Note to other teachers and users of these slides: We would be delighted if you found this our

material useful in giving your own lectures. Feel free to use these slides verbatim, or to modify
them to fit your own needs. If you make use of a significant portion of these slides in your own
lecture, please include this message, or a link to our web site: http://www.mmds.org

 In many data mining situations, we do not

High dim. Graph Infinite Machine
Apps know the entire data set in advance
data data data learning

Locality
PageRank,
Filtering
Recommen  Stream Management is important when the
sensitive data SVM
SimRank der systems
hashing streams input rate is controlled externally:
▪ Google queries
Community Queries on Decision Association
Clustering
Detection streams Trees Rules ▪ Twitter or Facebook status updates
 We can think of the data as infinite and
Mining of Massive Datasets Dimensional
Spam Web Perceptron,
Duplicate
non-stationary (the distribution changes
ity document
Jure Leskovec, Anand Rajaraman, Jeff Ullman Detection advertising kNN
Stanford University
reduction detection
over time)
http://www.mmds.org J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 2 J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 3

Ad-Hoc
 Input elements enter at a rapid rate,  Stochastic Gradient Descent (SGD) is an Queries

at one or more input ports (i.e., streams) example of a stream algorithm

 In Machine Learning we call this: Online Learning . . . 1, 5, 2, 7, 0, 9, 3 Standing
▪ We call elements of the stream tuples Queries
▪ Allows for modeling problems where we have . . . a, r, v, t, y, h, b Output
a continuous stream of data Processor
 The system cannot store the entire stream ▪ We want an algorithm to learn from it and . . . 0, 0, 1, 0, 1, 1, 0
time
accessibly slowly adapt to the changes in data
 Idea: Do slow updates to the model Streams Entering.
Each is stream is
 Q: How do you make critical calculations ▪ SGD (SVM, Perceptron) makes small updates composed of
about the stream using a limited amount of ▪ So: First train the classifier on training data. elements/tuples
Limited
Working
(secondary) memory? ▪ Then: For every example from the stream, we slightly Storage Archival
update the model (using small learning rate) Storage

J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 4 J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 5 J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 6

 Types of queries one wants on answer on  Types of queries one wants on answer on  Mining query streams
a data stream: (we’ll do these today) a data stream: (we’ll do these next time) ▪ Google wants to know what queries are
▪ Sampling data from a stream ▪ Filtering a data stream more frequent today than yesterday
▪ Construct a random sample ▪ Select elements with property x from the stream
 Mining click streams
▪ Queries over sliding windows ▪ Counting distinct elements
▪ Number of items of type x in the last k elements ▪ Number of distinct elements in the last k elements ▪ Yahoo wants to know which of its pages are
of the stream of the stream getting an unusual number of hits in the past hour
▪ Estimating moments
 Mining social network news feeds
▪ Estimate avg./std. dev. of last k elements
▪ E.g., look for trending topics on Twitter, Facebook
▪ Finding frequent elements

J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 7 J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 8 J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 9

 Sensor Networks  Since we can not store the entire stream,

▪ Many sensors feeding into a central controller one obvious approach is to store a sample
 Telephone call records  Two different problems:
▪ Data feeds into customer bills as well as ▪ (1) Sample a fixed proportion of elements
settlements between telephone companies in the stream (say 1 in 10)
 IP packets monitored at a switch ▪ (2) Maintain a random sample of fixed size
▪ Gather information for optimal routing over a potentially infinite stream
▪ Detect denial-of-service attacks ▪ At any “time” k we would like a random sample
of s elements
As the stream grows the sample ▪ What is the property of the sample we want to maintain?
also gets bigger For all time steps k, each of k elements seen so far has
equal prob. of being sampled
J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 10 J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 12

 Problem 1: Sampling fixed proportion  Simple question: What fraction of queries by an Solution:
average search engine user are duplicates?
 Scenario: Search engine query stream  Pick 1/10th of users and take all their
▪ Suppose each user issues x queries once and d queries
▪ Stream of tuples: (user, query, time) twice (total of x+2d queries) searches in the sample
▪ Correct answer: d/(x+d)
▪ Answer questions such as: How often did a user
▪ Proposed solution: We keep 10% of the queries  Use a hash function that hashes the
run the same query in a single days ▪ Sample will contain x/10 of the singleton queries and
▪ Have space to store 1/10th of query stream 2d/10 of the duplicate queries at least once user name or user id uniformly into 10
▪ But only d/100 pairs of duplicates buckets
 Naïve solution: ▪ d/100 = 1/10 ∙ 1/10 ∙ d
▪ Of d “duplicates” 18d/100 appear exactly once
▪ Generate a random integer in [0..9] for each query ▪ 18d/100 = ((1/10 ∙ 9/10)+(9/10 ∙ 1/10)) ∙ d
▪ Store the query if the integer is 0, otherwise 𝑑
100 𝒅
discard ▪ So the sample-based answer is 𝑥 𝑑 18𝑑 =
+ + 𝟏𝟎𝒙+𝟏𝟗𝒅
10 100 100

J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 13 J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 14 J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 15
 Stream of tuples with keys:  Problem 2: Fixed-size sample
▪ Key is some subset of each tuple’s components  Suppose we need to maintain a random
▪ e.g., tuple is (user, search, time); key is user sample S of size exactly s tuples
▪ Choice of key depends on application ▪ E.g., main memory size constraint
 Why? Don’t know length of stream in advance
 To get a sample of a/b fraction of the stream:  Suppose at time n we have seen n items
▪ Hash each tuple’s key uniformly into b buckets
▪ Each item is in the sample S with equal prob. s/n
▪ Pick the tuple if its hash value is at most a How to think about the problem: say s = 2
Stream: a x c y z k c d e g…
As the stream grows, the sample is of At n= 5, each of the first 5 tuples is included in the sample S with equal prob.
At n= 7, each of the first 7 tuples is included in the sample S with equal prob.
Hash table with b buckets, pick the tuple if its hash value is at most a.
How to generate a 30% sample? fixed size Impractical solution would be to store all the n tuples seen
Hash into b=10 buckets, take the tuple if it hashes to one of the first 3 buckets so far and out of them pick s at random
J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 16 J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 18

 Algorithm (a.k.a. Reservoir Sampling)  We prove this by induction:  Inductive hypothesis: After n elements, the sample
▪ Store all the first s elements of the stream to S ▪ Assume that after n elements, the sample contains S contains each element seen so far with prob. s/n
each element seen so far with probability s/n  Now element n+1 arrives
▪ Suppose we have seen n-1 elements, and now
the nth element arrives (n > s) ▪ We need to show that after seeing element n+1  Inductive step: For elements already in S,
the sample maintains the property probability that the algorithm keeps it in S is:
▪ With probability s/n, keep the nth element, else discard it
▪ Sample contains each element seen so far with
 s   s  s − 1  n
▪ If we picked the nth element, then it replaces one of the probability s/(n+1) 1 − +  =
s elements in the sample S, picked uniformly at random  Base case:  n + 1  Element
 n +n+11  Element
s  n +1
in the
Element n+1 discarded
▪ After we see n=s elements the sample S has the not discarded sample not picked
 Claim: This algorithm maintains a sample S desired property  So, at time n, tuples in S were there with prob. s/n
with the desired property: ▪ Each out of n=s elements is in the sample with  Time n→n+1, tuple stayed in S with prob. n/(n+1)
𝒔 𝒏 𝒔
▪ After n elements, the sample contains each probability s/s = 1  So prob. tuple is in S at time n+1 = ⋅ =
𝒏 𝒏+𝟏 𝒏+𝟏
element seen so far with probability s/n
J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 19 J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 20 J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 21

 A useful model of stream processing is that  Sliding window on a single stream: N=6
queries are about a window of length N – qwertyuiopasdfghjklzxcvbnm
the N most recent elements received
qwertyuiopasdfghjklzxcvbnm
 Interesting case: N is so large that the data
cannot be stored in memory, or even on disk
qwertyuiopasdfghjklzxcvbnm
▪ Or, there are so many streams that windows
for all cannot be stored
 Amazon example: qwertyuiopasdfghjklzxcvbnm

▪ For every product X we keep 0/1 stream of whether Past Future

that product was sold in the n-th transaction
▪ We want answer queries, how many times have we
sold X in the last k sales
J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 23 J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 24

 Problem:  You can not get an exact answer without  Q: How many 1s are in the last N bits?
▪ Given a stream of 0s and 1s storing the entire window  A simple solution that does not really solve
our problem: Uniformity assumption
▪ Be prepared to answer queries of the form
How many 1s are in the last k bits? where k ≤ N  Real Problem: N
010011100010100100010110110111001010110011010
What if we cannot afford to store N bits? Past Future

 Obvious solution: ▪ E.g., we’re processing 1 billion streams and  Maintain 2 counters:
Store the most recent N bits N = 1 billion 0 1 0 0 1 1 0 1 1 1 0 1 0 1 0 1 1 0 1 1 0 1 1 0 ▪ S: number of 1s from the beginning of the stream
▪ Z: number of 0s from the beginning of the stream
▪ When new bit comes in, discard the N+1st bit Past Future
𝑺
 How many 1s are in the last N bits? 𝑵 ∙
010011011101010110110110 Suppose N=6  But we are happy with an approximate 𝑺+𝒁
 But, what if stream is non-uniform?
Past Future answer
▪ What if distribution changes over time?
J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 25 J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 26 J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 27

[Datar, Gionis, Indyk, Motwani]

 DGIM solution that does not assume  Solution that doesn’t (quite) work:  Stores only O(log2N ) bits
uniformity ▪ Summarize exponentially increasing regions ▪ 𝑶(log 𝑵) counts of log 𝟐 𝑵 bits each
of the stream, looking backward
 We store 𝑶(log𝟐𝑵) bits per stream ▪ Drop small regions if they begin at the same point  Easy update as more bits enter
Window of as a larger region
 Solution gives approximate answer, width 16  Error in count no greater than the number
of 1s in the “unknown” area
has 6 1s 6 10
never off by more than 50% 4
?
▪ Error factor can be reduced to any fraction > 0, 3 2
2 1
with more complicated algorithm and 1 0
proportionally more stored bits 010011100010100100010110110111001010110011010
N
We can reconstruct the count of the last N bits, except we
are not sure how many of the last 6 1s are included in the N
J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 28 J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 29 J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 30
 [Datar, Gionis, Indyk, Motwani]

 As long as the 1s are fairly evenly distributed,  Idea: Instead of summarizing fixed-length  Each bit in the stream has a timestamp,
the error due to the unknown region is small blocks, summarize blocks with specific starting 1, 2, …
– no more than 50% number of 1s:
 But it could be that all the 1s are in the ▪ Let the block sizes (number of 1s) increase
 Record timestamps modulo N (the window
unknown area at the end exponentially size), so we can represent any relevant
 In that case, the error is unbounded! timestamp in 𝑶(𝒍𝒐𝒈𝟐 𝑵) bits
 When there are few 1s in the window, block
6 10
4
sizes stay small, so errors are small
?
3 2
1 2 1001010110001011010101010101011010101010101110101010111010100010110010
1 0 N
010011100010100100010110110111001010110011010
N
J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 31 J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 32 J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 33

 A bucket in the DGIM method is a record  Either one or two buckets with the same
consisting of: power-of-2 number of 1s
▪ (A) The timestamp of its end [O(log N) bits] At least 1 of 2 of 2 of 1 of 2 of
 Buckets do not overlap in timestamps size 16. Partially size 8 size 4 size 2 size 1
▪ (B) The number of 1s between its beginning and beyond window.

end [O(log log N) bits]  Buckets are sorted by size 1001010110001011010101010101011010101010101110101010111010100010110010

 Constraint on buckets: ▪ Earlier buckets are not smaller than later buckets
N
Number of 1s must be a power of 2
 Buckets disappear when their Three properties of buckets that are maintained:
▪ That explains the O(log log N) in (B) above end-time is > N time units in the past - Either one or two buckets with the same power-of-2 number of 1s
1001010110001011010101010101011010101010101110101010111010100010110010 - Buckets do not overlap in timestamps
N - Buckets are sorted by size
J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 34 J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 35 J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 36

 When a new bit comes in, drop the last  If the current bit is 1: Current state of the stream:
(oldest) bucket if its end-time is prior to N ▪ (1) Create a new bucket of size 1, for just this bit 1001010110001011010101010101011010101010101110101010111010100010110010

time units before the current time ▪ End timestamp = current time Bit of value 1 arrives
0010101100010110101010101010110101010101011101010101110101000101100101
▪ (2) If there are now three buckets of size 1, Two orange buckets get merged into a yellow bucket
 2 cases: Current bit is 0 or 1 combine the oldest two into a bucket of size 2 0010101100010110101010101010110101010101011101010101110101000101100101
▪ (3) If there are now three buckets of size 2, Next bit 1 arrives, new orange bucket is created, then 0 comes, then 1:
 If the current bit is 0:
combine the oldest two into a bucket of size 4 0101100010110101010101010110101010101011101010101110101000101100101101
no other changes are needed
▪ (4) And so on … Buckets get merged…
0101100010110101010101010110101010101011101010101110101000101100101101

State of the buckets after merging

0101100010110101010101010110101010101011101010101110101000101100101101

J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 37 J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 38 J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 39

 To estimate the number of 1s in the most  Why is error 50%? Let’s prove it!
recent N bits:  Suppose the last bucket has size 2r
1. Sum the sizes of all buckets but the last At least 1 of 2 of 2 of 1 of 2 of  Then by assuming 2r-1 (i.e., half) of its 1s are
size 16. Partially size 8 size 4 size 2 size 1
(note “size” means the number of 1s in the bucket) beyond window. still within the window, we make an error of
2. Add half the size of the last bucket at most 2r-1
1001010110001011010101010101011010101010101110101010111010100010110010
 Since there is at least one bucket of each of
 Remember: We do not know how many 1s N the sizes less than 2r, the true sum is at least
of the last bucket are still within the wanted 1 + 2 + 4 + .. + 2r-1 = 2r -1
window  Thus, error at most 50% At least 16 1s

111111110000000011101010101011010101010101110101010111010100010110010
N
J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 40 J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 41 J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 42

 Instead of maintaining 1 or 2 of each size  Can we use the same trick to answer queries  Stream of positive integers
 We want the sum of the last k elements
bucket, we allow either r-1 or r buckets (r > 2) How many 1’s in the last k? where k < N? ▪ Amazon: Avg. price of last k sales
▪ Except for the largest size buckets; we can have ▪ A: Find earliest bucket B that at overlaps with k.  Solution:
any number between 1 and r of those Number of 1s is the sum of sizes of more recent ▪ (1) If you know all have at most m bits
 Error is at most O(1/r) buckets + ½ size of B ▪ Treat m bits of each integer as a separate stream
▪ Use DGIM to count 1s in each integer ci …estimated count for i-th bit
 By picking r appropriately, we can tradeoff 1001010110001011010101010101011010101010101110101010111010100010110010 ▪ The sum is = σ𝑚−1
𝑖=0 𝑐𝑖 2
𝑖

between number of bits we store and the k ▪ (2) Use buckets to keep partial sums
▪ Sum of elements in size b bucket is at most 2b
error
 Can we handle the case where the stream is 2 5 7 1 3 8 4 6 7 9 1 3 7 6 5 3 5 7 1 3 3 1 2 2 6 Idea: Sum in each
bucket is at most
2 5 7 1 3 8 4 6 7 9 1 3 7 6 5 3 5 7 1 3 3 1 2 2 6 3 2b (unless bucket
not bits, but integers, and we want the sum has only 1 integer)
2 5 7 1 3 8 4 6 7 9 1 3 7 6 5 3 5 7 1 3 3 1 2 2 6 3 2 Bucket sizes:
of the last k elements? 2 5 7 1 3 8 4 6 7 9 1 3 7 6 5 3 5 7 1 3 3 1 2 2 6 3 2 5 16 8 4 2 1
J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 43 J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 44 J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 45
 Sampling a fixed proportion of a stream
▪ Sample size grows as the stream grows
 Sampling a fixed-size sample
▪ Reservoir sampling
 Counting the number of 1s in the last N
elements
▪ Exponentially increasing windows
▪ Extensions:
▪ Number of 1s in any last k (k < N) elements
▪ Sums of integers in the last N elements

J. Leskovec, A. Rajaraman, J. Ullman: Mining of Massive Datasets, http://www.mmds.org 46