US 20050210027 A1 Abstract Techniques for monitoring abnormalities in a data stream are provided. A plurality of objects are received from the data stream and one or more clusters are created from these objects. At least a portion of the one or more clusters have statistical data of the respective cluster. It is determined from the statistical data whether one or more abnormalities exist in the data stream.
Claims(31) 1. A method for monitoring abnormalities in a data stream, comprising the steps of:
receiving a plurality of objects in the data stream; creating one or more clusters from the plurality of objects, wherein at least a portion of the one or more clusters comprise statistical data of the respective cluster; and determining from the statistical data whether one or more abnormalities exist in the data stream. 2. The method of computing one or more similarity values for a given object relating to one or more existing clusters; and determining a closest cluster for the object based on the one or more similarity values. 3. The method of determining whether to add the object to the closest cluster; adding the object to the closest cluster when determined and updating the statistical data of the closest cluster; and creating a new cluster comprising the object when the object is not added to the closest cluster, and generating statistical data of the new cluster. 4. The method of 5. The method of determining which clusters present at a first time were not present at a second time, wherein the second time is before the first time; determining which of the clusters, present at the first time and not present at the second time, contain fewer than a user-defined number of objects; and reporting clusters with fewer than the user-defined number of objects as abnormalities. 6. The method of 7. The method of 8. The method of 9. The method of 10. The method of 11. The method of 12. The method of 13. The method of 14. The method of 15. The method of 16. Apparatus for monitoring abnormalities in a data stream, comprising:
a memory; and at least one processor coupled to the memory and operative to: (i) receive a plurality of objects in the data stream; (ii) create one or more clusters from the plurality of objects, wherein at least a portion of the one or more clusters comprise statistical data of the respective cluster; and (iii) determine from the statistical data whether one or more abnormalities exist in the data stream. 17. The apparatus of computing one or more similarity values for a given object relating to one or more existing clusters; and determining a closest cluster for the object based on the one or more similarity values. 18. The apparatus of determining whether to add the object to the closest cluster; adding the object to the closest cluster when determined and updating the statistical data of the closest cluster; and creating a new cluster comprising the object when the object is not added to the closest cluster, and generating statistical data of the new cluster. 19. The apparatus of 20. The apparatus of determining which clusters present at a first time were not present at a second time, wherein the second time is before the first time; determining which of the clusters, present at the first time and not present at the second time, contain fewer than a user defined number of objects; and reporting clusters with fewer than a defined number of objects as abnormalities. 21. The apparatus of 22. The apparatus of 23. The apparatus of 24. The apparatus of 25. The apparatus of 26. The apparatus of 27. The apparatus of 28. The apparatus of 29. The apparatus of 30. The apparatus of 31. An article of manufacture for monitoring abnormalities in a data stream, comprising a machine readable medium containing one or more programs which when executed implement the steps of:
receiving a plurality of objects in the data stream; creating one or more clusters from the plurality of objects, wherein at least a portion of the one or more clusters comprise statistical data of the respective cluster; and determining from the statistical data whether one or more abnormalities exist in the data stream. Description The present invention is related to techniques for clustering a data stream and, more particularly, techniques for monitoring data abnormalities in the stream through the clustering of the data stream. In general, large volumes of continuously evolving data, which may be stored, is referred to as a data stream. Data streams have received increased attention in recent years due to technological innovations, which have facilitated the creation, maintenance and storage of such data. A number of data mining studies have been conducted in the data stream context in recent years, see, e.g., C. C. Aggarwal, “A Framework for Diagnosing Changes in Evolving Data Streams,” ACM SIGMOD Conference, 2003; B. Babcock et al., “Models and Issues in Data Stream Systems,” ACM PODS Conference, 2002; P. Domingos et al., “Mining High-Speed Data Streams,” ACM SIGKDD Conference, 1998; S. Guha et al., “ROCK: A Robust Clustering Algorithm for Categorical Attributes,” Proceedings of the International Conference on Data Engineering, 1999; and L. O'Callaghan et al., “Streaming-Data Algorithms for High-Quality Clustering,” ICDE Conference, 2002. Clustering is the partitioning of a given set of objects, such as data points, into one or more groups (clusters) of similar objects. The similarity of a data point with another data point is typically defined by a distance measure or objective function. In addition, data points that do not naturally fit into any particular cluster are referred to as outliers. Clustering has been widely studied by those in the database and data mining communities because of its applicability to a wide range of problems, see, e.g., P. Bradley et al., “Scaling Clustering Algorithms to Large Databases,” SIGKDD Conference, 1998; S. Guha et al., “CURE: An Efficient Clustering Algorithm for Large Databases,” ACM SIGMOD Conference, 1998; R. Ng et al., “Efficient and Effective Clustering Methods for Spatial Data Mining,” Very Large Data Bases Conference, 1994; A. Jain et al., “Algorithms for Clustering Data,” Prentice Hall, N.J., 1998; L. Kaufman et al., “Finding Groups in Data—An Introduction to Cluster Analysis,” Wiley Series in Probability and Math Sciences, 1990; E. Knorr et al., “Algorithms for Mining Distance-Based Outliers in Large Data Sets,” Proceedings of the VLDB Conference, September, 1998; E. Knorr et al., “Finding Intensional Knowledge of Distance-Based Outliers,” Proceedings of the VLDB Conference, September, 1999; S. Ramaswamy et al., “Efficient Algorithms for Mining Outliers from Large Data Sets,” Proceedings of the ACM SIGMOD Conference, 2000; and T. Zhang et al., “BIRCH: An Efficient Data Clustering Method for Very Large Databases,” ACM SIGMOD Conference, 1996. The problem of categorical data clustering has also been recently studied, see, e.g., V. Ganti et al., “CACTUS-Clustering Categorical Data Using Summaries,” Proceedings of the ACM SIGKDD Conference, 1999; D. Gibson et al., “Clustering Categorical Data: An Approach Based on Dynamical Systems,” Proceedings of the VLDB Conference, 1998; and S. Guha et al., “ROCK: A Robust Clustering Algorithm for Categorical Attributes,” Proceedings of the International Conference on Data Engineering, 1999. However, these techniques cannot be utilized for clustering data streams, since they do not naturally scale well with increasing data size. Furthermore, a data stream clustering technique requires the appropriate mechanisms to deal with the temporal issues created by the evolution of the data stream. Clustering and outlier monitoring present a number of unique challenges in an evolving data stream environment. For example, the continuous evolution of clusters makes it essential to quickly identify new patterns in the data. In addition, it is also important to provide end users with the ability to analyze the clusters in an offline fashion. In the data stream environment, outlier and abnormality monitoring is especially problematic, since the temporal component of the data stream influences whether an outlier is defined as an abnormality. For example, the first arriving data point of a cluster may be considered an outlier at the moment of its arrival. However, as time passes, data points may join the newly created cluster, thereby initiating a new pattern of activity resulting from the evolution of the data stream. On the other hand, in many other cases, data points may not join the outlier or newly created cluster over time, thereby defining an abnormality. An important aspect of the data stream clustering process is the ability to identify and label such events effectively. The present invention provides techniques for clustering a data stream and, more particularly, techniques for monitoring data abnormalities in the stream through the clustering of the data stream. For example, in one aspect of the invention, a technique for monitoring abnormalities in a data stream comprises the following steps. A plurality of objects are received from the data stream, and one or more clusters are created from the plurality of objects. At least a portion of the one or more clusters have statistical data of the respective cluster. It is determined from the statistical data whether one or more abnormalities exist in the data stream. Thus, a framework may be provided in which select statistical data may be stored at regular intervals. This results in a technique which is able to analyze different characteristics of the clusters in an effective manner. Advantageously, the inventive techniques may be useful for clustering different kinds of categorical data sets, and adapting to the rapidly evolving nature of a data stream. Additional advantages of the inventive techniques of the present invention include the ability to explore the clusters in an online fashion, and store statistical data which may be utilized for a better understanding and analysis of the data stream. In applications in which the data stream evolves considerably, different kinds of clusters may assist in understanding the behavior of the data stream over different periods in time. This is advantageous since a fast data stream cannot be repeatedly processed in order to resolve different kinds of queries. These and other objects, features, and advantages of the present invention will become apparent from the following detailed description of illustrative embodiments thereof, which is to be read in connection with the accompanying drawings. The following description will illustrate the invention using an exemplary data processing system architecture. It should be understood, however, that the invention is not limited to use with any particular system architecture. The invention is instead more generally applicable to any data processing system in which it is desirable to perform efficient and effective data stream clustering. It is to be understood that the phrase “data point,” illustratively used herein, is one example of a data “object.” As will be illustrated in detail below, the present invention introduces techniques for clustering a data stream and, more particularly, techniques for monitoring data abnormalities in the stream through the clustering of the data stream. An abnormality, as referred to herein, is defined as an outlier cluster or outlier data point of the data stream having specifically defined values in the stored statistical data of the data point or cluster. The stored statistical data may include, for example, the number of pairwise attribute values, the number of categorical attribute values, the number of data points, the sum of the weights of the data points, and the time at which the last data point was added to the outlier. A more detailed description of the values of the statistical data required for abnormality determination are provided herein. Referring initially to Data points from a data stream are received at server In another example, the data points of the data stream may relate to records corresponding to user accesses, or customer connections, on a network. The queries for abnormalities in the data stream are searches for intrusions, or hacker actions. For example, a customer may attempt to bring down a web server by making millions of web accesses on the server using an automated machine, such as a crawler. The queries or searches for abnormalities may be initiated by a system administrator. Referring now to -
- (1) storage and maintenance of statistical data from the data stream (blocks
**202**and**204**); and - (2) use of statistical data for online abnormality querying (blocks
**206**-**210**).
- (1) storage and maintenance of statistical data from the data stream (blocks
The methodology begins at block -
- (1) The statistical data may be easily updated for a fast data stream. The nature of the statistical information is chosen in such a way that it is possible to perform linear updates; and
- (2) The statistical data allows for the computation of various analytical measures required by the user. Such measures may include clusters or outliers over a specific time horizon. It is also often desirable to determine the nature of a data stream evolution over a given time horizon.
In block Referring now to In block A newly created cluster containing only a single data point may be referred to as a “trend-setter.” From the point of view of a user, a trend-setter is an outlier, until the arrival of other data points certify the fact that it is actually a cluster. If and when a sufficient number of new data points are added to the cluster, it is referred to as a mature cluster. The specific number of data points needed in order to make a mature cluster is application dependent, however, in the intrusion detection application described above, a mature cluster may contain 20-50 data points. At a given moment in time, a mature cluster can either be “active” or “inactive.” A mature cluster is said to be active when it has received data points in the recent past. When a mature cluster has not received data points in the recent past, it is said to be inactive. Again, the specific amount of time that must pass in order for a mature cluster to become inactive is application dependent. However, in the intrusion detection application, an active mature cluster may be a mature cluster that has received data points in the last ten days. In some cases, a trend-setter cluster becomes inactive before it has a chance to mature. Such a cluster typically contains a small number of transient data points, which may typically be the result of an underlying abnormality that is short-term in nature. A set of clusters may be dynamically maintained by effectively scaling with data size. In order to achieve better scalability during data stream maintenance, data structures may be constructed that allow for additive operations on the data points. In order to achieve greater accuracy in the clustering technique, a high level of granularity is maintained in the maintenance of the underlying data structures. This may be achieved through a condensation technique in which groups of data clusters are condensed. These groups of clusters are referred to as cluster droplets. A cluster droplet D(t, C) at time t, and a set of categorical data points C is referred to as a tuple (DF2, DF1, n, w(t), l), in which each statistical component is defined as follows: -
- vector DF2 contains the number of the pairwise attribute values;
- vector DF1 contains the number of the categorical attribute values;
- entry n contains the number of data points in the cluster;
- entry w(t) contains the sum of the weights of the data points at time t (the value w(t) is a function of the time t and decays with time unless new data points are added to the droplet D(t)); and
- entry l contains the time stamp of the last time that a data point was added to the cluster.
Cluster droplet maintenance involves storing the data at a high level of granularity so as to lose the least amount of information. The droplet update technique continuously maintains a set of cluster droplets C Referring now to In the case of cluster droplets described above, which maintain a maximum number of droplets k, the cluster with the maximum similarity value is defined as C -
- the statistics are updated to reflect the decay of the data points at the current moment in time; and
- the statistics for each newly arriving data point are added to the statistics of C
_{mindex}.
In the event that the newly arriving data point does not naturally fit in any of the cluster droplets and an inactive cluster does exist, then the most inactive cluster is replaced by a new cluster containing the solitary data point X. The most inactive cluster may be defined as the least recently updated cluster droplet. This new cluster is a potential outlier, or the beginning of a new trend. Further understanding of this new cluster droplet may only be obtained with the progress of the data stream. Referring now to In order to more fully describe decay statistics, a further description of the data stream is first required. The data stream comprises a set of multi-dimensional records X Conceptually, the aim of defining a half life is to define the rate of decay of the weight assigned to each data point in the stream. Correspondingly, the decay-rate is defined as the inverse of the half life of the data stream. The decay-rate is denoted by λ=1/t By changing the value of λ, it is possible to change the rate at which the importance of the historical information in the data stream decays. The higher the value of λ, the lower the importance of the historical information compared to more recent data. By changing the value of this parameter, it is possible to obtain considerable control on the rate at which the historical statistics are allowed to decay. For more stable data streams, it is desirable to pick a smaller value of λ, whereas for rapidly evolving data streams, it is desirable to pick a larger value of λ. Referring now to For example, when a new cluster is created during the streaming technique by a newly arriving data point, it is allowed to remain as a trend-setting outlier for at least one half-life. During that period, if at least one more data point is added to the newly formed cluster, it becomes an active and mature cluster. If no new points arrive during a half-life, then the trend-setting outlier is recognized as a true abnormality in the data stream, and the single point cluster is removed from the current set of clusters. Thus, a new cluster containing one data point is removed when the (weighted) number of points in the cluster is 0.5. This criterion is also used for the removal of mature clusters. In other words, a mature cluster is removed when the weighted number of points in that cluster is larger than 0.5. This will happen only when the inactivity period in the cluster has exceeded the half life 1/λ. The greater the number of points in the cluster, the greater the level by which the inactivity period would need to exceed its half life in order to be considered an inactive cluster. This is a natural solution, since it is intuitively desirable to have stronger requirements (a longer inactivity period) for the elimination of a cluster containing a larger number of points. The inventive techniques are applicable to a large number of applications such as systems diagnosis. For example, as described above, the techniques of the present invention may be utilized for online monitoring of network intrusions. Referring now to Although illustrative embodiments of the present invention have been described herein with reference to the accompanying drawings, it is to be understood that the invention is not limited to those precise embodiments, and that various other changes and modifications may be made by one skilled in the art without departing from the scope or spirit of the invention. Referenced by
Classifications
Legal Events
Rotate |