1. Fast and Scalable Nearest Neighbor Based Classification Taufik Abidin and William Perrizo Department of Computer Science North Dakota State University

2. Given a (large) TRAINING SET, R(A 1,…,A n, C), with C=CLASSES and {A 1 …A n }=FEATURES Classification is: labeling unclassified objects based on the training set kNN classification goes as follows: Classification Search for the k-Nearest Neighbors Vote the class Training Set Unclassified Object

3. Problems with kNN Finding k-Nearest Neighbor Set from horizontally structured data (record oriented data) can be expensive for large training set (containing millions or trillions of tuples) – linear to the size of the training set (1 scan) – Closed kNN is much more accurate but requires 2 scans Vertically structuring the data can help.

4. 6. 1 st half of 1 st of 2 nd is  1 0 0 1 1 4. 1 st half of 2 nd half not  0 0 2. 1 st half is not pure1  0 0 0 1. Whole file is not pure1  0 Horizontal structures (records) Scanned vertically P 11 P 12 P 13 P 21 P 22 P 23 P 31 P 32 P 33 P 41 P 42 P 43 0 0 0 0 1 10 0 1 0 0 1 0 0 0 0 0 0 1 01 10 0 1 0 0 1 0 0 0 0 1 0 01 0 1 0 0 0 0 1 0 0 0 1 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 10 01 5. 2 nd half of 2 nd half is  1 0 0 1 R 11 0 1 0 1 process P-trees using multi-operand logical AND s. Vertical Predicate-tree (P-tree) structuring: vertically partition table; compress each vertical bit slice into a basic Ptree; 010 111 110 001 011 111 110 000 010 110 101 001 010 111 101 111 101 010 001 100 010 010 001 101 111 000 001 100 R( A 1 A 2 A 3 A 4 ) A data table, R(A 1..A n ), containing horizontal structures (records) is processed vertically (vertical scans) The basic (1-D) Ptree for R 11 is built by recording the truth of the predicate “pure 1” recursively on halves, until purity is reached. 3. 2 nd half is not pure1  0 0 7. 2 nd half of 1 st of 2 nd not  0 0 0 1 10 0 1 0 1 1 1 1 1 0 0 0 1 0 1 1 1 1 1 1 1 0 0 0 0 0 1 0 1 1 0 1 0 1 0 0 1 0 1 0 1 1 1 1 0 1 1 1 1 1 0 1 0 1 0 0 0 1 1 0 0 0 1 0 0 1 0 0 0 1 1 0 1 1 1 1 0 0 0 0 0 1 1 0 0 R 11 R 12 R 13 R 21 R 22 R 23 R 31 R 32 R 33 R 41 R 42 R 43 R[A 1 ] R[A 2 ] R[A 3 ] R[A 4 ] 010 111 110 001 011 111 110 000 010 110 101 001 010 111 101 111 101 010 001 100 010 010 001 101 111 000 001 100 Eg, to count, 111 000 001 100 s, use “pure111000001100”: 0 2 3 -level P 11 ^P 12 ^P 13 ^P’ 21 ^P’ 22 ^P’ 23 ^P’ 31 ^P’ 32 ^P 33 ^P 41 ^P’ 42 ^P’ 43 = 0 0 2 2 -level =2 01 2 1 -level But it is pure (pure0) so this branch ends

5. Total Variation The Total Variation of a set X, TV(a) is the sum of the squared separations of objects in X from a, defined as follows: TV(a) =  x  X (x-a)o(x-a) We will use the concept of functional contours (in particular, the TV contours) in this presentation to identify a well- pruned, small superset of the Nearest Neighbor Set of an unclassified sample (which can then be efficiently scanned) First we will discuss functional contours in general then consider the specific TV contours.

6. Given f:R(A 1..A n )  Y and S  Y, define contour(f,S)  f -1 (S). From the derived attribute point of view, Contour(f,S) = SELECT A 1..A n FROM R* WHERE R*.A f  S. If S={a}, f -1 ({a}) is Isobar(f, a) There is a DUALITY between functions, f:R(A 1..A n )  Y and derived attributes, A f of R given by x.A f  f(x) where Dom(A f )=Y A 1 A 2 A n x 1 x 2 x n :... Y f(x) f A 1 A 2 A n A f x 1 x 2 x n f(x) :... R R* A 1 A 2 A n : :... YSYS f R A 1 ..  A n space Y S graph(f) = { (a 1,...,a n,f(a 1.a n )) | (a 1..a n )  R } contour(f,S)

7. TV(a) =  x  R (x-a)o(x-a) If we use d for a index variable over the dimensions, =  x  R  d=1..n (x d 2 - 2a d x d + a d 2 ) i,j,k bit slices indexes =  x  R  d=1..n (  k 2 k x dk ) 2 - 2  x  R  d=1..n a d (  k 2 k x dk ) + |R||a| 2 =  x  d (  i 2 i x di )(  j 2 j x dj ) - 2  x  R  d=1..n a d (  k 2 k x dk ) + |R||a| 2 =  x  d  i,j 2 i+j x di x dj - 2  x,d,k 2 k a d x dk + |R||a| 2 =  x,d,i,j 2 i+j x di x dj - |R||a| 2 2  d a d  x,k 2 k x dk + TV(a) =  i,j,d 2 i+j |P di^dj | - |R||a| 2  k 2 k+1  d a d |P dk | + The first term does not depend upon a. Thus, the derived attribute coming from f(a)=TV-TV(  ) (which does not have that 1 st term at all) has identical contours as TV (just a lowered graph). We also find it useful to post-compose a log function to reduce the number of bit slices. The resulting functional is called the High-Dimension-ready Total Variation or HDTV(a). =  x,d,i,j 2 i+j x di x dj +  d a d a d ) |R|( -2  d a d  d +=  x,d,i,j 2 i+j x di x dj - |R|  d a d a d 2|R|  d a d  d +

8. Isobars are hyper-circles centered at  graph(g) is a log-shaped hyper-funnel: From equation 7, f(a)=TV(a)-TV(  )  d (a d a d -  d  d ) ) = |R| ( -2  d (a d  d -  d  d ) + TV(a) =  x,d,i,j 2 i+j x di x dj + |R| ( -2  d a d  d +  d a d a d ) +  d  d 2 )= |R|(  d a d 2 - 2  d  d a d f(  )=0 and g(a)  HDTV(a) = ln( f(a) )=ln|R| + ln|a-  | 2 = |R| |a-  | 2 so going inward and outward along a-  by  we arrive at inner point, b=  +(1-  /|a-  |)(a-  ) and outer point, c=  -(1+  /|a-  |)(a-  ).  -contour (radius  about a) a For an  -contour ring (radius  about a) g(b) and g(c) are the lower and upper endpoints of a vertical interval, S, defining the ε-contour shown. An easy P-tree calculation on that interval provides a P-tree mask for the  - contour (no scan requred). b c g(b) g(c)  x1x1 x2x2 g(x)

9. If more pruning is needed (i.e., HDTV(a) contour is still to big to scan) use a dimension projection contour (Dim-i projection P-trees are already computed = basic P-trees of R.A i. Form that contour_mask_P-tree; AND it with the HDTV contour P-tree. The result is a mask for the intersection).   -contour (radius  about a) a HDTV(b) HDTV(c) b c As pre-processing, calculate basic P-trees for the HDTV derived attribute. To classify a, 1. Calculate b and c (which depend upon a and  ) 2. Form the mask P-tree for training points with HDTV-values in [HDTV(b),HDTV(c)] (Note: the paper was submitted we were still doing this step by sorting TV(a) values. Now we use the contour approach which speeds up this step considerably. The performance evaluation graphs in this paper are still based on the old method. And w/o Gaussian vote weighting). 3. User that mask P-tree to prune down the candidate NNS. 4. If the root count of the candidate set is small enough, proceed to scan and assign class votes using, e.g., a Gaussian vote function, else prune further using a dimension projection). contour of dimension projection f(a)=a 1 x1x1 x2x2 HDTV(x) If more pruning is needed (i.e., HDTV(a) contour is still to big to scan)

10. Graphs of TV, TV-TV(  ) and HDTV TV(  )=TV(x 33 ) TV(x 15 ) 1 2 3 4 5 X Y TV 1 2 3 4 5 1 2 3 TV(x 15 )- TV(  ) 1 2 3 4 5 X Y TV- TV(  ) 4 5  HDTV

11. Experiements: Dataset 1.KDDCUP-99 Dataset (Network Intrusion Dataset) – 4.8 millions records, 32 numerical attributes – 6 classes, each contains >10,000 records – Class distribution: – Testing set: 120 records, 20 per class – 4 synthetic datasets (randomly generated): - 10,000 records (SS-I) - 100,000 records (SS-II) - 1,000,000 records (SS-III) - 2,000,000 records (SS-IV) Normal972,780 IP sweep12,481 Neptune1,072,017 Port sweep10,413 Satan15,892 Smurf2,807,886

12. (k=5) Note: SMART-TV was done by sorting the derived attribute. Now we use the much faster P-tree interval mask. Algorithm x 1000 cardinality 10100100020004891 SMART-TV0.140.332.013.889.27 Vertical Closed-KNN0.891.063.9412.4430.79 KNN0.392.3423.4749.28 NA Speed or Scalability Machine used: Intel Pentium 4 CPU 2.6 GHz machine, 3.8GB RAM, running Red Hat Linux

13. Dataset (Cont.) 2.OPTICS dataset – ~8,000 points, 8 classes (CL-1, CL-2,…,CL-8) – 2 numerical attributes – Training set: 7,920 points – Testing set: 80 points, 10 per class

14. 3.IRIS dataset – 150 samples – 3 classes (iris-setosa, iris- versicolor, and iris-virginica) – 4 numerical attributes – Training set: 120 samples – Testing set: 30 samples, 10 per class Dataset (Cont.)

15. Overall F-score Classification Accuracy Comparison (Note: SMART-TV class voting done with equal votes for each training neighbor – now we use a Gaussian vote weighting and get better accuracy than the other two). DatasetsSMART-TVPKNNKNN IRIS0.970.710.97 OPTICS0.960.990.97 SS-I0.960.720.89 SS-II0.920.910.97 SS-III0.940.910.96 SS-IV0.920.910.97 NI0.930.91NA Overall Accuracy

16. A nearest-based classification algorithm that starts its classification steps by approximating the Nearest Neighbor Set. A total variation functional is used prune down the NNS candidate set. It finishes classification in the traditional way The algorithm is fast. It scales well to very large dataset. The classification accuracy is very comparable to that of Closed kNN (which is better than kNN). Summary