Barga Strata'18 presentation
•
2 likes•414 views
This document discusses using Robust Random Cut Forest (RRCF) for continuous machine learning over streaming data. RRCF provides an efficient and highly scalable way to summarize streaming data and detect anomalies. It can also be used for attribution and directionality to explain anomalies, hotspot detection, classification, forecasting, missing value imputation, and anomaly detection in streaming directed graphs.
Recommended
More Related Content
Similar to Barga Strata'18 presentation
Similar to Barga Strata'18 presentation (20)
More from Roger Barga
More from Roger Barga (14)
Recently uploaded
Recently uploaded (20)
Barga Strata'18 presentation
- 1. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Continuous Machine Learning over Streaming Data Roge r Barga, N ina M ishra, Sudipto Guha, Ry an N ie nhuis Am azon We b Se rvice
- 2. Kinesis Streaming Services Robust Random Cut Forrest Summary of a dynamic data stream, highly efficient, wide number of use cases…
- 3. #Real-time
- 4. All data originates in real-time!
- 5. { "payerId": "Joe", "productCode": "AmazonS3", "clientProductCode": "AmazonS3", "usageType": "Bandwidth", "operation": "PUT", "value": "22490", "timestamp": "1216674828" } Metering Record 127.0.0.1 user-identifier frank [10/Oct/2000:13:55:36 -0700] "GET /apache_pb.gif HTTP/1.0" 200 2326 Common Log Entry <165>1 2003-10-11T22:14:15.003Z mymachine.example.com evntslog - ID47 [exampleSDID@32473 iut="3" eventSource="Application" eventID="1011"][examplePriority@32473 class="high"] Syslog Entry “SeattlePublicWater/Kinesis/123/Realtime” – 412309129140 MQTT Record <R,AMZN,T,G,R1> NASDAQ OMX Record Smart Buildings Beacons Smart Textiles Health Monitors
- 6. But, analytics to gain insights is usually done much, much later.
- 7. #WhyWait
- 9. Batch analytics operations take too long BusinessValue Time To Action Data originated Analytics performed Insights gleaned Action taken Outdated insights Impotent or harmful actions PositiveNegative Decision made Poor decision
- 10. Compress the analytics lifecycle Maximize the value of data BusinessValue Time To Action PositiveNegative Maximum Business Value
- 11. Streaming technology is necessary to detect and act on real-time perishable insights.
- 12. #Streaming
- 13. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Kinesis Data Streaming Services Get actionable insights quickly Streaming Ingest data as it’s generated Process data on the fly Real-time analytics/ML, alerts, actions
- 14. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Streaming with Amazon Kinesis Easily collect, process, and analyze data and video streams in real time Capture, process, and store video streams Kinesis Video Streams Load data streams into AWS data stores Analyze data streams with SQL Capture, process, and store data streams Kinesis Data Streams Kinesis Data Firehose Kinesis Data Analytics
- 15. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Customer Examples 1 billion events per week from connected devices Near-real-time home valuation (Zestimates) Live clickstream dashboards refreshed under 10s 100 GB/day clickstreams from 250+ sites 50 billion daily ad impressions, sub- 50 ms responses Online stylist processing 10 million events/day Migrated data bus from Kafka to Kinesis Facilitate communications between 100+ microservices Analyze billions of network flows in real-time IoT predictive analytics
- 16. © 2018, Amazon Web Services, Inc. or Its Affiliates. All rights reserved. Amazon Kinesis Foundational Service Used Across Amazon Amazon CloudWatch logs Amazon S3 events AWS metering Amazon.com online catalog Amazon Go video analytics
- 18. Discover actionable insights in real-time Anomaly Detection
- 19. Random Cut Tree Recurse: The cutting stops when each point is isolated. Range-biased Cut 0 10 5
- 20. Random Cut Forest Each tree built on a random sample. …
- 21. Random Sample of a Stream Reservoir Sampling [Vitter] Maintain random sample of 5 points in a stream? Keep heads with probability Discard tails with probability 5 6 1 6
- 22. Insert – Case I Start with the Root If the point falls inside the bounding box follow the path to the appropriate child
- 23. Insert – Case II Theorem: Insert generates a tree T’ ~ T( )
- 24. What is an Outlier?
- 25. Anomaly Score: Displacement A point is an anomaly if its insertion greatly increases the tree size ( = sum of path lengths from root to leaves = description length). Inlier:
- 27. NYC Taxi Ridership 0 5000 10000 15000 20000 25000 30000 2014-12-0100:00:00 2014-12-0104:00:00 2014-12-0108:00:00 2014-12-0112:00:00 2014-12-0116:00:00 2014-12-0120:00:00 2014-12-0200:00:00 2014-12-0204:00:00 2014-12-0208:00:00 2014-12-0212:00:00 2014-12-0216:00:00 2014-12-0220:00:00 2014-12-0300:00:00 2014-12-0304:00:00 2014-12-0308:00:00 2014-12-0312:00:00 2014-12-0316:00:00 2014-12-0320:00:00 2014-12-0400:00:00 2014-12-0404:00:00 2014-12-0408:00:00 2014-12-0412:00:00 2014-12-0416:00:00 2014-12-0420:00:00 2014-12-0500:00:00 2014-12-0504:00:00 2014-12-0508:00:00 2014-12-0512:00:00 2014-12-0516:00:00 2014-12-0520:00:00 2014-12-0600:00:00 2014-12-0604:00:00 2014-12-0608:00:00 2014-12-0612:00:00 2014-12-0616:00:00 2014-12-0620:00:00 2014-12-0700:00:00 2014-12-0704:00:00 2014-12-0708:00:00 2014-12-0712:00:00 2014-12-0716:00:00 2014-12-0720:00:00 numPassengers Mon 8am 6pm 4pm Sat 11pm 11am Tue Wed Thu Fri Date aggregated every 30 minutes, Shingle Size: 48 1Public Data: http://www.nyc.gov/html/tlc/html/about/trip_record_data.shtml
- 28. SQL to call Random Cut Forest -- Compute an anomaly score for each record in the input stream -- using Random Cut Forest CREATE OR REPLACE PUMP “STREAM_PUMP” AS INSERT INTO “TEMP STREAM” SELECT STREAM “passengers”, “distance”, ANOMALY_SCORE FROM TABLE (RANDOM_CUT_FOREST ( CURSOR(SELECT STREAM * FROM “SOURCE_SQL_STREAM”))) -- creates a temporary stream. CREATE OR REPLACE STREAM “TEMP_STREAM” ( “passengers” INTEGER, “distance” DOUBLE, “ANOMALY_SCORE” DOUBLE); -- creates another stream for application output. CREATE OR REPLACE STREAM “DESTINATION_SQL_STREAM” ( “passengers” INTEGER, “distance” DOUBLE, “ANOMALY_SCORE” DOUBLE); -- Sort records by descending anomaly score, insert into output stream CREATE OR REPLACE PUMP “OUTPUT_PUMP” AS INSERT INTO “DESTINATION_SQL_STREAM” SELECT STREAM * FROM “TEMP_STREAM” ORDER BY FLOOR(“TEMP_STREAM”.ROWTIME TO SECOND), ANOMALY_SCORE DESC;
- 31. Proceedings 33rd International Conference on Machine Learning, New York, NY, USA, 2016.
- 32. Attribution and Directionality Explainable/Transparent/Interpretable ML “If my time-series data with 30 features yields an unusually high anomaly score. How do I explain why this particular point in the time- series is unusual? [..] Ideally I’m looking for some way to visualize “feature importance” for a specific data point.” --- Robin Meehan, Inasight.com
- 33. What is Attribution? It’s the ratio of the “distance” of the anomaly from normal. (It’s a distance in space of repeated patterns in the data.)
- 35. NYC Taxi Ridership Data1 1Public Data: http://www.nyc.gov/html/tlc/html/about/trip_record_data.shtml
- 36. AnomalyScore
- 38. The Moving Example A Fan/Turbine 1000 pts in each blade Gaussian, for simplicity Blades designed unequal Rotate counterclockwise 3 special “query” points 100 trees, 256 points each
- 39. Anomaly Score at P1 What is going on at 90 degrees? Blade overhead = Not an anomaly
- 40. All 3 Blades
- 41. Transparent Attributions p1 is far away in x-coord most of the time But what is happening to y? x coordinate’s contribution for p1?
- 42. Directionality Sharp transition when the blade moves from above to below at p1! Total score plummets. Slowly rotating away Total score remains high
- 43. Hotspots on a Stream
- 44. Hotspots on a Stream
- 45. Detecting Anomalies in Directed Graphs
- 47. False Alarms Anomaly Detection with user feedback ““Alarms sounded 1 hour before the nurse discovered he was unresponsive. He eventually died. An investigation found the alarm volume had been turned off.” Alarm fatigue: Personnel become desensitized 560 alarm related deaths during 2005—2008 (FDA data)
- 48. System View Data Anomaly Detection Semi-Supervised Classification Alarm / No alarm Is it an anomaly? Is it interesting? ✓RRCF ??? Streaming semi-supervised learning
- 49. Orders Data: vs. Ground truth labels RRCF anomalies Orders per minute Alarms Labeled examples Jun Jul Aug Sep Oct Nov Dec Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec Jan Feb Mar Apr May
- 50. Robust Random Cut Forrest Summary of a dynamic data stream, efficient, number of use cases… Anomaly Detection Attribution and Directionality Hotspot Detection Classification Forecasting Missing Value Imputation Anomaly Detection in Streaming Directed Graph
- 51. Unsupervised Online Adaptive Real-time Amazon Kinesis Data Analytics The easiest way to use machine learning! Available Now • Anomaly Detection • Anomaly Detection with explanations • Hotspot Detection (releasing soon!) Coming Soon • Classification • Time Series Forecasting • Missing Value Imputation
- 52. Contributors To This Project Roger Barga, Kapil Chhabra, Charles Elkan, Dhivya Eswaran, Christos Faloutsos, Praveen Gattu, Gaurav Ghare, Sudipto Guha, Shiva Kasiviswanathan, Nina Mishra, Morteza Monemizadeh, Lauren Moos, Yonatan Naamad, Ryan Nienhuis, Gourav Roy, Okke Schrijvers, Joshua Tokle, and Tal Wagner