Data Mining Concepts and Techniques Chapter 8 8

Data Mining: Concepts and Techniques — Chapter 8 — 8. 1. Mining data streams Jiawei Han and Micheline Kamber Department of Computer Science University of Illinois at Urbana-Champaign www. cs. uiuc. edu/~hanj © 2006 Jiawei Han and Micheline Kamber. All rights reserved. 10/30/2020 Data Mining: Concepts and Techniques 1

10/30/2020 Data Mining: Concepts and Techniques 2

Data and Information Systems (DAIS: ) Course Structures at CS/UIUC n Three streams: Database, data mining and text information systems n Database Systems: n n n Database mgmt systems (CS 411: Fall and Spring) n Advanced database systems (CS 511: Fall) n Web information systems (Kevin Chang) n Information integration (An-Hai Doan) Data mining n Intro. to data mining (CS 412: Han—Fall) n Data mining: Principles and algorithms (CS 512: Han—Spring) n Seminar: Advanced Topics in Data mining (CS 591 Han—Fall and Spring) Text information systems and Bioinformatics n Text information system (CS 410 Zhai) n Introduction to Bio. Informatics (CS 598 Sinha, CS 498 Zhai) 10/30/2020 Data Mining: Concepts and Techniques 3

Data Mining: Concepts and Techniques, 2 ed. 2006 n Seven chapters (Chapters 1 -7) are covered in the Fall semester n Four chapters (Chapters 811) are covered in the Spring semester 10/30/2020 Data Mining: Concepts and Techniques 4

Coverage of CS 412@UIUC (Intro. to Data Warehousing and Data Mining) 1. Introduction 2. Data Preprocessing 3. Data Warehouse and OLAP Technology: An Introduction 4. Advanced Data Cube Technology and Data Generalization 5. Mining Frequent Patterns, Association and Correlations 6. Classification and Prediction 7. Cluster Analysis 10/30/2020 Data Mining: Concepts and Techniques 5

Coverage of CS 512@UIUC (Data Mining: Principles and Algorithms) 8. 9. Mining stream, time-series, and sequence data 10. Mining Object, Spatial, Multimedia, Text and Web data n Mining data streams n Mining object data n Mining time-series data n n Mining sequence patterns in transactional databases Spatial and spatiotemporal data mining n Multimedia data mining n Mining sequence patterns in biological data n Text mining n Web mining Graph mining, social network analysis, and multi-relational data mining 11. Applications and trends of data mining n Data mining applications n Data mining products and research prototypes n Graph mining n Social network analysis n Additional themes on data mining n Multi-relational data mining n Social impacts of data mining 10/30/2020 n Trends in data mining Data Mining: Concepts and Techniques 6

Chapter 8. Mining Stream, Time. Series, and Sequence Data Mining data streams Mining time-series data Mining sequence patterns in transactional databases Mining sequence patterns in biological data 10/30/2020 Data Mining: Concepts and Techniques 7

Mining Data Streams n What is stream data? Why Stream Data Systems? n Stream data management systems: Issues and solutions n Stream data cube and multidimensional OLAP analysis n Stream frequent pattern analysis n Stream classification n Stream cluster analysis n Research issues 10/30/2020 Data Mining: Concepts and Techniques 8

Characteristics of Data Streams n n Data Streams n Data streams—continuous, ordered, changing, fast, huge amount n Traditional DBMS—data stored in finite, persistent data sets Characteristics n Huge volumes of continuous data, possibly infinite n Fast changing and requires fast, real-time response n Data stream captures nicely our data processing needs of today n n n 10/30/2020 Random access is expensive—single scan algorithm (can only have one look) Store only the summary of the data seen thus far Most stream data are at pretty low-level or multi-dimensional in nature, needs multi-level and multi-dimensional processing Data Mining: Concepts and Techniques 9

Stream Data Applications n Telecommunication calling records n Business: credit card transaction flows n Network monitoring and traffic engineering n Financial market: stock exchange n Engineering & industrial processes: power supply & manufacturing n Sensor, monitoring & surveillance: video streams, RFIDs n Security monitoring n Web logs and Web page click streams n Massive data sets (even saved but random access is too expensive) 10/30/2020 Data Mining: Concepts and Techniques 10

DBMS versus DSMS n Persistent relations n Transient streams n One-time queries n Continuous queries n Random access n Sequential access n “Unbounded” disk store n Bounded main memory n Only current state matters n Historical data is important n No real-time services n Real-time requirements n Relatively low update rate n Possibly multi-GB arrival rate n Data at any granularity n Data at fine granularity n Assume precise data n Data stale/imprecise n Access plan determined by query processor, physical DB design 10/30/2020 n Unpredictable/variable data arrival and characteristics Ack. From Motwani’s PODS tutorial slides Data Mining: Concepts and Techniques 11

Mining Data Streams n What is stream data? Why Stream Data Systems? n Stream data management systems: Issues and solutions n Stream data cube and multidimensional OLAP analysis n Stream frequent pattern analysis n Stream classification n Stream cluster analysis n Research issues 10/30/2020 Data Mining: Concepts and Techniques 12

Architecture: Stream Query Processing SDMS (Stream Data Management System) User/Application Continuous Query Results Multiple streams Stream Query Processor Scratch Space (Main memory and/or Disk) 10/30/2020 Data Mining: Concepts and Techniques 13

Challenges of Stream Data Processing n Multiple, continuous, rapid, time-varying, ordered streams n Main memory computations n Queries are often continuous n n n Evaluated continuously as stream data arrives n Answer updated over time Queries are often complex n Beyond element-at-a-time processing n Beyond stream-at-a-time processing n Beyond relational queries (scientific, data mining, OLAP) Multi-level/multi-dimensional processing and data mining n 10/30/2020 Most stream data are at low-level or multi-dimensional in nature Data Mining: Concepts and Techniques 14

Processing Stream Queries n Query types n n One-time query vs. continuous query (being evaluated continuously as stream continues to arrive) Predefined query vs. ad-hoc query (issued on-line) Unbounded memory requirements n For real-time response, main memory algorithm should be used n Memory requirement is unbounded if one will join future tuples Approximate query answering n With bounded memory, it is not always possible to produce exact answers n High-quality approximate answers are desired n Data reduction and synopsis construction methods n 10/30/2020 Sketches, random sampling, histograms, wavelets, etc. Data Mining: Concepts and Techniques 15

Methodologies for Stream Data Processing n n n 10/30/2020 Major challenges n Keep track of a large universe, e. g. , pairs of IP address, not ages Methodology n Synopses (trade-off between accuracy and storage) k n Use synopsis data structure, much smaller (O(log N) space) than their base data set (O(N) space) n Compute an approximate answer within a small error range (factor ε of the actual answer) Major methods n Random sampling n Histograms n Sliding windows n Multi-resolution model n Sketches n Radomized algorithms Data Mining: Concepts and Techniques 16

Stream Data Processing Methods (1) n Random sampling (but without knowing the total length in advance) n Reservoir sampling: maintain a set of s candidates in the reservoir, which form a true random sample of the element seen so far in the stream. As the data stream flow, every new element has a certain probability (s/N) of replacing an old element in the reservoir. n n Sliding windows n Make decisions based only on recent data of sliding window size w n An element arriving at time t expires at time t + w Histograms n Approximate the frequency distribution of element values in a stream n Partition data into a set of contiguous buckets n n Multi-resolution models n 10/30/2020 Equal-width (equal value range for buckets) vs. V-optimal (minimizing frequency variance within each bucket) Popular models: balanced binary trees, micro-clusters, and wavelets Data Mining: Concepts and Techniques 17

Stream Data Processing Methods (2) n Sketches n n Histograms and wavelets require multi-passes over the data but sketches can operate in a single pass Frequency moments of a stream A = {a 1, …, a. N}, Fk: where v: the universe or domain size, mi: the frequency of i in the sequence n n Given N elts and v values, sketches can approximate F 0, F 1, F 2 in O(log v + log N) space Randomized algorithms n n Monte Carlo algorithm: bound on running time but may not return correct result Chebyshev’s inequality: n n 10/30/2020 Let X be a random variable with mean μ and standard deviation σ Chernoff bound: n Let X be the sum of independent Poisson trials X 1, …, Xn, δ in (0, 1] n The probability decreases expoentially as we move from the mean Data Mining: Concepts and Techniques 18

Approximate Query Answering in Streams n Sliding windows n n n Batched processing, sampling and synopses n n Only over sliding windows of recent stream data Approximation but often more desirable in applications Batched if update is fast but computing is slow n Compute periodically, not very timely Sampling if update is slow but computing is fast n Compute using sample data, but not good for joins, etc. Synopsis data structures n Maintain a small synopsis or sketch of data n Good for querying historical data Blocking operators, e. g. , sorting, avg, min, etc. n 10/30/2020 Blocking if unable to produce the first output until seeing the entire input Data Mining: Concepts and Techniques 19

Projects on DSMS (Data Stream Management System) n Research projects and system prototypes 10/30/2020 n STREAM (Stanford): A general-purpose DSMS STREAM n Cougar (Cornell): sensors Cougar n Aurora (Brown/MIT): sensor monitoring, dataflow n Hancock (AT&T): telecom streams Hancock n Niagara (OGI/Wisconsin): Internet XML databases Niagara n Open. CQ (Georgia Tech): triggers, incr. view maintenance n Tapestry (Xerox): pub/sub content-based filtering Tapestry n Telegraph (Berkeley): adaptive engine for sensors Telegraph n Tradebot (www. tradebot. com): stock tickers & streams Tradebot n Tribeca (Bellcore): network monitoring Tribeca n MAIDS (UIUC/NCSA): Mining Alarming Incidents in Data Streams MAIDS Data Mining: Concepts and Techniques 20

Stream Data Mining vs. Stream Querying n n Stream mining—A more challenging task in many cases n It shares most of the difficulties with stream querying n But often requires less “precision”, e. g. , no join, grouping, sorting n Patterns are hidden and more general than querying n It may require exploratory analysis n Not necessarily continuous queries Stream data mining tasks n Multi-dimensional on-line analysis of streams n Mining outliers and unusual patterns in stream data n Clustering data streams n Classification of stream data 10/30/2020 Data Mining: Concepts and Techniques 21

Mining Data Streams n What is stream data? Why Stream Data Systems? n Stream data management systems: Issues and solutions n Stream data cube and multidimensional OLAP analysis n Stream frequent pattern analysis n Stream classification n Stream cluster analysis n Research issues 10/30/2020 Data Mining: Concepts and Techniques 22

Challenges for Mining Dynamics in Data Streams n Most stream data are at pretty low-level or multidimensional in nature: needs ML/MD processing n n Analysis requirements n Multi-dimensional trends and unusual patterns n Capturing important changes at multi-dimensions/levels n Fast, real-time detection and response n Comparing with data cube: Similarity and differences Stream (data) cube or stream OLAP: Is this feasible? n 10/30/2020 Can we implement it efficiently? Data Mining: Concepts and Techniques 23

Multi-Dimensional Stream Analysis: Examples n Analysis of Web click streams n n n Raw data at low levels: seconds, web page addresses, user IP addresses, … Analysts want: changes, trends, unusual patterns, at reasonable levels of details E. g. , Average clicking traffic in North America on sports in the last 15 minutes is 40% higher than that in the last 24 hours. ” n Analysis of power consumption streams n n Raw data: power consumption flow for every household, every minute Patterns one may find: average hourly power consumption surges up 30% for manufacturing companies in Chicago in the last 2 hours today than that of the same day a week ago 10/30/2020 Data Mining: Concepts and Techniques 24

A Stream Cube Architecture n A tilted time frame n Different time granularities n n Critical layers n Minimum interest layer (m-layer) n Observation layer (o-layer) n n second, minute, quarter, hour, day, week, … User: watches at o-layer and occasionally needs to drill-down to m-layer Partial materialization of stream cubes n Full materialization: too space and time consuming n No materialization: slow response at query time n Partial materialization: what do we mean “partial”? 10/30/2020 Data Mining: Concepts and Techniques 25

A Titled Time Model n Natural tilted time frame: n n Example: Minimal: quarter, then 4 quarters 1 hour, 24 hours day, … Logarithmic tilted time frame: n 10/30/2020 Example: Minimal: 1 minute, then 1, 2, 4, 8, 16, 32, … Data Mining: Concepts and Techniques 26

A Titled Time Model (2) n Pyramidal tilted time frame: n Example: Suppose there are 5 frames and each takes maximal 3 snapshots d n Given a snapshot number N, if N mod 2 = 0, insert into the frame number d. If there are more than 3 snapshots, “kick out” the oldest one. Frame no. 10/30/2020 Snapshots (by clock time) 0 69 67 65 1 70 66 62 2 68 60 52 3 56 40 24 4 48 16 5 64 32 Data Mining: Concepts and Techniques 27

Two Critical Layers in the Stream Cube (*, theme, quarter) o-layer (observation) (user-group, URL-group, minute) m-layer (minimal interest) (individual-user, URL, second) (primitive) stream data layer 10/30/2020 Data Mining: Concepts and Techniques 28

On-Line Partial Materialization vs. OLAP Processing n On-line materialization n Materialization takes precious space and time n n Only materialize “cuboids” of the critical layers? n n Only incremental materialization (with tilted time frame) Online computation may take too much time Preferred solution: n popular-path approach: Materializing those along the popular drilling paths n H-tree structure: Such cuboids can be computed and stored efficiently using the H-tree structure n Online aggregation vs. query-based computation 10/30/2020 n Online computing while streaming: aggregating stream cubes n Query-based computation: using computed cuboids Data Mining: Concepts and Techniques 29

Stream Cube Structure: From m-layer to o-layer 10/30/2020 Data Mining: Concepts and Techniques 30

An H-Tree Cubing Structure root Observation layer Chicago . com Minimal int. layer Elec . edu Chem Urbana . com Elec Springfield . gov Bio 6: 00 AM-7: 00 AM 156 7: 00 AM-8: 00 AM 201 8: 00 AM-9: 00 AM 235 …… 10/30/2020 Data Mining: Concepts and Techniques 31

Benefits of H-Tree and H-Cubing n H-tree and H-cubing n Developed for computing data cubes and ice-berg cubes n J. Han, J. Pei, G. Dong, and K. Wang, “Efficient Computation of Iceberg Cubes with Complex Measures”, SIGMOD'01 n n Fast cubing, space preserving in cube computation Using H-tree for stream cubing n Space preserving n Intermediate aggregates can be computed incrementally and saved in tree nodes n Facilitate computing other cells and multi-dimensional analysis n H-tree with computed cells can be viewed as stream cube 10/30/2020 Data Mining: Concepts and Techniques 32

Mining Data Streams n What is stream data? Why Stream Data Systems? n Stream data management systems: Issues and solutions n Stream data cube and multidimensional OLAP analysis n Stream frequent pattern analysis n Stream classification n Stream cluster analysis n Research issues 10/30/2020 Data Mining: Concepts and Techniques 33

Frequent Patterns for Stream Data n Frequent pattern mining is valuable in stream applications n n Mining precise freq. patterns in stream data: unrealistic n n e. g. , network intrusion mining (Dokas, et al’ 02) Even store them in a compressed form, such as FPtree How to mine frequent patterns with good approximation? n Approximate frequent patterns (Manku & Motwani VLDB’ 02) n Keep only current frequent patterns? No changes can be detected Mining evolution freq. patterns (C. Giannella, J. Han, X. Yan, P. S. Yu, 2003) n Use tilted time window frame n Mining evolution and dramatic changes of frequent patterns Space-saving computation of frequent and top-k elements (Metwally, Agrawal, and El Abbadi, ICDT'05) 10/30/2020 Data Mining: Concepts and Techniques 34

Mining Approximate Frequent Patterns n Mining precise freq. patterns in stream data: unrealistic n n Even store them in a compressed form, such as FPtree Approximate answers are often sufficient (e. g. , trend/pattern analysis) n Example: a router is interested in all flows: n n n whose frequency is at least 1% (σ) of the entire traffic stream seen so far and feels that 1/10 of σ (ε = 0. 1%) error is comfortable How to mine frequent patterns with good approximation? 10/30/2020 n Lossy Counting Algorithm (Manku & Motwani, VLDB’ 02) n Major ideas: not tracing items until it becomes frequent n Adv: guaranteed error bound n Disadv: keep a large set of traces Data Mining: Concepts and Techniques 35

Lossy Counting for Frequent Items Bucket 1 Bucket 2 Bucket 3 Divide Stream into ‘Buckets’ (bucket size is 1/ ε = 1000) 10/30/2020 Data Mining: Concepts and Techniques 36

First Bucket of Stream Empty (summary) + At bucket boundary, decrease all counters by 1 10/30/2020 Data Mining: Concepts and Techniques 37

Next Bucket of Stream + At bucket boundary, decrease all counters by 1 10/30/2020 Data Mining: Concepts and Techniques 38

Approximation Guarantee n Given: (1) support threshold: σ, (2) error threshold: ε, and (3) stream length N n Output: items with frequency counts exceeding (σ – ε) N n How much do we undercount? If stream length seen so far = N and bucket-size = 1/ε then frequency count error #buckets = εN n Approximation guarantee n No false negatives n False positives have true frequency count at least (σ–ε)N n Frequency count underestimated by at most εN 10/30/2020 Data Mining: Concepts and Techniques 39

Lossy Counting For Frequent Itemsets Divide Stream into ‘Buckets’ as for frequent items But fill as many buckets as possible in main memory one time Bucket 1 Bucket 2 Bucket 3 If we put 3 buckets of data into main memory one time, Then decrease each frequency count by 3 10/30/2020 Data Mining: Concepts and Techniques 40

Update of Summary Data Structure 2 4 3 10 9 1 2 + 1 1 2 2 1 0 summary data 3 bucket data in memory summary data Itemset ( ) is deleted. That’s why we choose a large number of buckets – delete more 10/30/2020 Data Mining: Concepts and Techniques 41

Pruning Itemsets – Apriori Rule 1 2 2 + 1 1 summary data 3 bucket data in memory If we find itemset ( ) is not frequent itemset, Then we needn’t consider its superset 10/30/2020 Data Mining: Concepts and Techniques 42

Summary of Lossy Counting n n n Strength n A simple idea n Can be extended to frequent itemsets Weakness: n Space Bound is not good n For frequent itemsets, they do scan each record many times n The output is based on all previous data. But sometimes, we are only interested in recent data A space-saving method for stream frequent item mining n 10/30/2020 Metwally, Agrawal and El Abbadi, ICDT'05 Data Mining: Concepts and Techniques 43

Mining Evolution of Frequent Patterns for Stream Data n Approximate frequent patterns (Manku & Motwani VLDB’ 02) n n Keep only current frequent patterns—No changes can be detected Mining evolution and dramatic changes of frequent patterns (Giannella, Han, Yu, 2003) n Use tilted time window frame n Use compressed form to store significant (approximate) frequent patterns and their time-dependent traces n Note: To mine precise counts, one has to trace/keep a fixed (and small) set of items 10/30/2020 Data Mining: Concepts and Techniques 44

Two Structures for Mining Frequent Patterns with Tilted-Time Window n n FP-Trees store Frequent Patterns, rather than Transactions Tilted-time major: An FP-tree for each tilted time frame 10/30/2020 Data Mining: Concepts and Techniques 45

Frequent Pattern & Tilted-Time Window (2) n The second data structure: n n 10/30/2020 Observation: FP-Trees of different time units are similar Pattern-tree major: each node is associated with a tilted-time window Data Mining: Concepts and Techniques 46

Mining Data Streams n What is stream data? Why Stream Data Systems? n Stream data management systems: Issues and solutions n Stream data cube and multidimensional OLAP analysis n Stream frequent pattern analysis n Stream classification n Stream cluster analysis n Research issues 10/30/2020 Data Mining: Concepts and Techniques 47

Classification for Dynamic Data Streams n Decision tree induction for stream data classification n VFDT (Very Fast Decision Tree)/CVFDT (Domingos, Hulten, Spencer, KDD 00/KDD 01) Is decision-tree good for modeling fast changing data, e. g. , stock market analysis? Other stream classification methods n n n 10/30/2020 Instead of decision-trees, consider other models n Naïve Bayesian n Ensemble (Wang, Fan, Yu, Han. KDD’ 03) n K-nearest neighbors (Aggarwal, Han, Wang, Yu. KDD’ 04) Tilted time framework, incremental updating, dynamic maintenance, and model construction Comparing of models to find changes Data Mining: Concepts and Techniques 48

Hoeffding Tree n n n With high probability, classifies tuples the same Only uses small sample n Based on Hoeffding Bound principle Hoeffding Bound (Additive Chernoff Bound) r: random variable R: range of r n: # independent observations Mean of r is at least ravg – ε, with probability 1 – d 10/30/2020 Data Mining: Concepts and Techniques 49

Hoeffding Tree Algorithm n n Hoeffding Tree Input S: sequence of examples X: attributes G( ): evaluation function d: desired accuracy Hoeffding Tree Algorithm for each example in S retrieve G(Xa) and G(Xb) //two highest G(Xi) if ( G(Xa) – G(Xb) > ε ) split on Xa recurse to next node break 10/30/2020 Data Mining: Concepts and Techniques 50

Decision-Tree Induction with Data Streams Packets > 10 yes Data Stream no Protocol = http Packets > 10 yes Data Stream no Bytes > 60 K yes Protocol = ftp 10/30/2020 Protocol = http Ack. From Gehrke’s SIGMOD tutorial slides Data Mining: Concepts and Techniques 51

Hoeffding Tree: Strengths and Weaknesses n n Strengths n Scales better than traditional methods n Sublinear with sampling n Very small memory utilization n Incremental n Make class predictions in parallel n New examples are added as they come Weakness n Could spend a lot of time with ties n Memory used with tree expansion n Number of candidate attributes 10/30/2020 Data Mining: Concepts and Techniques 52

VFDT (Very Fast Decision Tree) n n Modifications to Hoeffding Tree n Near-ties broken more aggressively n G computed every nmin n Deactivates certain leaves to save memory n Poor attributes dropped n Initialize with traditional learner (helps learning curve) Compare to Hoeffding Tree: Better time and memory Compare to traditional decision tree n Similar accuracy n Better runtime with 1. 61 million examples n 21 minutes for VFDT n 24 hours for C 4. 5 Still does not handle concept drift 10/30/2020 Data Mining: Concepts and Techniques 53

CVFDT (Concept-adapting VFDT) n n Concept Drift n Time-changing data streams n Incorporate new and eliminate old CVFDT n Increments count with new example n Decrement old example n Sliding window n Nodes assigned monotonically increasing IDs n Grows alternate subtrees n When alternate more accurate => replace old n O(w) better runtime than VFDT-window 10/30/2020 Data Mining: Concepts and Techniques 54

Ensemble of Classifiers Algorithm n n H. Wang, W. Fan, P. S. Yu, and J. Han, “Mining Concept. Drifting Data Streams using Ensemble Classifiers”, KDD'03. Method (derived from the ensemble idea in classification) n train K classifiers from K chunks n for each subsequent chunk train a new classifier test other classifiers against the chunk assign weight to each classifier select top K classifiers 10/30/2020 Data Mining: Concepts and Techniques 55

Mining Data Streams n What is stream data? Why Stream Data Systems? n Stream data management systems: Issues and solutions n Stream data cube and multidimensional OLAP analysis n Stream frequent pattern analysis n Stream classification n Stream cluster analysis n Research issues 10/30/2020 Data Mining: Concepts and Techniques 56

Clustering Data Streams [GMMO 01] n n 10/30/2020 Base on the k-median method n Data stream points from metric space n Find k clusters in the stream s. t. the sum of distances from data points to their closest center is minimized Constant factor approximation algorithm n In small space, a simple two step algorithm: 1. For each set of M records, Si, find O(k) centers in S 1, …, Sl n Local clustering: Assign each point in Si to its closest center 2. Let S’ be centers for S 1, …, Sl with each center weighted by number of points assigned to it n Cluster S’ to find k centers Data Mining: Concepts and Techniques 57

Hierarchical Clustering Tree level-(i+1) medians level-i medians data points 10/30/2020 Data Mining: Concepts and Techniques 58

Hierarchical Tree and Drawbacks n Method: n n n maintain at most m level-i medians On seeing m of them, generate O(k) level-(i+1) medians of weight equal to the sum of the weights of the intermediate medians assigned to them Drawbacks: n n 10/30/2020 Low quality for evolving data streams (register only k centers) Limited functionality in discovering and exploring clusters over different portions of the stream over time Data Mining: Concepts and Techniques 59

Clustering for Mining Stream Dynamics n Network intrusion detection: one example n Detect bursts of activities or abrupt changes in real time—by online clustering n Our methodology (C. Agarwal, J. Han, J. Wang, P. S. Yu, VLDB’ 03) n Tilted time frame work: o. w. dynamic changes cannot be found n Micro-clustering: better quality than k-means/k-median n incremental, online processing and maintenance) n Two stages: micro-clustering and macro-clustering n With limited “overhead” to achieve high efficiency, scalability, quality of results and power of evolution/change detection 10/30/2020 Data Mining: Concepts and Techniques 60

Clu. Stream: A Framework for Clustering Evolving Data Streams n Design goal n n n High quality for clustering evolving data streams with greater functionality While keep the stream mining requirement in mind n One-pass over the original stream data n Limited space usage and high efficiency Clu. Stream: A framework for clustering evolving data streams n Divide the clustering process into online and offline components n n 10/30/2020 Online component: periodically stores summary statistics about the stream data Offline component: answers various user questions based on the stored summary statistics Data Mining: Concepts and Techniques 61

The Clu. Stream Framework n Micro-cluster n Statistical information about data locality n Temporal extension of the cluster-feature vector n Multi-dimensional points with time stamps n Each point contains d dimensions, i. e. , n n A micro-cluster for n points is defined as a (2. d + 3) tuple Pyramidal time frame n 10/30/2020 Decide at what moments the snapshots of the statistical information are stored away on disk Data Mining: Concepts and Techniques 62

Clu. Stream: Pyramidal Time Frame n Pyramidal time frame n Snapshots of a set of micro-clusters are stored following the pyramidal pattern n n Snapshots are classified into different orders varying from 1 to log(T) n n 10/30/2020 They are stored at differing levels of granularity depending on the recency The i-th order snapshots occur at intervals of αi where α ≥ 1 Only the last (α + 1) snapshots are stored Data Mining: Concepts and Techniques 63

Clu. Stream: Clustering On-line Streams n Online micro-cluster maintenance n Initial creation of q micro-clusters n n Online incremental update of micro-clusters n n q is usually significantly larger than the number of natural clusters If new point is within max-boundary, insert into the microcluster n O. w. , create a new cluster n May delete obsolete micro-cluster or merge two closest ones Query-based macro-clustering n 10/30/2020 Based on a user-specified time-horizon h and the number of macro-clusters K, compute macroclusters using the k-means algorithm Data Mining: Concepts and Techniques 64

Mining Data Streams n n n What is stream data? Why SDS? Stream data management systems: Issues and solutions Stream data cube and multidimensional OLAP analysis n Stream frequent pattern analysis n Stream classification n Stream cluster analysis n Research issues 10/30/2020 Data Mining: Concepts and Techniques 65

Stream Data Mining: Research Issues n Mining sequential patterns in data streams n Mining partial periodicity in data streams n Mining notable gradients in data streams n Mining outliers and unusual patterns in data streams n Stream clustering n Multi-dimensional clustering analysis? n Cluster not confined to 2 -D metric space, how to incorporate other features, especially non-numerical properties 10/30/2020 n Stream clustering with other clustering approaches? n Constraint-based cluster analysis with data streams? Data Mining: Concepts and Techniques 66

Summary: Stream Data Mining n Stream data mining: A rich and on-going research field n Current research focus in database community: n n n DSMS system architecture, continuous query processing, supporting mechanisms Stream data mining and stream OLAP analysis n Powerful tools for finding general and unusual patterns n Effectiveness, efficiency and scalability: lots of open problems Our philosophy on stream data analysis and mining n A multi-dimensional stream analysis framework n Time is a special dimension: Tilted time frame n What to compute and what to save? —Critical layers n partial materialization and precomputation n Mining dynamics of stream data 10/30/2020 Data Mining: Concepts and Techniques 67

References on Stream Data Mining (1) n n n n n 10/30/2020 C. Aggarwal, J. Han, J. Wang, P. S. Yu. A Framework for Clustering Data Streams, VLDB'03 C. C. Aggarwal, J. Han, J. Wang and P. S. Yu. On-Demand Classification of Evolving Data Streams, KDD'04 C. Aggarwal, J. Han, J. Wang, and P. S. Yu. A Framework for Projected Clustering of High Dimensional Data Streams, VLDB'04 S. Babu and J. Widom. Continuous Queries over Data Streams. SIGMOD Record, Sept. 2001 B. Babcock, S. Babu, M. Datar, R. Motwani and J. Widom. Models and Issues in Data Stream Systems”, PODS'02. (Conference tutorial) Y. Chen, G. Dong, J. Han, B. W. Wah, and J. Wang. "Multi-Dimensional Regression Analysis of Time-Series Data Streams, VLDB'02 P. Domingos and G. Hulten, “Mining high-speed data streams”, KDD'00 A. Dobra, M. N. Garofalakis, J. Gehrke, R. Rastogi. Processing Complex Aggregate Queries over Data Streams, SIGMOD’ 02 J. Gehrke, F. Korn, D. Srivastava. On computing correlated aggregates over continuous data streams. SIGMOD'01 C. Giannella, J. Han, J. Pei, X. Yan and P. S. Yu. Mining frequent patterns in data streams at multiple time granularities, Kargupta, et al. (eds. ), Next Generation Data Mining’ 04 Data Mining: Concepts and Techniques 68

References on Stream Data Mining (2) n S. Guha, N. Mishra, R. Motwani, and L. O'Callaghan. Clustering Data Streams, FOCS'00 n G. Hulten, L. Spencer and P. Domingos: Mining time-changing data streams. KDD 2001 n n n n S. Madden, M. Shah, J. Hellerstein, V. Raman, Continuously Adaptive Continuous Queries over Streams, SIGMOD 02 G. Manku, R. Motwani. Approximate Frequency Counts over Data Streams, VLDB’ 02 A. Metwally, D. Agrawal, and A. El Abbadi. Efficient Computation of Frequent and Top-k Elements in Data Streams. ICDT'05 S. Muthukrishnan, Data streams: algorithms and applications, Proceedings of the fourteenth annual ACM-SIAM symposium on Discrete algorithms, 2003 R. Motwani and P. Raghavan, Randomized Algorithms, Cambridge Univ. Press, 1995 S. Viglas and J. Naughton, Rate-Based Query Optimization for Streaming Information Sources, SIGMOD’ 02 Y. Zhu and D. Shasha. Stat. Stream: Statistical Monitoring of Thousands of Data Streams in Real Time, VLDB’ 02 H. Wang, W. Fan, P. S. Yu, and J. Han, Mining Concept-Drifting Data Streams using Ensemble Classifiers, KDD'03 10/30/2020 Data Mining: Concepts and Techniques 69

10/30/2020 Data Mining: Concepts and Techniques 70