170 likes | 254 Views
Frequent Pattern Mining for Kernel Trace Data Christopher LaRosa, Li Xiong, Ken Mandelberg. SAC’08, March 16-20, 2008, Fortaleza, Ceará, Brazil. outline. Introduction Module Window Folding and Slicing Subsequence mining Experimentation. Introduction.
E N D
Frequent Pattern Mining for Kernel Trace DataChristopher LaRosa, Li Xiong, Ken Mandelberg SAC’08, March 16-20, 2008, Fortaleza, Ceará, Brazil.
outline • Introduction • Module • Window Folding and Slicing • Subsequence mining • Experimentation
Introduction • The introduction of low-impact kernel-level tracing tools allows for comprehensive and transparent reporting of process and operating system activity. • In Linux trace toolkit(LTT) • 達到human-readable
Introduction(cont.) • LTT 可以配合其他工具的使用ex:trace time 可以分析系統performance LTT可以透過設置參數,在特定時段裡,篩選所需要記錄的事件類型,透過合理的參數配置,可使系統負擔減少一定的程度 LTT提供自定函數跟紀錄使他可以用來debug跟自己編寫內核代碼
Module 1.find frequent itemset 2.Analysis pattern
Module(cont.) • In Real world A and B can no order only C after B
Module(cont.) 此篇合用兩個方法 • Window Folding • Window Slicing
Window Slicing • There are two ways to cut the long access stream into short sequences – overlapped cutting The overlapped cutting divides an entire access stream into many short sequences and leaves some overlapped regions between any two consecutive sequences .
Window Slicing(con.) • non-overlapped cutting • 重疊的可以得到比較多的sequence但algorithm處理時間較長
Window Slicing(con.) Stream abcabdabeabf into short sequences with length of 4 using overlapped cutting results in 5 short sequences is :
Window Slicing(con.) Overlapping ab的sup=4 Non Overlapping ab的sup=3
Window Slicing(con.) 不同於一般的 sequential pattern
Subsequence mining 根據windows Slicing找到frequent Itemset 之後 再做事件判斷 W要多大?