Multidimensional analysis tool for high dimensional data

Described is a technology by which high dimensional data may be efficiently analyzed, including by filtering, grouping, aggregating and/or sorting operations to provide an analysis result. For efficiency in the analysis, an inverted index may be built (e.g., as part of filtering), and/or a hash structure (e.g., as part of grouping). Analysis parameters specify dimensions, on which union and/or intersection operations are performed to provide a final dataset. The analysis tool provides a user interface for inputting analysis parameters and outputting information corresponding to an analysis result. The analysis tool may sort the information corresponding to the analysis result, e.g., to output the topmost or bottommost results.

CROSS-REFERENCE TO RELATED APPLICATIONS

The present application is related to the following copending U.S. patent applications, assigned to the assignee of the present application, filed concurrently herewith and hereby incorporated by reference: Analyzing Software Users with Instrumentation Data and User Group Modeling and Analysis, U.S. patent application Ser. No. 11/818,610; Software Reliability Analysis Using Alerts, Asserts, and User Interface Controls, U.S. patent application Ser. No. 11/818,612; Efficient Data Infrastructure for High Dimensional Data Analysis, U.S. patent application Ser. No. 11/818,879; Software Feature Usage Analysis and Reporting, U.S. patent application Ser. No. 11/818,600; Software Feature Modeling and Recognition, U.S. patent application Ser. No. 11/818,596; and Analyzing Software Usage with Instrumentation Data, U.S. patent application Ser. No. 11/818,611.

BACKGROUND

To resolve many business-related questions, a tool referred to as multidimensional analysis is used, which in SQL terms is a ‘group by’ operation. Generally for one query, a large amount of data is involved, whereby computing performance is critical to obtain the results, e.g., users cannot wait several hours to get analysis results.

Current OLAP (Online Analytical Processing) systems enhance the performance by pre-computing data cubes that correspond to the multidimensional arrangement of the data to be analyzed. More particularly, in OLAP, a dimension is a category of data represented in one column of a table, and a measure represents data in the table that can be accessed by specifying values for its dimensions. A set of measures having the same dimensions may be represented as an OLAP cube.

However, as the number of dimensions increases, the storage required for data cubes grows exponentially. As a result of this limitation, one cube can only support tens of dimensions. There was heretofore no known effective tool that is able to support an analysis of high-dimensional data, such as data having thousands of dimensions, yet such data exists in a number of situations for which data analysis is desired.

SUMMARY

Briefly, various aspects of the subject matter described herein are directed towards a technology by which high dimensional data may be efficiently analyzed, including by filtering, grouping, aggregating and/or sorting operations. For efficiency in the analysis, an inverted index may be built (e.g., as part of filtering), and a hash structure (e.g., as part of grouping).

Analysis parameters are received that correspond to one or more sets of dimension values. For multiple dimensions, union and/or intersection operations are performed to assemble the requested data into a final dataset. An inverted index is built for each dimension which facilitates lookup of identifiers that are associated with data values in that dimension. A hash structure may be built to group together identifiers having identical dimension values.

In one implementation, the analysis is performed by an analysis tool that includes a user interface for inputting analysis parameters and outputting information corresponding to an analysis result. The analysis tool may sort the information corresponding to the analysis result, to output a subset of the information that is smaller than all of the available information, e.g., the topmost or bottommost results.

DETAILED DESCRIPTION

Various aspects of the technology described herein are generally directed towards a mechanism/tool that support multidimensional analysis of high dimensional data, in which a computation model is developed and may be used in an online state. In one example implementation, an inverted index is used for fast data retrieval, and an efficient grouping algorithm is described based on hashing technology.

For purposes of description, various examples herein are directed towards software quality metrics (SQM) data, which is generally data that was recorded during usage sessions of software products and is very high dimensional, e.g., SQM data may have many thousands of dimensions. However, as will be understood, these are only non-limiting examples, as the technology generally applies to computation (e.g., online) for multidimensional analysis of high dimensional data, regardless of the data type, as well as inverted index and hashing for enhancing the performance of multidimensional analysis.

As such, the present invention is not limited to any particular embodiments, aspects, concepts, structures, functionalities or examples described herein. Rather, any of the embodiments, aspects, concepts, structures, functionalities or examples described herein are non-limiting, and the present invention may be used various ways that provide benefits and advantages in computing in general.

Turning toFIG. 1, there is shown an analysis tool102for analyzing information corresponding to high-dimensional data104. In one example implementation, a user interface106comprises a client of the tool102, which allows an operator (user) to define a query and send the query to the analysis tool (e.g., a service thereof). In return, the operator receives query results back, such as presented in a report set108comprising one or more reports.

In one example implementation generally represented inFIG. 1and described in the aforementioned U.S. patent application entitled “Efficient Data Infrastructure for High Dimensional Data Analysis,” access to the information is via a data manager110of a data processing mechanism112. In general, a data importer/processor114converts the high dimensional data (e.g., SQM data) in the source104into a set of data files116. To this end, when the original data is in some source such as a database, the data importer/processor component114pulls the data from the data source104and converts the data into data files116arranged for efficient data retrieval, as set forth below.

As can be readily appreciated, the data manager110may simply provide access to the data and/or data files, or alternatively can provide at least some functionality. For example, in one implementation, for a given dimension, the APIs provide functions to get the raw values of specified rows, functions to get the mapped values of specified rows, functions to get the rows of specified raw values, functions to get the rows of specified mapped values, functions to get a mapped value dictionary and functions to get the row count.

Other functionality such as filtering, grouping, sorting, aggregating and so forth may be provided by the data manager110, but alternatively may be secondarily processed from the retrieved data. In the example implementation described herein and represented inFIG. 1, the analysis tool102provides mechanisms121-124for filtering, grouping, sorting and aggregating, respectively, as described below.

In one example, to define an analysis and get the results, the operator provides search dimensions and measures for searching, (where in general, dimensions and measures are similar to OLAP concepts thereof), such as by inputting keywords in a search text box. In general, a dimension may be any variable recorded in a session, a feature (e.g., copy and paste, typically comprising a series of commands), and/or variables that are not directly recorded in a session, but rather are calculated from other variables that are recorded. Matching results may be displayed in association with (e.g., under) the search text box.

FIG. 2provides an example of instrumentation data206, with some of the collected data (arranged in columns) for some number of program usage sessions (arranged in rows). In general, the example instrumentation data206comprise data collected from each user session, where a session corresponds to actual usage by a user of an executing program. A session starts from the application start, and ends when the application is closed or otherwise terminated. Sessions can also be time limited, e.g., if a session exceeds twenty-four hours, the session is ended and the instrumentation data recorded (the application continues to run). In SQM, each record corresponds to one session, which is the period of a single run of a software program under evaluation, e.g., a software application program of the Microsoft® Office suite of software programs.

In one example implementation, each session is associated with some or all of the information shown inFIG. 2, including a session ID, a user ID, and an application name. Other information that is typically recorded includes the application version, a start time, an end time, the commands used during the session and still other data, such as the number of files opened and so forth.

Conceptually the data can be viewed as a (very large) table, in which each row represents a record and each column represents a dimension, where there could be thousands of dimensions. In the example below, the data recorded in a session include memory size, CPU speed, application name, and so forth. In one system, the data is organized by column, with inverted indices built for high retrieval.

A first part of the data organization processing is represented in the block330ofFIG. 3. In general, in block330the data is organized by columns, and each column corresponds to three data structures, which in this example comprise files, namely a dimension table file332, the raw data file334and a mapped data file336. The raw data file334is used to store the values of a column (in each row) of the source data106, and the mapped data file336is used to store the mapped value for each raw value. The mapping is defined in the dimension table file332.

In the example ofFIG. 3, the dimension table332defines a memory size range for each mapped value. For any suitable dimension, an operator of the analysis process or the like may determine the ranges as appropriate for the desired analysis. Using the range, each raw value is mapped to a corresponding mapped value. Nulls are mapped to zero (although in a real world model, each session would ordinarily have some memory and thus few if any nulls would be present, unless not reported for some reason). Thus, using the range of 256 MB to 511 MB, it is seen inFIG. 3that the raw value of 511 (MB) is mapped to a value of two (2), the raw value of 768 (MB) is mapped to a value of three (3) based on the range in the dimension table312of 512 MB to 1 GB, and so forth.

In the raw data file334, values can be stored sequentially as vectors. However, some dimensions are relatively sparse because there are often ‘null’ values in the data. For such dimensions, compression techniques may be used to store the data so that the amount of required data storage can be reduced. One example is represented in the block440ofFIG. 4, in which a compressed file335is built from the raw value file334. As can be seen in the compressed file335, only the non-null values are recorded by storing them in association with a record identifier, e.g., as RecordID, value pairs. The compressed file335may be used instead of the raw value file334when mapping; any RecordID values skipped in the compressed data file335are known to have a null raw value.

For high retrieval performance, inverted indices are built from the data. In general, using SQM data as an example, an inverted index uses a data value (a dimension or measure) as an index to a set of one or more sessions in which that data appeared. For example, if the data value corresponded to the Excel spreadsheet program, the inverted index would find that the Excel spreadsheet program was associated with sessions125,230,1415,6153, and so forth.

In one implementation, for each column of data, an inverted index is built and stored into two files; one file stores the row identifiers for each mapped value, and another file stores the row count and offset in the first file for each mapped value. With the inverted index, the retrieval of records for a given mapped value is efficient, requiring only a constant time. Note that in general, any performance enhancement cannot rely on pre-computation because there are too many potential results to be pre-computed. As such, a computation model is provided that may operate in an online fashion.

Block550ofFIG. 5shows an example inverted index552comprising inverted index files554and556for the variable that represents the memory size (“MemSize”) in the logged session SQM data. The shaded blocks show how the session ID that is set with the memory size range from 256M to 511M (mapped value2via the dimension table332) is retrieved with the inverted index552built for the MemSize variable. As can be seen, for the range from 256M to 511M, there is a count of three (3) session ID entries, beginning at offset eight (8), namely session IDs one (1), six (6) and eleven (11). These correspond to the three mapped values of two (2) in the mapped value file334, which map to raw values511,511and510in the raw value file336. Note again that the compressed file335ofFIG. 4may be provided instead of the raw value file334wherever appropriate.

Block660shows an example inverted index662comprising inverted index files664and666for the variable that represents an application program of the Microsoft® Office software product suite in the logged session SQM data. The shaded blocks show how a session ID for the Word sessions and Outlook sessions (mapped values0and2respectively via the dimension table668) is retrieved with the inverted index662.

Turning to analysis operation, an operator can define filters in the client user interface106to determine a target session set. For example, in the client user interface, the user can drag a dimension from the dimension list into the filter panel, and choose members of interest. In general, the operator can specify any combination of dimensions and measures in an analysis. For example, in the client user interface, user can drag any dimension/measure into the dimension/measure panel, and specify a variable that is used for sorting.

The user interface106allows an operator or the like to set analysis parameters. After defining an analysis, user can run that analysis. The analysis service receives the queries, computes the analysis and sends the results back to the client. Steps for computation may include filtering, grouping, aggregating and sorting.

The query results are output in some way, such as presented in the user interface106. For example, once a search is performed on a dimension or measure, the operator can select information for an item, (e.g., by clicking information button on the left of the dimension or measure item), and preview the information of the dimension or the measure. A preview window or the like may be used to display the owner and description of the dimension or the measure. For the dimension, there also may be information related to distribution.

As mentioned above, the operator may only be interested in some subset of the total sessions. To this end, a filtering mechanism (block121ofFIG. 1) is used to determine a target session set. More particularly, using the inverted indices, the session filtering process is performed efficiently, e.g., because the session set for one dimension's value set can be retrieved efficiently. For multiple dimension values, union and intersection operations are performed on those session sets to get a final target session set.

For example, consider an operator that wants to select from the SQM data Microsoft® Word and Outlook sessions in which the computer memory size was the range from 128 MB to 255 MB. As can be seen inFIG. 7, the related variables are memory size (MemSize) and Office application (OfficeApplication). Using the inverted index552(FIG. 5) for memory size, the tool obtains a session list (e.g., ordered by session) containing sessions with memory size from 128 MB to 255 MB. With the inverted index662(FIG. 6) for OfficeApplication, the system gets two sorted session lists related to Word and Outlook sessions, respectively; these two session lists are merged with a union operation into a second, merged session list. An intersection operation is performed on the first and second, merged session lists to obtain the sessions that the user wants.

After the filtering process, the filtered sessions may be grouped by their dimension values, as represented inFIG. 1via the grouping mechanism122. Then for each session group, the measure values are calculated. As described below and represented inFIG. 7, in order to perform the session grouping efficiently, a hash structure is built in memory. The sessions with same dimension values are mapped to the same group.

For example, for each filtered session in the set770, a hash value is calculated according to its dimension values (shown in the block772). In this example, the hash values (shown in the block774) are computed by adding up the dimension values, e.g., the session ID of three has dimension values of one, three and four, whereby the hash value is eight.

The hash entry structure776then has an entry added thereto for each sum, via the hash bucket778. If the corresponding dimension group (block780) already exists, the same group is used, e.g., session ID three (3) and session ID eight (8) both have dimension values of (1, 3, 4) and thus the same group is reused. If the corresponding dimension group does not already exist, a new group is inserted into the hash structure, as shown inFIG. 7. Note that the hash function handles collisions, e.g., session ID nine (9) has dimension values of (2, 3, 3) which also sums to eight (8), but has a different dimension group in block780.

Various hash functions can be used in the grouping process. In one example system, the following efficient hash function is provided:

Aggregation may be performed via an aggregating mechanism (block123ofFIG. 1), in which the measures are computed for each session group. In one example, there are three kinds of measures, namely distributive measures, algebraic measures and holistic measures. Distributive measures, such as count and sum, are the measures that can be computed in a distributive manner. Algebraic measures are the measures that can be computed from two or more distributive measures. For example, Crash Ratio (number of sessions that crashed relative to total sessions) is an algebraic measure, which can be computed from the crash session count and total session count. Any distributive and algebraic measures can be computed during the grouping process122.

Holistic measures, such as distinct count, are the measures that are computed based on the whole data set and cannot be computed in a distributive manner. Instead, the inverted index can be used to efficiently calculate distinct count measure. By way of example, user count is the distinct count of user IDs in each session group. For each user ID, the aggregation mechanism123can determine that user's sessions with the inverted index, and increment the user count of the corresponding session groups in the hash structure.

FIG. 8shows an example of the calculation of the distinct count measure for a set of user IDs880via the inverted index882for user IDs. As described above, the inverted index includes a count-offset table884which maps the session IDs in the session ID file886. Using the hash structure (e.g., blocks776,778and780) described above with reference toFIG. 7, the count (block896) is incremented for each distinct dimension group. For example, it is seen that user ID0includes session identifiers of3,8and9; session identifiers3and8have the same dimension values and thus are only counted as one, while session identifier9has a different set of dimension values and is thus counted as one (at least while in the state shown inFIG. 8).

With respect to sorting (block124ofFIG. 1), the query results maybe very large, whereby a typical operator may only want to receive a subset of the result set some lesser number of results, such as the top or bottom k results. After the measure calculation completes, a sorting algorithm (e.g., a heap sort algorithm) may be performed to return a subset of sorted results.

To summarize,FIG. 9is a flow diagram representing example steps in an analysis, beginning at step902where the user inputs the analysis parameters. Step904represents performing a filtering operation based on inverted index(es) to obtain filtered data.

Step906represents evaluating whether the filter contains multiple dimension values. If so, step908represents performing the union and/or intersection operation or operations as exemplified above.

Based on the final dataset (e.g., session set for SQM data), grouping, aggregating and sorting are represented via steps912,914and916, respectively. Note that with respect to aggregation, any distributive and algebraic measures can be computed during the grouping operation (step912), and to this extent steps912and914can be considered together. Step918represents generating and outputting a report or the like for operator viewing and/or interaction therewith.

As can be readily appreciated, while the technology described herein used examples of how SQM data analysis is supported, it is straightforward to apply the technology to other data sources. For example, web log data is also very high dimensional.

Further, because the data is organized by columns, if there are new variables added for the same data source, only the data of the new variable needs to be imported; there is no need to modify the existing data. In this way, the system provides straightforward extensibility for multidimensional analysis of high dimensional data.

Exemplary Operating Environment

FIG. 10illustrates an example of a suitable computing system environment1000on which the analysis tool102(FIG. 1) may be implemented. The computing system environment1000is only one example of a suitable computing environment and is not intended to suggest any limitation as to the scope of use or functionality of the invention. Neither should the computing environment1000be interpreted as having any dependency or requirement relating to any one or combination of components illustrated in the exemplary operating environment1000.

With reference toFIG. 10, an exemplary system for implementing various aspects of the invention may include a general purpose computing device in the form of a computer1010. Components of the computer1010may include, but are not limited to, a processing unit1020, a system memory1030, and a system bus1021that couples various system components including the system memory to the processing unit1020. The system bus1021may be any of several types of bus structures including a memory bus or memory controller, a peripheral bus, and a local bus using any of a variety of bus architectures. By way of example, and not limitation, such architectures include Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA) bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus also known as Mezzanine bus.

The system memory1030includes computer storage media in the form of volatile and/or nonvolatile memory such as read only memory (ROM)1031and random access memory (RAM)1032. A basic input/output system1033(BIOS), containing the basic routines that help to transfer information between elements within computer1010, such as during start-up, is typically stored in ROM1031. RAM1032typically contains data and/or program modules that are immediately accessible to and/or presently being operated on by processing unit1020. By way of example, and not limitation,FIG. 10illustrates operating system1034, application programs1035, other program modules1036and program data1037.

The computer1010may also include other removable/non-removable, volatile/nonvolatile computer storage media. By way of example only,FIG. 10illustrates a hard disk drive1041that reads from or writes to non-removable, nonvolatile magnetic media, a magnetic disk drive1051that reads from or writes to a removable, nonvolatile magnetic disk1052, and an optical disk drive1055that reads from or writes to a removable, nonvolatile optical disk1056such as a CD ROM or other optical media. Other removable/non-removable, volatile-/nonvolatile computer storage media that can be used in the exemplary operating environment include, but are not limited to, magnetic tape cassettes, flash memory cards, digital versatile disks, digital video tape, solid state RAM, solid state ROM, and the like. The hard disk drive1041is typically connected to the system bus1021through a non-removable memory interface such as interface1040, and magnetic disk drive1051and optical disk drive1055are typically connected to the system bus1021by a removable memory interface, such as interface1050.

The drives and their associated computer storage media, described above and illustrated inFIG. 10, provide storage of computer-readable instructions, data structures, program modules and other data for the computer1010. InFIG. 10, for example, hard disk drive1041is illustrated as storing operating system1044, application programs1045, other program modules1046and program data1047. Note that these components can either be the same as or different from operating system1034, application programs1035, other program modules1036, and program data1037. Operating system1044, application programs1045, other program modules1046, and program data1047are given different numbers herein to illustrate that, at a minimum, they are different copies. A user may enter commands and information into the computer1010through input devices such as a tablet, or electronic digitizer,1064, a microphone1063, a keyboard1062and pointing device1061, commonly referred to as mouse, trackball or touch pad. Other input devices not shown inFIG. 10may include a joystick, game pad, satellite dish, scanner, or the like. These and other input devices are often connected to the processing unit1020through a user input interface1060that is coupled to the system bus, but may be connected by other interface and bus structures, such as a parallel port, game port or a universal serial bus (USB). A monitor1091or other type of display device is also connected to the system bus1021via an interface, such as a video interface1090. The monitor1091may also be integrated with a touch-screen panel or the like. Note that the monitor and/or touch screen panel can be physically coupled to a housing in which the computing device1010is incorporated, such as in a tablet-type personal computer. In addition, computers such as the computing device1010may also include other peripheral output devices such as speakers1095and printer1096, which may be connected through an output peripheral interface1094or the like.

The computer1010may operate in a networked environment using logical connections to one or more remote computers, such as a remote computer1080. The remote computer1080may be a personal computer, a server, a router, a network PC, a peer device or other common network node, and typically includes many or all of the elements described above relative to the computer1010, although only a memory storage device1081has been illustrated inFIG. 10. The logical connections depicted inFIG. 10include one or more local area networks (LAN)1071and one or more wide area networks (WAN)1073, but may also include other networks. Such networking environments are commonplace in offices, enterprise-wide computer networks, intranets and the Internet.

When used in a LAN networking environment, the computer1010is connected to the LAN1071through a network interface or adapter1070. When used in a WAN networking environment, the computer1010typically includes a modem1072or other means for establishing communications over the WAN1073, such as the Internet. The modem1072, which may be internal or external, may be connected to the system bus1021via the user input interface1060or other appropriate mechanism. A wireless networking component1074such as comprising an interface and antenna may be coupled through a suitable device such as an access point or peer computer to a WAN or LAN. In a networked environment, program modules depicted relative to the computer1010, or portions thereof, may be stored in the remote memory storage device. By way of example, and not limitation,FIG. 10illustrates remote application programs1085as residing on memory device1081. It may be appreciated that the network connections shown are exemplary and other means of establishing a communications link between the computers may be used.

An auxiliary subsystem1099(e.g., for auxiliary display of content) may be connected via the user interface1060to allow data such as program content, system status and event notifications to be provided to the user, even if the main portions of the computer system are in a low power state. The auxiliary subsystem1099may be connected to the modem1072and/or network interface1070to allow communication between these systems while the main processing unit1020is in a low power state.

Conclusion