350 likes | 470 Views
Relational Data Mining with Inductive Logic Programming for Link Discovery. Ray Mooney, Prem Melville, Rupert Tang University of Texas at Austin Jude Shavlik, In ê s de Castro Dutra, David Page, V í tor Santos Costa University of Wisconsin at Madison. EELD Program. Evidence Extraction
E N D
Relational Data Mining with Inductive Logic Programming for Link Discovery Ray Mooney, Prem Melville, Rupert Tang University of Texas at Austin Jude Shavlik, Inês de Castro Dutra, David Page, Vítor Santos Costa University of Wisconsin at Madison
EELD Program • Evidence Extraction • Link Discovery • Pattern Learning
Queries Evidence Problem Context Ontologies Link Discovery Task(fromJim Antonisse,GITI) Vetted hyp cases Evidence request(s) Link Discovery Core: Pattern Matching Alerts based on Hypothesized cases Pattern(s) of Interest Domain Patterns Legend: pre-run-time processing run-time processing
Link Discovery • Data is multi-relational with many people, places, objects and actions and numerous types of relations between them. • Link analysis in intelligence and criminology investigates exploring and visualizing such data as a graph with many nodes and edges of various types. • Link discovery entails finding new links and recognizing threatening patterns in such highly-relational data.
EELD Program • Evidence Extraction • Link Discovery • Pattern Learning
Pattern Learning for Link Discovery • Automated discovery of “patterns of interest” that indicate potentially threatening activities in large amounts of heterogeneous, multi-relational data. • Requires inducing multi-relational patterns that characterize multiple entities and multiple links between them.
Limitations of Traditional Data Mining • Traditional KDD methods assume the data to be mined is in a single relational table and that examples are flat tuples of attribute values. • This assumption stems from: • 1) Properties of the typical data mining tasks like market basket analysis. • 2) Focus in machine learning and statistics on classification or regression using feature vectors as inputs.
Relational Data Mining • Data contains multiple relations. • Patterns to be discovered contain multiple relations. • Knowledge to be discovered may be the definition of another relation rather than a classification or regression function.
Alice Z X Tom W Jane Y Carol Uncle(tom, carol) Relational Data Mining Example Male Female Alice Bob Married Mary Jack Parent Tom Jane Carol Fred John Sue Uncle(X,Y) :- Parent(Z,X), Parent(Z,W), Parent(W,Y) , Male(X), not(X=W).
W Alice Tom V Z Jane X Jack Y John Uncle(jack, john) Uncle(X,Y) :- Married(X,Z), Parent(W,Z), Parent(W,V), Parent(V,Y) Relational Data Mining Example (cont) Male Female Alice Bob Married Mary Jack Parent Tom Jane Carol Fred John Sue , Male(X), not(Z=V).
Most KDD Ignores RDM • KDD textbooks barely mention RDM: • Han & Kamber, 2001 • Hand, Mannila, & Smyth, 2001 • Witten & Frank, 1999 • But there is a recent edited collection on RDM: • S. Džeroski & N. Lavrač, eds. Relational Data Mining, Springer Verlag, 2001.
Inductive Logic Programming(ILP) • Standard formal language for representing relational knowledge is first-order predicate logic. • ILP studies the induction of hypotheses in first-order predicate logic. • Logic programs (e.g. Prolog) or function-free logic programs (e.g. Datalog), are a useful, reasonably-tractable subset of first-order predicate logic. • ILP is the most well-studied approach to relational data mining.
ILP Problem Definition Given • Positive Example Set: P • Negative Example Set: N • Background Knowledge: B Find • Hypothesis, H, such that P, N, B and H are all sets of rules in first-order logic (i.e. Horn clauses, logic programs)
ILP Algorithms • We have utilized two ILP systems for EELD problems in link discovery. • Aleph(Srinivasan, 2001) A variant of the popular Progol algorithm (Muggleton, 1995) • mFoil+(Tang and Mooney, 2002) A variant of the popular Foil algorithm (Quinlan, 1990)
EELD Russian Nuclear Smuggling Data • Data manually extracted from new sources about events related to nuclear smuggling (developed by Veridian Inc.) • Size of data set: • 40 relational tables • 2 to 800 tuples per relation • Translated Access database to Prolog, mapping each relational table to a predicate. • Used Aleph to learn rules for the relation Linked(A,B)which determines whether or not two events are part of the same incident. • 143 positive examples • 517 negative examples
Illustration of Linked Relation New Event Partial Incident N Partial Incident M
Find Correct Incident for New Event Partial Incident M Expanded Incident N
Sample Rule linked(EventA,EventB) :- lk_event_material(_,EventA,_,_,_, ConcealmentG,DescH), lk_event_person(_,EventB,PersonD,_,C,C,_), lk_person_material(_,PersonD,MatF,EvE,_,_,_,_,_), lk_event_material(_,EvE,MatF,I,_, ConcealmentG,DescH), l_relations(I,_,"Stolen"). If A is linked to a specific type of material <G,H>, and B is linked to a person linked to the same specific type of material, through an event in which that material was stolen, then events A and B are linked.
Linked(A,B) B A Event Material Person
Linked(A,B) B A Material Type GH Event Material Person
Linked(A,B) B A E D Material Type GH Material Type GH Event Material Person
Linked(A,B) B A E D Stolen Material Type GH Material Type GH Event Material Person
Linked(A,B) B A E D Stolen Material Type GH Material Type GH Event Material Person
Accuracy Results for Learning Linkedfor Nuclear Smuggling Data • Experimental Method: 5-fold cross validation. • Also tried bagging Aleph to produce an ensemble of 25 hypotheses.
Synthetic Contract Killing Data • Data generated by a plan-based simulator that generates evidence emulating contract killings and other types of murders (developed by IET Inc.). • Simulator used to generate evidence from 200 murder events of three types: • Murder for Hire (71 exs) • First Degree (75 exs) • Second Degree (54 exs) • Use mFoil+ to classify events into one of these three categories.
Sample Rules • Murder For Hire(A):- groupMemberMaleficiary(A, B), subEvents(A, C), crimeMotive(C, economic). • First Degree Murder(A):- subEvents(A, B), performedBy(B, C), loves(C,D). • Second Degree Murder(A):- subEvents(A, B), eventOccursAtLocationType(B,publicProperty), crimeMotive(B, rival), occurrentSubeventType(B, stealing_Generic).
Recent Result from EELD Challenge Problem • murder_for_hire(A) :- • eventOccursAt(A,B), perpetrator(A,C), • agentPhoneNumber(C,D),callerNumber(E,D), • accountHolder(F,C), to_Generic(G,F), • from_Generic(G,H), to_Generic(I,H). • Says an event is a “murder for hire” if it has a recorded location and perpetrator, we have a recorded phone call to the perpetrator, and there was a chain of bank transfers resulting in money reaching the perpetrator’s account. • 100% accuracy on a held-out test set. • Similar pattern found manually by LD researchers working on this challenge problem.
Future Research • Scaling to larger datasets • Stochastic search • Logic program optimization • Integration with relational and deductive database technology. • Integrating probabilistic reasoning • Logic programs with Bayes-net constraints • Active Learning • Theory Refinement
Related Research • Graph-based Relational Data Mining • Subdue (Cook & Holder, UT Arlington) • Probabilistic Relational Models • PRMs (Koller, Stanford) • Relational Feature Construction • PROXIMITY (Jensen, UMass)
Record Linkage • Identify and merge duplicate field values and duplicate records in a database. • Applications • Duplicates in mailing lists • Merging multiple databases of stores, restaurants, etc. • Matching bibliographic references in research papers (Cora/ResearchIndex) • Identifying individuals who are trying to hide their identity by providing slightly erroneous personal information.
Record Linkage Examples Author Title Venue Address Year Name Address City Cusine
Trainable Record Linkage • MARLIN (Multiply Adaptive Record Linkage using INduction) • Learn parameterized similarity metrics for comparing each field. • Trainable edit-distance • Use EM to set edit-operation costs • Learn to combine multiple similarity metrics for each field to determine equivalence. • Use SVM to decide on duplicates
mk m1 m1 mk m1 mk B.Field2 A.Field2 B.Fieldn B.Field1 A.Field1 A.Fieldn MARLIN Record Linkage Framework Trainable duplicate detector Trainable similarity metrics … … … … …
Conclusions • Pattern Learning for Link Discovery is an important application of data mining for counter-terrorism. • Learning for Link Discovery requires Relational Data Mining (RDM). • Other problem domains require RDM • Bioinformatics • Web • Natural Language Understanding • RDM is an important next-generation KDD capability.