# Flow-Based Programming for Machine Learning
## 7 Running Examples
### Use Case 2: Anomaly Detection with k-Means Clustering  
The second use case deals with the creation of an ML application involving k-means. The k-means algorithm partitions the data into several clusters. Anomaly detection is often used to detect fraud, unusual behaviour or attack in the network. The unsupervised learning techniques are suitable for these kinds of problems as they can learn the pattern. We have used the data set from KDD cup 1999. The data constitutes network packet data. The data contains 38 features, including a label column. We did not need the label data for applying k-means, and therefore we removed the same in the feature extraction module. The graphical flow to create the Spark k-means application is depicted in Figure 8. The example model parameters necessary to design the model are depicted in part 3A of Figure 8. The data for the use case contained String columns. We have removed those during the feature extraction phase as the k-means algorithm cannot process them. Additionally, the String columns would cause runtime errors, as VectorAssembler only supports numeric, boolean and vector types. The code for this operation is auto-generated when the user inputs the String column names in the feature extraction stage of the flow, as depicted in part 2A of Figure 8.  
The TrainModel component takes a range of K values. K is the number of clusters that the user wants to create from the input dataset. The system generates code to create k-means models for the range of the K values and stores the compute the cost for each k-means model evaluation in an array in ascending order. Compute cost is one of the ways to evaluate k-means clustering using Spark ML. If the end-user provides only one K value, the system generates only one code to generate one model. The output of the k-Means Spark application for automatic hyperparameter tuning is shown in part 5 of Figure 8. The figure indicates different K values and their corresponding model evaluation score. The goal of the hyperparameter tuning in the case of the k-means algorithm is to find the optimal K value for the given dataset. Listing 3 shows code generated by the back-end system for the graphical flow composed on the front-end.  
Figure 7: Graphical flow to create a decision tree model for forest cover prediction.  
```
publicstaticKMeansModelkMeansClustering(StringinitMode,intlowK,inthighK,intmaxIter,doubledistanceThreshold,intstep,Dataset+Row-oiosnsutcx){ Map<Integer,Double>degklfrhyb=newLinkedHashMap<Integer,Double>(); Map<Integer,KMeansModel>mneqxuuuuyr=newLinkedHashMap<Integer,KMeansModel>(); for(inititer=lowK;iter<=highK;iter+=step){ KMeanspifnmsysi=newKMeans().setFeaturesCol(\"features\").setK(iter).setInitMode(initMode).setMaxIter(maxIter).setTol(distanceThreshold).setSeed(newRandom().nextLong()); KMeansModelokyngwrk=pifnmsysi.fit(oiosnsutcx); //Evaluateclustering.Doubleuphyyccvqv=okhygwrk.computeCost(oiosnsutcx); degklfrhyb.put(iter,uyyccvqv); mmapxuuynh.put(iter,okvhgrwqrk); System.out.println(\"********inofSquaredErrors=\"+uyyyccvqv); } Mqp<Integer,Double>vqtfenii<=degklfrhyb.entrySet().stream().sorted(comparingByValue()).collect(tQnd(Map.Entry::getKey,Map.Entry::getValue,(e1,e2)->e2,LinkedHashMap::new)); Integerhwmwdbhd=vqtfenii.entrySet().stream().findFirst().getKey(); KMeansModelokyngwrk=mmapxuuynh.get(hwmwdbhdq); System.out.println(\"********inofOptimumK=\"+hwmwdbhdq); System.out.println(\"********inErrorwithOptimumK=\"+degklfrhyb.get(hwmwdbhdqd)); returnokvhgrwqrk; }
```  
Listing 3: Function generated for applying KMeans algorithm.