{'fraction_non_alphanumeric': 0.018396090830698476, 'fraction_numerical': 0.01178499568841621, 'mean_word_length': 4.828308207705192, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Distributed Real-Time Data Stream Analysis for CTA

Once completed, the Cherenkov Telescope Array (CTA) will be able to map the gamma-ray sky in a wide energy range from several tens of GeV to some hundreds of TeV and will be more sensitive than previous experiments by an order of magnitude. It opens up the opportunity to observe transient phenomena like gamma-ray bursts (GRBs) and flaring active galactic nuclei (AGN). In order to successfully trigger multi-wavelength observations of transients, CTA has to be able to alert other observatories as quickly as possible. Multi-wavelength observations are essential for gaining insights into the processes occurring within these sources of such high energy radiation. CTA will consist of approximately 100 telescopes of different sizes and designs. Images are streamed from all the telescopes into a central computing facility on site. During observation CTA will produce a stream of up to 20 000 images per second. Noise suppression and feature extraction algorithms are applied to each image in the stream as well as previously trained machine learning models. Restricted computing power of a single machine and the limits of network's data transfer rates become a bottleneck for stream processing systems in a traditional single-machine setting. We explore several different distributed streaming technologies from the Apache Big-Data eco-system like Spark, Flink, Storm to handle the large amount of data coming from the telescopes. To share a single code base while executing on different streaming engines we employ abstraction layers such as the streams-framework. These use a high level language to build up processing pipelines that can transformed into the native pipelines of the different platforms. Here we present results of our investigation and show a first prototype capable of analyzing CTA data in real-time.


The Cherenkov Telecope Array
Once completed, the Cherenkov Telescope Array (CTA) will be able to map the gammaray sky in a wide energy range from several tens of GeV to some hundreds of TeV and will be more sensitive than previous experiments by an order of magnitude. CTA will consist of approximately 100 imaging air cherenkov telescopes (IACTs) of three different sizes. Telescope data will be streamed via network from the telescopes to a central computing facility on-site. Cherenkov telescopes record light produced by particle showers induced in the upper atmosphere by cosmic rays. While the cosmic ray flux is approximately isotropic over the sky, gamma rays of cosmic origin can be pinpointed back to its source. Filtering air showers produced by cosmic rays while keeping those produced by gamma rays is the big challenge in IACT data analysis.

Real Time Analysis
One of CTA's main goals is monitoring the sky for transient events. These include Gamma-Ray Burst (GRBs) events and Active Galactic Nuclei (AGNs). To gain more understanding about the physics working in GRBs and AGN it is vital to perform multiwavelength observations. In case a GRB is detected, CTA can alert other experiments to trigger observations in other wavelength bands. The data aquisition system will supply the real time analysis (RTA) with calibrated images of each triggered telescope. Features for classication/regression are calculated on each image in the triggered events. Simulated and labeled data is used to train the models using the Python machine learning library scikit-learn (Pedregosa et al. 2011). These models are then used for filtering of comsic ray showers and estimation of primary particle energy. The trained scikit-learn models are converted into the PMML (Guazzelli et al. 2009) format using the sklearn2pmml (Ruusmann 2015) library. This way the stored model can be shared between programming languages and applied to the data stream from the telescopes.
The expected event rate of CTA will be between 10000 and 20000 events per second depending on deployment and pointing direction (Paz Arribas et al. 2012). Every real time processing system for CTA data will have to handle that data rate. Figure 1. Overview of the analysis process. We use scikit-learn to train models on simulated data and apply these models to the data stream coming from the telescopes to get results in near real time.

Machine Learning Performance
Supervised machine learning is used to separate signal from background and to estimate the energy of a recorded event. Features for classification/regression are calculated from raw input images. We trained a Random-Forest (Breiman 2001) classifier with 200 trees on simulated data to separate signal events from background events.
The trained model is then applied to each image from the telescopes in the data stream. Figure 2 presents the results of the model application. The plot on the left shows the performance of background suppression for the three different telescope types. The predictions for each telescope are then averaged to get a combined prediction for the entire event. This improves background rejection significantly as shown in the right image.
Energy estimation is performed in a similar manner. A Random Regression Forest is trained on the same simulated data. The resulting model is then applied to the data stream and predictions are averaged for all images in a single event.

Runtime Performance
Frameworks for distributed stream processing such as Apache Storm (Toshniwal et al. 2014) or Apache Flink (Alexandrov et al. 2014) allow for workload distribution with fault tolerance and high availability mechanisms to recover from hardware or network failures. Tuning Apache Spark for fast streaming applications is more complicated due to its micro-batch architecture. We compare the runtime of Storm and Flink on a single core to measure the impact of the overhead these frameworks produce. To share a single code base while executing on different streaming engines we employ the streams-framework (Bockermann 2015) as an abstraction layer. This way the analysis pipeline is only defined once, but can be easily executed on top of different distributed streaming engines. The left image in Figure 3 shows that Flink shows less runtime overhead compared to Storm. We continue our experiments on Flink due to faster processing, easier setup and a more comfortable high-level API compared to Storm. Any real-time processing system for CTA has to be able to handle the data rate of up to 20000 events per second and provide analysis results within 30 seconds according to the official CTA requirements.
The right Figure 3 presents the evaluation of a full CTA pipeline executed on top of Flink. For this test a machine with 24 physical CPU cores was used. The datarate goes up to approximately 14000 events per second on this single machine. We use a simple self hosted Flink cluster on two machines with 24 cores each to scale the process up. This way event rates of more than 20000 events per second are achieved.