h j k l z x c v b n m q w e r t y u i o p a s d f g h j k l z x c v b n m q w e r t y u i o p a s d f g h j k l z x c v b n m q w e r t y u i o p a s d f g h j k l z x c v b n m Past Future N = 6 Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) 21 22 0 1 0 0 1 1 0 1 1 1 0 1 0 1 0 1 1 0 1 1 0 1 1 0 Past Future Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) Suppose N=6 23 Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) 0 1 0 0 1 1 0 1 1 1 0 1 0 1 0 1 1 0 1 1 0 1 1 0 Past Future Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) 24 0 1 0 0 1 1 1 0 0 0 1 0 1 0 0 1 0 0 0 1 0 1 1 0 1 1 0 1 1 1 0 0 1 0 1 0 1 1 0 0 1 1 0 1 0 N Past Future Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) 25 [Datar, Gionis, Indyk, Motwani] N size 2 size 4 size 8 size 1 1001010110001011010101010101011010101010101110101010111010100010110010 Past Future Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) 26 N 1 of size 2 2 of size 4 2 of size 8 At least 1 of size 16. Partially beyond window. 2 of size 1 1001010110001011010101010101011010101010101110101010111010100010110010 Each stream bit has a timestamp (starting 1, 2, …), recorded by modulo N A bucket is a record consisting of: (A) The timestamp of its end (B) The number of 1s between its beginning and end Three properties of buckets that are maintained: •Either one or two buckets with the same power-of-2 number of 1s •Buckets do not overlap in timestamps •Buckets are sorted by size Buckets disappear when their end-time is > N time units in the past 27 Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) N 1001010110001011010101010101011010101010101110101010111010100010110010 ¡If the current bit is 1: §(1) Create a new bucket of size 1, for just this bit §End timestamp = current time §(2) If there are now three buckets of size 1, combine the oldest two into a bucket of size 2 §(3) If there are now three buckets of size 2, combine the oldest two into a bucket of size 4 §(4) And so on … 28 Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) 29 1001010110001011010101010101011010101010101110101010111010100010110010 0010101100010110101010101010110101010101011101010101110101000101100101 0010101100010110101010101010110101010101011101010101110101000101100101 0101100010110101010101010110101010101011101010101110101000101100101101 0101100010110101010101010110101010101011101010101110101000101100101101 0101100010110101010101010110101010101011101010101110101000101100101101 Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) Current state of the stream: Bit of value 1 arrives Two orange buckets get merged into a yellow bucket Next bit 1 arrives, new orange bucket is created, then 0 comes, then 1: Buckets get merged… State of the buckets after merging 30 Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) 31 Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) 1001010110001011010101010101011010101010101110101010111010100010110010 N 33 Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) 34 Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) ¡Given a set of keys S that we want to filter ¡Create a bit array B of n bits, initially all 0s ¡Choose a hash function h with range [0,n) ¡Hash each member of sÎ S to one of n buckets, and set that bit to 1, i.e., B[h(s)]=1 ¡Hash each element a of the stream and output only those that hash to bit set to 1 §Output a if B[h(a)] == 1 ¡ 35 Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) 0010001011000 Output the item since it may be in S. Bit array B s Stream items Hash func h Drop the item. a ¡Creates false positives but no false negatives §If the item is in S we surely output it, if not we may still output it 36 Stream items 0010001011000 Output the item since it may be in S. Item hashes to a bucket that at least one of the items in S hashed to. Hash func h Drop the item. It hashes to a bucket set to 0 so it is surely not in S. Bit array B Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) True positive = correctly identified False positive = incorrectly identified True negative = correctly rejected False negative = incorrectly rejected 37 Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) Fraction of 1s in B = 1 – e^-1/8 = 0.1175 Compare with our earlier estimate: 1/8 = 0.125 ¡Consider: |S| = m, |B| = n ¡Use k independent hash functions h1 ,…, hk ¡Initialization: §Set B to all 0s §Hash each element sÎ S using each hash function hi, set B[hi(s)] = 1 (for each i = 1,.., k) ¡Run-time: §When a stream element with key x arrives §If B[hi(x)] = 1 for all i = 1,..., k then declare that x is in S §That is, x hashes to a bucket set to 1 for every hash function hi(x) §Otherwise discard the element x Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) 38 (note: we have a single array B!) Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) 39 Number of hash functions, k Fraction of 1s in B is (1 – e^-km/n) False positive probability = (1 – e^-km/n)^k Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) 40 42 Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) 43 Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) 44 Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) 45 Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) ¡Very very rough and heuristic intuition why Flajolet-Martin works: §h(a) hashes a with equal prob. to any of N values §Then h(a) is a sequence of log2 N bits, where 2-r fraction of all as have a tail of r zeros §About 50% of as hash to ***0 §About 25% of as hash to **00 §So, if we saw the longest tail of r=2 (i.e., item hash ending *100) then we have probably seen about 4 distinct items so far §So, it takes to hash about 2r items before we see one with zero-suffix of length r Pavel Zezula, Jan Sedmidubsky. Advanced Search Techniques for Large Scale Data Analytics (PA212) 46