{'fraction_non_alphanumeric': 0.02493368700265252, 'fraction_numerical': 0.004420866489832007, 'mean_word_length': 4.984656084656085, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Event metadata records as a testbed for scalable data mining

At a data rate of 200 hertz, event metadata records ("TAGs," in ATLAS parlance) provide fertile grounds for development and evaluation of tools for scalable data mining. It is easy, of course, to apply HEP-specific selection or classification rules to event records and to label such an exercise "data mining," but our interest is different. Advanced statistical methods and tools such as classification, association rule mining, and cluster analysis are common outside the high energy physics community. These tools can prove useful, not for discovery physics, but for learning about our data, our detector, and our software. A fixed and relatively simple schema makes TAG export to other storage technologies such as HDF5 straightforward. This simplifies the task of exploiting very-large-scale parallel platforms such as Argonne National Laboratory's BlueGene/P, currently the largest supercomputer in the world for open science, in the development of scalable tools for data mining. Using a domain-neutral scientific data format may also enable us to take advantage of existing data mining components from other communities. There is, further, a substantial literature on the topic of one-pass algorithms and stream mining techniques, and such tools may be inserted naturally at various points in the event data processing and distribution chain. This paper describes early experience with event metadata records from ATLAS simulation and commissioning as a testbed for scalable data mining tool development and evaluation.


Introduction
In the ATLAS computing model (see Figure 1), TAGs are event metadata records. They provide a summary description of physics events by means of approximately 200 simple attributes (including event identification, trigger information, particle content, and global event quantities useful in determining whether a given event is of interest for specific purposes), and they store references to the full event data in all upstream data products, both raw and derived. TAGs are most typically used for event identification, selection, and extraction, and these kinds of use cases have been the focus of ATLAS TAG developer effort to date, but the resulting collection of information provides a rich source of information for mining, and a natural testbed for development of mining tools. In this paper we elaborate on this theme. The focus is prospective: the paper describes a foundation for future work rather than a report of work already undertaken.

Standard TAG processing provides opportunities for mining
The number of TAGs recorded by the ATLAS experiment is at a scale that is attractive as a data mining testbed. During data taking, ATLAS expects 2 x 10 9 events per year of real data. In addition, an equivalent amount of Monte Carlo will be produced. By June 2009, ATLAS will have more than 0.5 x 10 9 TAGs coming from Monte Carlo. Hundreds of millions of TAGs have been written in the recent reprocessing of 2008 cosmic ray commissioning data, and hundreds of millions more are expected from 2009 detector commissioning, even in advance of collision data.  2.1. One-pass algorithms Stream data mining and one-pass algorithms provide a way to analyze data that arrives in the form of continuous streams. In many environments (network traffic monitoring is a standard example), it is straightforward to read or sample data as it goes by, but it may not be feasible to store the data. Therefore, a tool suite that can learn from data that it sees exactly once is useful. As the data can't be stored, some traditional statistical mining operations are challenging, or must be adapted in some way.
One-pass algorithms learn from data as they go by, without the need to store the data or to do iterative processing. Tools based upon such algorithms can detect outliers and anomalies, for example, that may be caused by shifts in machine or detector behavior. Currently, we do not intend TAG stream data mining for discovery physics, but we have already detected software bugs by anomaly detection in the TAG data. Standard ATLAS processing of TAG data provides several loci for nonintrusive insertion of stream mining tools, e.g., during tag upload or transfer.

Association rules
In data mining, association rule finding is a method for discovering interesting relations (called associations) between variables. The goal is to identify attributes of an object that predict other attributes of the same object. The confidence of an association rule is a measure of how often the prediction of an association rule is correct.
ATLAS physics data contain some known association rule behavior, e.g. certain physics attributes (such as the existence of a high p T electron) are strongly associated to trigger decisions (such as the electromagnetic triggers). These known associations provide a means to test the quality of association discovery algorithms, much as Monte Carlo truth provides a way to test trigger and reconstruction algorithms.
Data mining TAGs could further serve as a testbed for tool validation to verify trigger efficiencies in the following manner: Using physics attributes stored in the TAGs, statistical tools can find associations to trigger decisions without domain-specific knowledge. The confidence of these associations can be used to verify or measure the effectiveness of a trigger. One could also learn something from the associations found blindly (without physics knowledge), and not necessarily involving triggers, by association discovery tools.

Clustering
In data mining, clustering is the assignment of objects into groups (called clusters). The goal is to have objects that are more similar to each other build the same cluster whereas other objects form different clusters.
In ATLAS, data is currently clustered when events are streamed into different output files using quantities such as trigger information.
TAGs could serve as a data mining testbed for tool validation to verify the trigger information used for event streaming. ATLAS could treat, for example, a subset of event attributes (N physics attributes stored in the TAGs, without trigger information) as points in N-dimensional space. Utilizing data mining technologies, such as k-means clustering (see Figure 2), clusters of events with similar physics attributes can be found independent of the trigger information.

Neutral data format (HDF5)
The ATLAS TAG format, storing about 200 attributes (integers, floating point numbers and booleans) for each event, is relatively simple and can readily be mapped to other technologies. A few TAG attributes, however, including some trigger decision information, may depend upon run-dependent encoding (the trigger menu may change from one run to another, so a particular bit in a trigger decision word may not mean the same thing in every run). Using every attribute for potential mining therefore poses challenges. Some of these issues can be avoided by restricting the data sample to a range wherein the decoding of these attributes remains constant; further, for most purposes, mining every attribute is not essential.

Data format
Currently TAG storage technology in ATLAS is ROOT via POOL Collections [1], Oracle via POOL, and MySQL via POOL. These technologies are common to HEP and are very well suited for the task of event selection. However, these technologies make it difficult to use off-the-shelf mining tools (though some commercial packages, e.g. for mining Oracle tables, do exist) or to port TAG data mining to high-performance computer hardware.   HDF5 [2] is a unique technology suite that makes possible the management of extremely large and complex data collections. HDF5 data file format is completely portable with no limit on the number or size of data objects in the collection. In addition HDF5 provides tools and applications for managing, manipulating, viewing, and analyzing the data in the collection. Some data mining tools, both opensource and proprietary, can read HDF5 (e.g. rattle [3], mathworks [4]).
ATLAS has developed functionality to write TAGs using an HDF5 file format, either directly during TAG production or by copying from an existing TAG file. TAGs in HDF5 file format contain the same event attributes as their ROOT and Oracle counterparts. The HDF5 file format allows ATLAS to use existing data mining tools to analyze TAGs, and will allow us to utilize supercomputer infrastructure without porting HEP proprietary software.

TAG mining on BlueGene/P
With TAGs in HDF5, we do not need to port LCG or ATLAS software to BlueGene/P [5] (see Figure  3) in order to begin data mining analyses.

First steps
Stream data mining provides statistical tools to analyze distributional characteristics, outliers, and anomalies. These tools can run separately on each node of BlueGene/P, processing disjoint subsets of data. At this level, no inter-process communication is needed until an aggregation phase at the end. The aggregation stage can be done hierarchically, e.g., by means of a binary tree. Stream data mining typically requires only modest amounts of memory, and because of the small size of TAGs, I/O requirements are not too stringent, making this application well suited for a highly parallelized supercomputer.

Later steps
The most challenging effort will be to address data mining problems that require inter-process communication in parallel implementations. These analyses include iterative process, exchange, process and exchange models, e.g. clustering and classification.

Additional directions
One of the advantages of a rich corpus of mineable data such as that provided by the ATLAS TAGs is its potential use as a testbed for development of mining tools beyond those that may be of direct interest to physicists. One example comes from privacy preserving data mining, in which one of the primary challenges is this: even when private information is removed from data prior to its release, there is a real and often subtle risk that the omitted information can be deduced with high confidence from data that remain.
In many circumstances it is computationally straightforward to answer questions like, "Do A and B predict C," i.e., if one discloses the values of A and B, has one effectively, albeit inadvertently, revealed C as well? What is much more computationally demanding is to ascertain whether there is anything in the data that one proposes to release that would allow a determined reader to make substantial inferences about unreleased private or sensitive information. (Rigorous formulations of such problems are demonstrably in a class that complexity theorists term "NP-hard.") When the answer is yes, one may also wish to take the process one step further, i.e., to decide what additional data, perhaps not themselves inherently sensitive, should also be removed prior to release to prevent inferences about sensitive information from being feasible.
TAGs (and the domain-specific knowledge we have about explicit and implicit associations therein) provide a rich and natural testbed for development of these kinds of algorithms, development that can in principle be undertaken on large-scale supercomputing platforms as an extension to the work outlined in the preceding section.