## 5 An Efficient Method for ETL (Extract-Transform-Load) in WR-Store  
In this section, we propose an ETL (Extract-Transform-Load) method to extract data stored in WR-Store and load them into the other key-value stores. Because WR-Store is based on the Windows registry, it is portable only if Windows operating systems are running. However, in the other environments without Windows operating systems, we need a method to migrate data in WR-Store into the other environments. The key-value store deals with data in a very simple form consisting of the key and value pair. However, WR-Store stores data in a multi-level structure based on the Windows registry as presented in Section 3.2. Thus, we need to investigate the method to extract data from the multi-level structure and to transform them into a form of the key-value pair. First, let us consider a straightforward method for the ETL process in WR-Store. It extracts data from the registry path for WR-Store into a file, and then, transforms the contents in the file into a form of the key-value pair, which we call _extract-then-transform (E-then-T)_. The E-then-T method depends on the built-in extract feature provided by the Windows registry. That is, if we execute a Window command \"regedit /E\", it will extract data stored in a specific registry path into a file. Figure 14 shows the details of data extracted from WR-Store storing a real data set, _ID-HashTag_. It represents the registry path in a multi-level, and each registry path contains the corresponding key and value pairs. Then, from this file, we can specify the key part and value part by parsing the contents based on the pattern matching method such as the regular expression. Figure 13: Throughput as the number of concurrently running processes \(p\) increases. (a) Read throughput; (b) Write throughput; (c) Delete throughput. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Process Name** & **The Number of Registry Operations** & **Portion** \\ \hline svchost.exe & 932,191 & 24.39\% \\ settingsynchost.exe & 667,275 & 17.46\% \\ mscorsww.exe & 365,202 & 9.56\% \\ tiworker.exe & 275,724 & 7.21\% \\ silhou.exe & 205,835 & 5.39\% \\ runtimebroker.exe & 180,807 & 4.73\% \\ exploree.exe & 177,815 & 4.65\% \\ ngen.exe & 147,814 & 3.87\% \\ msmpeng.exe & 130,601 & 3.42\% \\ backgroundtaskhost.exe & 125,047 & 3.27\% \\ \hline \hline \end{tabular}
\end{table} 
Table 9: The top-10 processes accessing to the registry. The E-then-T method requires two separate phases, and the second phase (i.e., transform) must be performed on the result of the first phase (i.e., extract). Thus, we need to design a more efficient ETL method that transforms data directly while extracting data, which we call _extract-and-transform (E-and-T)_. For the E-and-T method, we need to directly access to the Windows registry using the native APIs. Using those APIs, we can traverse the entire structure under a registry path that is storing data for WR-Store. Whenever we find the key and value during the traversal, we directly transform each one into a form of the key-value pair. Figure 15 shows the algorithm of the E-and-T method. First, it obtains the information for a given registry path to know the number of subkeys and the number of key and value pairs. If there are subkeys, we need to investigate each one of them by calling this algorithm recursively. Otherwise, we extract key and value pairs one by one. As a result, we can obtain the list of key and value pairs that have been stored in WR-Store. To show the performance of the proposed E-and-T method, we conduct some experiments. Figure 16 shows the performance analysis of two proposed ETL methods for WR-Store, i.e., E-then-T and E-and-T. Here, we use four real data sets and fix the number of continuous operations as 10 thousand. The elapsed time of the E-then-T method consists of two parts: (1) that of the extract process and (2) that of the transform process. We measure those parts separately to compare each one with the elapsed time of the E-and-T method.