Query Log Compression for Workload Analytics

Ting XieUniversity at Buffalo, SUNY

tingxie@buffalo.edu

Varun ChandolaUniversity at Buffalo, SUNY

chandola@buffalo.edu

Oliver KennedyUniversity at Buffalo, SUNY

okennedy@buffalo.edu

ABSTRACTAnalyzing database access logs is a key part of performancetuning, intrusion detection, benchmark development, andmany other database administration tasks. Unfortunately,it is common for production databases to deal with mil-lions or even more queries each day, so these logs must besummarized before they can be used. Designing an ap-propriate summary encoding requires trading off betweenconciseness and information content. For example: simpleworkload sampling may miss rare, but high impact queries.In this paper, we present LogR, a lossy log compressionscheme suitable use for many automated log analytics tools,as well as for human inspection. We formalize and ana-lyze the space/fidelity trade-off in the context of a broaderfamily of “pattern” and “pattern mixture” log encodingsto which LogR belongs. We show through a series of ex-periments that LogR compressed encodings can be createdefficiently, come with provable information-theoretic boundson their accuracy, and outperform state-of-art log summa-rization strategies.

1. INTRODUCTIONAutomated analysis of database access logs is critical for

solving a wide range of problems, from database perfor-mance tuning [6], to compliance validation [11] and queryrecommendation [8]. For example, the Peloton self-tuningdatabase [36] searches for optimal configurations by repeat-edly simulating database performance on historical queriesdrawn from access logs. Unfortunately, query logs for pro-duction databases can grow to be extremely large — A re-cent study of queries at a major US bank for a period of19 hours found that the bank’s systems produced nearly 17million SQL queries and over 60 million stored procedure ex-ecution events [27]. Tracking only a sample of these queriesis not sufficient, as rare queries can disproportionately af-fect database performance, for example, if they are using anotherwise unused index.

We propose LogR, a lossy compression scheme for sum-marizing database query logs. The summarized log facili-tates efficient (both in terms of storage and time) approxi-mation of workload statistics. Hence applications like databasetuning optimizers and query recommendation systems thatneed to repeatedly compute statistics can benefit by com-pressing the log with LogR during a pre-processing step. Asan additional benefit, the summarized log is interpretableand can be used for human inspection.

By adjusting a tunable parameter in LogR, a user canchoose to obtain a summary that incurs a low loss of in-formation (high-fidelity) but is verbose, or obtain a morecompact summary (high-compression) that incurs a greaterloss of information. To manage the loss-rate, we develop aframework for reasoning about the trade-off between spaceand fidelity. While LogR does not admit closed-form so-lutions to classical information theoretical fidelity measureslike information loss, we propose an efficiently computable fi-delity measure called Reproduction Error. We show througha combination of analytical and experimental evidence thatReproduction Error is a meaningful measure of the qualityin LogR.

LogR-compressed data relies on a codebook based onstructural elements like SELECT items, FROM tables, or con-junctive WHERE clauses [1]. This codebook provides a bi-directional mapping from SQL queries to a bit-vector en-coding and back again. In effect, we treat the query log asa collection of feature-vectors, with each structural elementas one feature. The compression problem thus reduces toone of compactly encoding a collection of feature-vectors.

We further simplify this problem by observing that a com-mon theme in use cases like automated performance tuningor query recommendation is the need for predominantly ag-gregate workload statistics. Because such statistics do notdepend on the order of the query log, the compression prob-lem further reduces to compacting a bag of feature-vectors.

LogR works by identifying groups of co-occurring struc-tural elements that we call patterns. We define a familyof pattern encodings of access logs, which map patterns totheir frequencies in the log. For pattern encodings, we de-fine two idealized measures of fidelity: (1) Ambiguity, whichmeasures how much room the encoding leaves for interpre-tation; and (2) Deviation, which measures how reliably theencoding approximates the original log. Neither Ambiguitynor Deviation can be computed efficiently for pattern encod-ings. Hence we propose a third measure called ReproductionError that is efficiently computable and that closely tracksboth Ambiguity and Deviation.

1

In general, the size of the encoding is inversely relatedwith Reproduction Error: The more detailed the encoding,the more faithfully it represents the original log. Thus, logcompression may be defined as a search over the space ofpattern based encodings to identify the one that best tradesoff between these two properties. Unfortunately, searchingfor such an ideal encoding from the full space can be com-putationally expensive. To overcome this limitation, we re-duce the search space by first clustering entries in the logand then encoding each cluster separately, an approach thatwe call pattern mixture encoding. Finally we identify a sim-ple approach to encoding individual clusters that we callnaive mixture encodings, and show experimentally that itproduces results competitive with more powerful techniquesfor log compression and summarization.

Concretely, in this paper we make the following contribu-tions: (1) We define two families of compression for querylogs: pattern and pattern mixture, (2) We define Ambigu-ity and Deviation, two principled measures of the quality ofany pattern or pattern mixture encoding, (3) We define acomputationally efficient measure, Reproduction Error, anddemonstrate that it is a close approximation of Ambiguityand Deviation, (4) We propose a clustering-based approachto efficiently search for naive mixture encodings, and showhow these encodings can be further optimized, and, (5) Weexperimentally validate our approach and show that it pro-duces more precise encodings faster than several state-of-the-art pattern encoding algorithms.

2. PROBLEM DEFINITIONIn this section, we introduce and formally define the log

compression problem. We begin by exploring several appli-cations that need to repeatedly analyze query logs.

Index Selection. Selecting an appropriate set of indexesrequires trading off between update costs, access costs, andlimitations on available storage space. Existing strategies forselecting a (near-)optimal set of indexes typically repeatedlysimulate database performance under different combinationsof indexes, which in turn requires repeatedly estimating thefrequency with which specific predicates appear in the work-load. For example, if status = ? occurs in 90% of the queriesin a workload, a hash index on status is beneficial.

Materializing Views Selection. The results of joins orhighly selective selection predicates are good candidates formaterialization when they appear frequently in the work-load. Like index selection, view selection is a non-convexoptimization problem, typically requiring exploration by re-peated simulation, which in turn requires repeated frequencyestimation over the workload.

Online Database Monitoring. In production settings, itis common to monitor databases for atypical usage patternsthat could indicate a serious bug or security threat. Whenquery logs are monitored, it is often done retrospectively,some hours after-the-fact [27]. To support real-time moni-toring it is necessary to quickly compute the frequency of aparticular class of query in the system’s typical workload.

In each case, the application’s interactions with the logamount to counting queries that have specific features: se-lection predicates, joins, or similar.

2.1 Notation

Let L be a log, or a finite collection of queries q ∈ L. Wewrite f ∈ q to indicate that q has some feature f , such asa specific predicate or table in its FROM clause. We assume(1) that the universe of features in both a log and a queryis enumerable and finite, and (2) that a query is isomorphicto its feature set. We outline one approach to extractingfeatures that satisfies both assumptions below. We abusesyntax and write q to denote both the query itself, as wellas the set of its (relevant) features.

Let b denote some set of features f ∈ b, which we calla pattern. We write these sets using vector notation: b =(x1, . . . , xn) where n is the number of distinct features ap-pearing in the log and xi indicates the presence (absence)of ith feature with a 1 (resp., 0). For any two patterns b,b′, we say that b′ is contained in b if b′ ⊆ b. Equivalently,using vector notation b = (x1, . . . , xn), b′ = (x′1, . . . , x

′n):

b′ ⊆ b ≡ ∀i, x′i ≤ xiOur goal then is to be able to query logs for the number oftimes a pattern b appears:

| q | q ∈ L ∧ b ⊆ q |

2.2 Coding QueriesFor this paper, we specifically adopt the feature-extraction

conventions of a query summarization scheme by Aligon etal. [1]. In this scheme, each feature is one of the follow-ing three query elements: (1) a table or sub-query in theFROM clause, (2) a column in the SELECT clause, and (3) aconjunctive clause of the WHERE clause.

Example 1. Consider the following example query.

SELECT _id , sms_type , _time FROM MessagesWHERE status = 1 AND transport_type = 3

This query uses 6 features: 〈 sms_type, SELECT 〉, 〈 _id, SELECT 〉,〈 _time, SELECT 〉, 〈 Messages, FROM 〉, 〈 status = 1, WHERE 〉,and 〈 transport_type = 3, WHERE 〉

Although this scheme is simple and limited to conjunctivequeries (or queries with a conjunctive equivalent), it fulfillsboth assumptions we make on feature extraction schemes.The features of a query (and consequently a log) are enumer-able and finite, and the feature set of the query is isomorphic(modulo commutativity and column order) to the originalquery. Furthermore, even if a query is not itself conjunc-tive, it often has a conjunctive equivalent. We quantify thisstatement with Table 1, which provides two relevant datapoints from production query logs; In both cases, all loggedqueries can be rewritten into equivalent queries compatiblewith the Aligon scheme.

Although we do not explore more advanced feature encod-ing schemes in detail here, we direct the interested readerto work on query summarization [30, 2, 27]. For example, ascheme by Makiyama et. al. [30] also captures aggregation-related features like group-by columns, while an approach byKul et. al. [27] encodes partial tree-structures in the query.

2.3 Log CompressionAs a lossy form of compression, LogR only approximates

the information content of a query log. We next developa simplified form of LogR that we call pattern-based com-pression, and develop a framework for reasoning about thefidelity of a LogR-compressed log. As a basis for this frame-work, we first reframe the information content of a query log

2

SELECT sms type, external ids, time, idFROM messages

WHERE (sms type=1) ∧ (sms type=0) ∧ (status=1)

(a) Correlation-ignorant : Features are highlighted independently

SELECT sms type FROM messages WHERE sms type=1

SELECT sms type FROM messages WHERE status=1

(b) Correlation-aware: Pattern groups are highlighted together.

Figure 1: Example Encoding Visualizations

to allow us to adapt classical information-theoretical mea-sures of information content.

2.3.1 Information Content of LogsWe define the information content of the log as a distri-

bution p(Q | L) of queries Q drawn uniformly from the log.

Example 2. Consider the following query log, which con-sists of four conjunctive queries.

1. SELECT _id FROM Messages WHERE status = 12. SELECT _time FROM Messages

WHERE status = 1 AND sms_type = 13. SELECT _id FROM Messages WHERE status = 14. SELECT sms_type , _time FROM Messages

WHERE sms_type = 1

Drawing uniformly from the log, each entry will appear withprobability 1

4= 0.25. The query q1 (= q3) occurs twice, so

the probability of drawing it is double that of the others (i.e.,p(q1 | L) = p(q3 | L) = 2

4= 0.5)

Treating a query as a vector of its component features,we can define a query q = (x1, . . . , xn) to be an obser-vation of the multivariate distribution over variables Q =(X1, . . . , Xn) corresponding to features. The event Xi = 1occurs if feature i appears in a query uniformly drawn fromthe log.

Example 3. Continuing, the universe of features for thisquery log is (1) 〈 _id, SELECT 〉, (2) 〈 _time, SELECT 〉,(3) 〈 sms_type, SELECT 〉, (4) 〈 status = 1, WHERE 〉,(5) 〈 sms_type = 1, WHERE 〉, and (6) 〈 Messages, FROM 〉. Ac-cordingly, the queries can be encoded as feature vectors, withfields counting each feature’s occurrences: q1 = 〈 1, 0, 0, 1, 0, 1 〉,q2 = 〈 0, 1, 0, 1, 1, 1 〉, q3 = 〈 1, 0, 0, 1, 0, 1 〉, q4 = 〈 0, 1, 1, 0, 1, 1 〉

Patterns. Our target applications require us to count thenumber of times features (co-)occur in a query. For example,materialized view selection requires counting tables used to-gether in queries. Motivated by this observation, we beginby defining a broad class of pattern based encodings that di-rectly encode co-occurrence probabilities. A pattern is anarbitrary set of features b = (x1, . . . , xn) that may co-occurtogether. Each pattern captures a piece of information fromthe distribution p(Q | L). In particular, we are interested inthe probability of uniformly drawing a query q from the logthat contains the pattern b (i.e., q ⊇ b):

p(Q ⊇ b | L) =∑

q∈L∧q⊇b p(q | L)

When it is clear from context, we abuse notation and writep(·) instead of p(· | L). Recall that p(Q) can be repre-sented as a joint distribution over variables (X1, . . . , Xn)and probability p(Q ⊇ b) is thus equivalent to the marginalprobability or simply marginal p(X1 ≥ x1, . . . , Xn ≥ xn).

Pattern-Based Encodings. Denote by Emax : Nn →[0, 1], the mapping from the space of all possible patternsb ∈ Nn to their marginals. A pattern based encoding E is anysuch partial mapping E ⊆ Emax. We denote the marginal ofpattern b in encoding EL by EL[b] (= p(Q ⊇ b | L)). Whenit is clear from context, we abuse syntax and also use E todenote the set of patterns it maps (i.e., domain(E)). Hence,|E| is the number of mapped patterns, which we call the en-coding’s Verbosity. A pattern based encoder is any algorithmencode(L, ε) 7→ E whose input is a log L and whose outputis a set of patterns E , with Verbosity thresholded at someinteger ε. Many pattern mining algorithms [12, 31] can beused for this purpose.

2.3.2 Communicating Information ContentA side-benefit of pattern based encodings is that they are

interpretable: patterns and their marginals can be used forhuman analysis of the log. Figure 1 shows two examples.The approach illustrated in Figure 1a uses shading to showeach feature’s frequency in the log, and communicates fre-quently occurring constraints or attributes. This approachmight, for example, help a human to manually select in-dexes. A second approach illustrated in Figure 1b conveyscorrelations, showing the frequency of entire patterns.

3. INFORMATION LOSSOur goal is to encode the distribution p(Q) as a set of

patterns: obtaining a less verbose encoding (i.e., with fewerpatterns), while also ensuring that the encoding capturesp(Q) without information loss. We will start by defininginformation loss for pattern based encodings and generalizethe definition to probabilistic models.

3.1 Lossless SummariesTo establish a baseline for measuring information loss, we

begin with the extreme cases. At one extreme, an emptyencoding (|E| = 0) conveys no information. At the other ex-treme, we have the encoding Emax which is the full mappingfrom all patterns. Having this encoding is a sufficient con-dition to exactly reconstruct the original distribution p(Q).

Proposition 1. For any query q = (x1, . . . , xn) ∈ Nn,the probability of drawing exactly q at random from the log(i.e., p(X1 = x1, . . . , Xn = xn)) is computable, given Emax.

3.2 Lossy SummariesAlthough lossless, Emax is also verbose. Hence, we will

focus on lossy encodings that can be less verbose. A lossyencoding E ⊂ Emax may not be able to precisely identifythe distribution p(Q), but can still be used to approximatethe distribution. We characterize the information content ofa lossy encoding E by defining a space (denoted by ΩE) ofdistributions ρ ∈ ΩE allowed by an encoding E . This space isdefined by constraints as follows: First, we have the generalproperties of probability distributions:

∀q ∈ Nn : ρ(q) ≥ 0∑

q∈Nn ρ(q) = 1

Each pattern b in the encoding E constraints the marginalprobability over its component features:

∀b ∈ domain(E) : E [b] =∑

q⊇bρ(q)

Note that the dual constraints 1 − E [b] =∑

q6⊇b ρ(q) are

redundant under constraint∑

q∈Nn ρ(q) = 1.

3

The resulting space ΩE is the set of all query logs, orequivalently the set of all possible distributions of queries,that obey these constraints. From the outside observer’sperspective, the distribution ρ ∈ ΩE that the encoding con-veys is ambiguous: We model this ambiguity with a ran-dom variable PE with support ΩE . The true distributionp(Q) derived from the query log must appear in ΩE , denotedp(Q) ≡ ρ∗ ∈ ΩE (i.e., p(PE = ρ∗) > 0). Of the remainingdistributions ρ admitted by ΩE , it is possible that some aremore likely than others. For example, a query containing acolumn (e.g., status) is only valid if it also references a tablethat contains the column (e.g., Messages). This prior knowl-edge may be modeled as a prior on the distribution of PEor by an additional constraint. However, for the purposes ofthis paper, we take the uninformed prior by assuming thatPE is uniformly distributed over ΩE :

p(PE = ρ) =

1|ΩE |

if ρ ∈ ΩE

0 otherwise

Naive Encodings. One specific family of lossy encodingsthat treats each feature as being independent (e.g., as inFigure 1a) is of particular interest to us. We call this familynaive encodings, and return to it throughout the rest of thepaper. A naive encoding is composed of all patterns thathave exactly one feature and a non-zero marginal.

b = (0, . . . , 0, xi, 0, . . . , 0) | i ∈ [1, n], xi = 1

3.3 Idealized Information Loss MeasuresBased on the space of distributions constrained by the

encoding, the information loss of a encoding can be consid-ered from two related, but subtly distinct perspectives: (1)Ambiguity measures how much room the encoding leavesfor interpretation, (2) Deviation measures how reliably theencoding approximates the target distribution p(Q).

Ambiguity. We define the Ambiguity I(E) of an encodingas the entropy of the random variable PE . The higher theentropy, the less precisely E identifies any specific distribu-tion.

I(E) =∑ρ

p(PE = ρ) log (p(PE = ρ))

Deviation. The deviation from any permitted distribu-tion ρ to the true distribution ρ∗ can be measured by theKullback-Leibler (K-L) divergence [28] (denote asDKL(ρ∗||ρ)).We define Deviation d(E) of a encoding as the expectationof the K-L divergence over all permitted ρ ∈ ΩE :

d(E) = EPE [DKL(ρ∗||PE)] =∑ρ∈ΩE

p(PE = ρ) · DKL(ρ∗||ρ)

Limitations. There are two limitations to these idealizedmeasures in practice. First, K-L divergence is not definedfrom any probability measure ρ∗ that is not absolutely con-tinuous with respect to a second (denoted ρ∗ ρ). Second,neither Deviation nor Ambiguity has a closed-form formula.

4. PRACTICAL LOSS MEASUREComputing either Ambiguity or Deviation requires enu-

merating the entire space of possible distributions, or anapproximation. One approach to estimating either measureis to repeatedly sample from, rather than enumerate the

space. However accurate measures require a large numberof samples, rendering this approach similarly infeasible. Inthis section, we propose a faster approach to assessing thefidelity of a pattern encoding. We select a single represen-tative distribution ρE from the space ΩE , and use ρE toapproximate both Ambiguity and Deviation.

4.1 Reproduction ErrorMaximum Entropy Distribution. Inspired by the prin-ciple of maximum entropy [21], we select a single distin-guished representative distribution ρE from the space ΩE :

ρE = arg minρ∈ΩE

−H(ρ) where H(ρ) =∑q∈Nn

−ρ(q) log ρ(q)

Maximizing an objective function belonging to the expo-nential family (entropy in our case) under a mixture of lin-ear equalities/inequality constraints is a convex optimizationproblem [5] which guarantees a unique solution and can beefficiently solved [10], using the cvx toolkit [17, 33], and/orsubdividing the problem by grouping variables of q ∈ Nninto equivalence classes. For naive encodings specifically,we can assume independence across word occurrences Xi.Under this assumption, ρE has a closed-form solution:

ρE(q) =∏i

p(Xi = xi) where q = (x1, . . . , xn) (1)

Reproduction Error. Using the representative distribu-tion ρE , we define Reproduction Error e(E) as the entropydifference between the representative and true distributions:

e(E) = H(ρE)−H(ρ∗) where ρE = arg minρ∈ΩE

−H(ρ)

Relationship to K-L Divergence. Reproduction Erroris closely related to the K-L divergence from the represen-tative distribution ρE to the true distribution ρ∗.

DKL(ρ∗||ρE) = H(ρ∗, ρE)−H(ρ∗)

where H(ρ∗, ρE) =∑q

−ρ∗(q) log ρE(q)

H(ρ∗, ρE) is called the cross-entropy. Replacing cross-entropyby entropy H(ρE), the formula becomes the same as Repro-duction Error. Though cross entropy is different from en-tropy in general, e.g., it is only defined when ρ∗ ρE , theyare closely correlated. However, for the specific case of naiveencodings the two are equivalent.

Lemma 1. For any naive encoding E, H(ρ∗, ρE) = H(ρE)

Proof. With q = (x1, . . . , xn) and applying Equation 1:∑q∈L−ρ∗(q) log ρE(q) = −

∑q

p(q) ·∑i

log p(Xi = xi)

= −∑i,k

log p(Xi = k) ·∑

q | xi=kp(q)

= −∑i,k

log p(Xi = k) · p(Xi = k)

=∑i

H(Xi)

The variables in a naive encoding are independent, so:∑iH(Xi) = H(ρE), and we have the lemma.

While we do not provide a similar proof for more generalencodings, we show it experimentally in Section 7.3.

4

4.2 Practical vs Idealized Information LossIn this section we prove that Reproduction Error closely

parallels Ambiguity. We define a partial order lattice overencodings and show that for any pair of encodings on whichthe partial order is defined, a like relationship is implied forboth Reproduction Error and Ambiguity. We supplementthe proofs given in this section with an empirical analysisrelating Reproduction Error to Deviation in Section 7.3.

Containment. We define a partial order over encodings≤Ω based on containment of their induced spaces ΩE :

E1 ≤Ω E2 ≡ ΩE1 ⊆ ΩE2

That is, one encoding (i.e., E1) precedes another (i.e., E2)when all distributions admitted by the former encoding arealso admitted by the latter.

Containment Captures Reproduction Error. We firstprove that the total order given by Reproduction Error is asuperset of the partial order ≤Ω.

Lemma 2. For any two encodings E1, E2 with induced spacesΩE1 ,ΩE2 and maximum entropy distributions ρE1 , ρE2 it holdsthat E1 ≤Ω E2 → e(E1) ≤ e(E2).

Proof. Firstly ΩE2 ⊇ ΩE1 → ρE1 ∈ ΩE2 . Since ρE2 hasthe maximum entropy among all distributions ρ ∈ ΩE2 , wehave H(ρE1) ≤ H(ρE2) ≡ e(E1) ≤ e(E2).

Containment Captures Ambiguity. Next, we showthat the partial order based on containment implies a likerelationship between Ambiguities of pairs of encodings.

Lemma 3. Given encodings E1, E2 with uninformed prioron PE1 ,PE2 , it holds that E1 ≤Ω E2 → I(E1) ≤ I(E2).

Proof. Given an uninformed prior: I(E) = log |ΩE |. HenceE1 ≤Ω E2 → |ΩE1 | ≤ |ΩE2 | → I(E1) ≤ I(E2)

5. PATTERN MIXTURE ENCODINGSThus far we have defined the problem of log compression,

treating the query log as a single joint distribution p(Q)that captures the frequency of feature occurrence and/orco-occurrence. Patterns capture positive information aboutcorrelations. However in cases like logs of mixed workloads,there are also many cases of anti-correlation between fea-tures. For example, consider a log that includes queriesdrawn from two workloads with disjoint feature sets. Pat-terns with features from both workloads never actually oc-cur in the log. However, unless explicitly defined otherwise,many such patterns will have non-zero marginals. Consis-tently excluding anti-correlations, in general, requires addingmany patterns to the encoding.

In this section, we explore an alternative to capturing cor-relation and anti-correlation with a single set of patterns.Instead, we propose a generalization of pattern encodingswhere the log is modeled not as a single probability distribu-tion, but rather as a mixture of several simpler distributions.The resulting encoding is likewise a mixture: Each compo-nent of the mixture of distributions is stored independently.Hence, we refer to it as a pattern mixture encoding, and itforms the basis of LogR compression.

To start, we explore a simplified form of the problem,where we only mix naive pattern encodings. We refer tothe resulting scheme as naive mixture encodings, and giveexamples of the encoding, as well as potential visualizations

in Section 5.1. Using naive mixture encodings as an ex-ample, we generalize Reproduction Error and Verbosity forpattern mixture encodings in Section 5.2. With generalizedencoding evaluation measures, we then evaluate several en-coding strategies based on different clustering methods forcreating naive mixture encodings. Finally, in Section 6.4, wediscuss strategies for refining naive mixture encodings intomore precise, general mixture encodings.

5.1 Example: Naive Mixture EncodingsConsider a toy query log with only 3 conjunctive queries.

1. SELECT id FROM Messages WHERE status = 1

2. SELECT id FROM Messages

3. SELECT sms_type FROM Messages

The vocabulary of this log consists of 4 features: 〈 id, SELECT 〉,〈 sms_type, SELECT 〉, 〈 Messages, FROM 〉, and 〈 status = 1, WHERE 〉.Re-encoding the three queries as vectors, we get:

1. 〈 1, 0, 1, 1 〉 2. 〈 1, 0, 1, 0 〉 3. 〈 0, 1, 1, 0 〉

A naive encoding of this log can be expressed as:⟨2

3,

1

3, 1,

1

3

⟩This encoding captures that all queries in the log pertain tothe Messages table, but obscures the relationship betweenthe remaining features. For example, this encoding obscuresthe anti-correlation between id and sms_type. Similarly, theencoding hides the association between status = 1 and id.Such relationships are critical for evaluating the effectivenessof views or indexes.

Example 4. The maximal entropy distribution for a naiveencoding assumes that features are independent. Assumingindependence, the probability of query 1 from the log is:

p(id) · p(¬sms type) · p(Messages) · p(status=1) =4

27≈ 0.148

This is a significant difference from true probability of thisquery (i.e., 1

3). Conversely queries not in the log, such as

the following, would be assumed to have non-zero probability.

SELECT sms_type FROM Messages WHERE status = 1

p(¬id) · p(sms type) · p(Messages) · p(status=1) =1

27≈ 0.037

To achieve a more faithful representation of the originallog, we could partition it into two components, with thecorresponding encoding parameters:

Partition 1 (L1) Partition 2 (L2)

(1, 0, 1, 1) (1, 0, 1, 0) (0, 1, 1, 0)↓ ↓ ↓⟨

1, 0, 1, 12

⟩〈 0, 1, 1, 0 〉

The resulting encoding only has one non-integral proba-bility: p(status = 1 | L1) = 0.5. Although there are nowtwo encodings, the encodings are not ambiguous. The fea-ture status = 1 appears in exactly half of the log entries,and is indeed independent of the other features. All otherattributes in each encoding appear in all queries in theirrespective partitions. Furthermore, the maximum entropydistribution induced by each encoding is exactly the distri-bution of queries in the compressed log. Hence, the Repro-duction Error is zero for both of the two encodings.

5

5.2 Generalized Encoding FidelityWe next generalize our definitions of Reproduction Error

and Verbosity from pattern to pattern mixture encodings.Suppose query log L has been partitioned into K clusterswith Li, Si, ρSi

and ρ∗i (where i ∈ [1,K]) representing thelog of queries, encoding, maximum entropy distribution andtrue distribution (respectively) for ith cluster. First, ob-serve that the distribution for the whole log (i.e., ρ∗) is thesum of distributions for each partition (i.e., ρ∗i ) weighted by

proportion of queries (i.e., |Li||L| ) in the partition.

ρ∗(q) =∑

i=1,...,K

wi · ρ∗i (q) where wi =|Li||L|

Generalized Reproduction Error. Similarly, the max-imum entropy distribution ρS for the whole log can be ob-tained as

ρS(q) =∑

i=1,...,K

wi ∗ ρSi(q)

We define the Generalized Reproduction Error of a patternmixture encoding similarly, as the weighted sum of the errorsfor each partition:

H(ρS)−H(ρ∗) =∑i

wi ·H(ρSi)−

∑i

wi ·H(ρ∗i ) =∑i

wi · e(Si)

As in the base case, a pattern mixture encoding with lowgeneralized Reproduction Error indicates a high-fidelity rep-resentation of the original log. A process can infer the prob-ability of any query p(Q = q | L) drawn from the originaldistribution, simply by inferring its probability drawn fromeach cluster i (i.e., p(Q = q | Li)) and taking a weightedaverage over all inferences. When it is clear from context,we refer to generalized Reproduction Error simply as Errorin the rest of this paper.

Generalized Verbosity. Verbosity can be generalized tomixture encodings in two ways. First we could measure theTotal Verbosity (

∑i |Si|), or the total size of the encoded

representation. This approach is ideal for our target ap-plications, where our aim is to reduce the representationalsize of the query log. As an alternative, we could expressthe complexity of the encoding by computing the AverageVerbosity (

∑i wi · |Si|), which measures the expected size

of each cluster. The latter measure is specifically useful incases where LogR encodings are presented for human con-sumption, as lower average verbosity encodings are simpler.

6. PATTERN MIXTURE COMPRESSIONWe are now ready to describe the LogR compression

scheme. Broadly, LogR attempts to identify a pattern mix-ture encoding that optimizes for some target trade-off be-tween Total Verbosity and Error. A naive — though im-practical — approach to finding such an encoding would beto search the entire space of possible pattern mixture en-codings. Instead, LogR approximates the same outcomeby identifying the naive pattern mixture encoding that isclosest to optimal for the desired trade-off. As we show ex-perimentally, the naive mixture summary produced by thefirst stage is competitive with more complicated, slower tech-niques for summarizing query logs. We also explore a hypo-thetical second stage, where LogR refines the naive mixtureencoding to further reduce error. The outcome of this hypo-thetical stage has a slightly lower Error and Verbosity, butdoes not admit efficient computation of database statistics.

6.1 Constructing Naive Mixture EncodingsLogR compression searches for a naive mixture summary

that best optimizes for a requested tradeoff between TotalVerbosity and Error. As a way to make this search efficient,we observe that a log (or log partition) uniquely determinesits naive mixture encoding. Thus the problem of search-ing for a naive mixture encoding reduces to the problem ofsearching for the corresponding log partitioning.

We further observe that the Error of a naive mixture en-coding is proportional to the diversity of the queries in thelog being encoded; The more uniform the log (or partition),the lower the corresponding error. Hence, the partitioningproblem further reduces to the problem of clustering queriesin the log by feature overlap.

To identify a suitable clustering scheme, we next eval-uate four commonly used partitioning/clustering methods:(1) KMeans [20] with Euclidean distance (i.e., l2-norm) andSpectral Clustering [24] with (2) Manhattan (i.e., l1-norm),(3) Minkowski (i.e., lp-norm) with p = 4, and (4) Hamming

( Count(x6=y)Count(x 6=y)+Count(x=y)

) distances1. Specifically, we evalu-

ate these four strategies with respect to their ability to createnaive mixture encodings with low Error and low Verbosity.

Experiment Setup. Spectral and KMeans clustering al-gorithms are implemented by sklearn [37] in Python. Wegradually increaseK (i.e., the number of clusters) configuredfor selected clustering algorithm that simulates the processof continuously sub-clustering the log, tolerating higher To-tal Verbosity for lower Error. To compare clustering meth-ods fairly, we reduce randomness in clustering (e.g., randominitialization in KMeans) by running each of them 10 timesfor each K and averaging Error of resulting encodings. Weused two datasets: “US Bank” and “PocketData.” We de-scribe both datsets in detail in Section 7.1 and the datapreparation process in Section 7.2. All results for our clus-tering experiments are shown in Figure 2.

6.1.1 ClusteringIn this section, we show that (1) Clustering is an effec-

tive way to consistently reduce Error, and that (2) Classicalclustering methods differ in at least one of Error, Verbosity,and/or runtime.

Adding more clusters reduces Error. Figure 2a com-pares the relationship between the number of clusters (x-axis) and Error (y-axis), showing the varying rates of con-vergence to zero Error for each clustering method. We ob-serve that adding more clusters consistently reduces Errorfor both data sets, regardless of clustering method and dis-tance measures. We note that the US Bank dataset is signif-icantly more diverse than the PocketData dataset, with re-spect to the total number of features (See Table 1) and thatmore than 30 clusters may be required for reaching near-zeroError. In general, Manhattan distance is not competitive asothers for both datasets and Hamming distance convergesfaster than other methods on PocketData. Minkowski dis-tance shows faster convergence rate than Hamming within14 clusters on US bank dataset. However, it is also the onlyone that shows consistently increasing trend on Error whenthe number of clusters exceeds 22 for both datasets. This

1We also evaluated Spectral Clustering with Euclidean,Chebyshev and Canberra distances; These did not performbetter and we omit them in the interest of conciseness.

6

is because lp-norm is more aggressive in distinguishing be-tween vectors as p grows (i.e., l4 vs l2) and since US bankdataset is more diverse, Minkowski helps by separating thehighly mixed workloads aggressively. But it begin to breakdown when the data is already well-organized (e.g., beingpartitioned into more than 22 clusters).

Adding more clusters increases Total Verbosity. Fig-ure 2b compares the relationship between the number ofclusters (x-axis) and Total Verbosity (y-axis). We observethat Total Verbosity increases with the number of clusters.This is because when a partition is split, features commonto both partitions each increase the Total Verbosity by 1.

Hierarchical Clustering. Classical clustering methodsproduce non-monotonic cluster assignments. That is, Er-ror/Total Verbosity can actually grow/shrink with more clus-ters, as seen in Figure 2a and 2b. Notably, a class of clus-tering approaches called hierarchical clustering [22] does cre-ate monotonic assignments, and can offer more flexible con-trol on deciding which cluster to further explore, by sub-clustering and constructing naive encodings with lower Re-production Error on sub-clusters.

Error v. Average Verbosity. We observe from Fig-ure 2c that Average Verbosity (x-axis) positively correlateswith Error (y-axis). By comparing Figure 2a with 2c, wealso observe that the clustering method that achieves lowerError also has lower Average Verbosity. Recall that AverageVerbosity is the weighted sum of the number of distinct fea-tures in each cluster for naive mixture encodings. Misplacingqueries with less overlap in features (i.e., less similar) intothe same cluster increases its number of distinct features,and Average Verbosity measures the weighted average de-gree of such misplacement over all clusters.

Running Time Comparison. The total running time(y-axis) in Figure 2d is measured in seconds and includesboth distance matrix computation time (if any) and cluster-ing running time. Since the total running time of KMeans issignificantly lower than that of Spectral Clustering, we loga-rithmically scaled Y-axis. In addition, the figure shows thatHamming distance is also the winner among other distanceswith respect to running time.

Take-Aways. Under Spectral Clustering, Hamming dis-tance helps to construct naive mixture encodings faster andof lower Error than other distance measures. Additionally,in cases where it may be necessary to dynamically vary theaccuracy (e.g., log visualizations), KMeans or its variants(e.g., KMedoids [35]) with customized distance measures(e.g., Hamming) are more effective, since KMeans is ordersof magnitude faster than Spectral Clustering.

6.2 Approximating Log StatisticsRecall that our primary goal is estimating statistics about

the log. In particular, we are interested in counting thenumber of occurrences (i.e., marginal) of a particular patternb in the log:

Γb(L) = | q | q ∈ L ∧ b ⊆ q |

Recall that a naive encoding EL of the log carries only pat-terns with only single feature present. In the absence ofa prior over the space of encodings allowed by EL — thatis, assuming a uniform distribution over log distributionsallowed by this encoding — the expected log distribution

is the maximal entropy distribution ρEL introduced in Sec-tion 4.1. Hence, the expectation of Γb(L) is computed bymultiplying the probability of the feature occurring by thesize of the log: |L| · ρEL, or:

E[ Γb(L) | EL ] = |L| ·

∏f∈E where f⊆b

E [f ]

This process trivially generalizes to naive pattern mixture

encodings by mixing distributions. Specifically, given a setof partitions L1 ∪ . . . ∪ LK = L, the expected counts foreach individual partition Li may be computed based on thepartition’s encoding Ei

E[ Γb(Li) | E1, . . . , EK ] =∑

i∈[1,K]

E[ Γb(Li) | Ei ]

6.3 Pattern Synthesis & Marginal EstimationIn this section, we empirically verify the effectiveness of

naive mixture encoding in approximating log statistics fromtwo related perspectives. The first perspective focuses onsynthesis error. It measures whether patterns synthesizedby naive mixture encoding actually exist in the log. Fromthe second perspective, we would like to further investigatemarginal deviation. It measures whether naive mixture en-coding gives correct marginal values to patterns that onemay query for. Specifically, synthesis error is measured as1 − M

Nwhere N is the total number of randomly synthe-

sized patterns and M is the number of synthesized patternswith positive marginals in the log. Marginal deviation is

measured as |ESTM−TM|TM

where TM is true marginal of apattern and ESTM is the one estimated by naive mixtureencoding.

We then set up experiments and empirically show thatboth synthesis error and marginal deviation consistently de-creases with lower Reproduction Error. Unless explicitlyspecified, we adopt the same experiment settings as Sec-tion 6.1.1 and experiment results are shown in Figure 3.

Figure 3a shows synthesis error (y-axis) versus Reproduc-tion Error (x-axis). The figure is generated by randomlysynthesizing N = 10000 patterns from each partition of thelog. Different values of N are tested and they show similarresult. Similar to Section 6.1.1, we gradually increase thenumber of clusters to reduce Reproduction Error. Synthe-sis error is then measured on each partition and the finalsynthesis error is the average over all partitions weighted byproportion of queries in the partition.

Figure 3b shows marginal deviation (y-axis) versus Re-production Error (x-axis). It is not possible to enumerateall patterns that exist in the data. As an alternative, wetreat each distinct query in the log as a pattern and measuremarginal deviation only on distinct queries. This is becausewe observe that marginal deviation tends to be smaller ifit is measured on a pattern that is contained in the otherone. Hence marginal deviation measured on an query is theupper bound of those measured on all possible patterns thatthis query contains. To measure marginal deviation for eachpartition, we enumerate all of its distinct queries and takean equally weighted average2. The final marginal deviationfor the whole log is an weighted average similar to that ofsynthesis error.

2Both frequent and infrequent patterns are treated equally.

7

(a) Error v. Number of Clusters (Left: PocketData, Right: US Bank)

(b) Total Verbosity v. Number of Clusters (Left: PocketData, Right: US Bank); We offset Y-axis by Verbosity ofthe naive encoding without clustering (i.e., the total number of distinct features in the log) to show the change.

(c) Error v. Expectation of Verbosity (Left: PocketData, Right: US Bank)

(d) Running Time v. Number of Clusters (Left: PocketData, Right: US Bank)

Figure 2: Distance Measure Comparison

0 10 20 30 40 50Reproduction Error

0

0.5

1

Synt

hesi

s Er

ror

bank datapocket data

(a) Synthesis Error v. Reproduction Error

0 10 20 30 40 50Reproduction Error

0

0.5

1

Mar

gina

l Dev

iatio

n

bank datapocket data

(b) Marginal Deviation v. Reproduction Error

Figure 3: Effectiveness of Naive Mixture Encoding

6.4 Naive Encoding RefinementNaive mixture encodings can already achieve close to near-

zero Error (Figure 2a), have low Verbosity, and admit effi-ciently computable log statistics Γb(L). Although doing so

makes estimating statistics more computationally expensive,as a thought experiment, we next consider how much of animprovement we could achieve in the Error/Verbosity trade-off by exploring a hypothetical second stage that enriches

8

naive mixture encodings by adding non-naive patterns.

Feature-Correlation Refinement. The first challengewe need to address is that our closed-form formula for Re-production Error only works for naive summaries. Hence,we first consider the simpler problem of identifying the in-dividual pattern that most reduces the Reproduction Errorof a naive summary.

Recall that for the Reproduction Error of a naive encod-ing has the closed-form representation by assuming indepen-dence among features (i.e., ρS(Q = q) =

∏i p(Xi = xi)).

Similarly, under naive encodings we have a closed-form esti-mation of marginals p(Q ⊇ b) (i.e., ρS(Q ⊇ b) =

∏i p(Xi ≥

xi)). We define the feature-correlation of pattern b as thelog-difference from its actual marginal to the estimation, ac-cording to naive encoding.

WC(b, S) = log (p(Q ⊇ b))− log (ρS(Q ⊇ b))

Intuitively, patterns with higher feature correlations createhigher Errors, which in turn makes them ideal candidates foraddition to the compressed log encoding. For two patternswith the same feature-correlation, the one that occurs morefrequently will have the greatest impact on Error [19]. Asa result, we compute an overall score for ranking patternsinvolving feature-correlation:

corr rank(b) = p(Q ⊇ b) ·WC(b, S)

We show in Section 7.3 that corr rank closely correlateswith Reproduction Error. That is, a higher corr rank valueindicates that a pattern produces a greater ReproductionError reduction if introduced into the naive encoding.

Pattern Diversification. This greedy approach only al-lows us to add a single pattern to each cluster. In general,we would like to identify a set of patterns to add to eachcluster. We cannot sum up corr rank of each pattern inthe set to estimate its Reproduction Error, because partialinformation content carried by patterns may overlap. Tocounter such overlap, or equivalently to diversify patterns,inevitably we will need to search through the space of com-binatorially large number of candidate pattern sets. Thesearch process can be time-consuming even using heuristics.In other words, the potential Reproduction Error reductionby plugging-in state-of-the-art pattern mining algorithmsmay come with burden on computation efficiency. We ex-perimentally analyze cases where naive mixture encodingsare kept intact, refined or replaced by patterns mined fromthem in Section 7.4.

7. EXPERIMENTSIn this section, we design experiments to empirically (1) val-

idate that Reproduction Error correlates with Deviation and(2) evaluate the effectiveness of LogR compression.

7.1 Data SetsWe use two specific datasets in the experiment: (1) SQL

query logs of the Google+ Android app extracted from thePocketData public dataset [25] and (2) SQL query logs thatcapture all query activity on the majority of databases at amajor US bank over a period of approximately 19 hours. Asummary of these two datasets is given in Table 1.

The PocketData-Google+ query log. The dataset con-sists of SQL logs that capture all database activities of 11Android phones. We selected Google+ application for our

Table 1: Summary of Data sets

Statistics PocketData US bank

# Queries 629582 1244243

# Distinct queries 605 188184

# Distinct queries (w/o const) 605 1712

# Distinct conjunctive queries 135 1494

# Distinct re-writable queries 605 1712

Max query multiplicity 48651 208742

# Distinct features 863 144708

# Distinct features (w/o const) 863 5290

Average features per query 14.78 16.56

study since it is one of the few applications where all userscreated a workload. This dataset can be characterized as astable workload of exclusively machine-generated queries.

The US bank query log. These logs are anonymizedby replacing all constants with hash values generated bySHA-256, and manually vetted for safety. Of the nearly73 million database operations captured, 58 million are notdirectly queries, but rather invocations of stored proceduresand 13 million not able to be parsed by standard SQL parser.Among the rest of the 2.3 million parsed SQL queries, sincewe are focusing on conjunctive queries, we base our analysison the 1.25 million valid SELECT queries. This dataset canbe characterized as a diverse workload of both machine- andhuman-generated queries.

7.2 Common Experiment SettingsExperiments were performed on operating system macOS

Sierra with 2.8 GHz Intel Core i7 CPU, 16 GB 1600 MHzDDR3 memory and a SSD.

Constant Removal. A number of queries in US Bankdiffer only in hard-coded constant values. Table 1 showsthe total number of queries, as well as the number of dis-tinct queries if we ignore constants. By comparison, queriesin PocketData all use JDBC parameters. For these experi-ments, we ignore constant values in queries.

Query Regularization. We apply query rewrite rules(similar to [7]) to regularize queries into equivalent conjunc-tive forms, where possible. Table 1 shows that 135

605and 1494

1712of distinct queries are in conjunctive form for PocketDataand US bank respectively. After regularization, all queriesin both data sets can be either simplified into conjunctivequeries or re-written into a UNION of conjunctive queries com-patible with the Aligon et. al.’s feature scheme [1].

Convex Optimization Solving. All convex optimizationproblems involved in measuring Reproduction Error and De-viation are solved by the successive approximation heuris-tic implemented by Matlab CVX package [17] with Sedumisolver.

7.3 Validating Reproduction ErrorIn this section, we validate that Reproduction Error is the

practical alternative for Deviation. In addition, we also offermeasurements on its correlation with Deviation, as well astwo other related measures. As it is impractical to enumer-ate all possible encodings, we choose a subset of encodingsfor both PocketData and US bank datases. Specifically, wefirst select a subset of features having a marginal within

9

0 0.1 0.19 0.36 0.42 0.52 0.74 0.910

0.20.40.60.81

(a) Containment captures Deviation (US bank)

0 0.1 0.17 0.27 0.34 0.39 0.48 0.56 0.65 0.67-0.2

0

0.2

0.4

0.6

0.8

(b) Containment captures Deviation (PocketData)

96.5 97 97.5 98 98.5 99 99.5 100Error

97

98

99

100

101

Deviation

NumPatterns=1NumPatterns=2NumPatterns=3

(c) Error captures Deviation (US bank)

598.4 598.6 598.8 599 599.2 599.4 599.6 599.8 600 600.2 600.4Error

599.5

600

600.5

601

601.5

Deviation

NumPatterns=1NumPatterns=2NumPatterns=3

(d) Error captures Deviation (PocketData)

96.5 97 97.5 98 98.5 99 99.5 100Error

96

97

98

99

100

KL-Divergence

NumPatterns=1NumPatterns=2NumPatterns=3

(e) Error captures KL-divergence (US bank)

598.4 598.6 598.8 599 599.2 599.4 599.6 599.8 600 600.2 600.4Error

598.5

599

599.5

600

600.5

KL-Divergence

NumPatterns=1NumPatterns=2NumPatterns=3

(f) Error captures KL-divergence (PocketData)

-0.1 0 0.1 0.2 0.3 0.4 0.5 0.6Corr_rank of Pattern

42.6

42.8

43

43.2

43.4

43.6

Err

or o

f Pat

tern

#Words=3#Words=2

(g) Error captures Correlation (US bank)

-0.1 0 0.1 0.2 0.3 0.4 0.5Corr_rank of Pattern

54.8

55

55.2

55.4

55.6

55.8E

rror

of P

atte

rn

#Words=3#Words=2

(h) Error captures Correlation (PocketData)

Figure 4: Validating The Reproduction Error Metric

[0.01, 0.99] and use these features to construct patterns. Wethen enumerate combinations of K (up to 3) patterns as ourchosen encodings.

Containment Captures Deviation. Here we empiri-cally verify that containment (Section 4.2) captures Devi-ation (i.e., E1 ≤Ω E2 → d(E1) ≤ d(E2)) to complete thechain of reasoning that Reproduction Error captures Devi-ation. Figures 4a and 4b show all pairs of encodings whereE2 ⊃ E1. The y-axis shows the difference in Deviation val-ues (i.e., d(E2)− d(E1)). Deviation d(S) is approximated bydrawing 1,000,000 samples from the space of possible pat-terns. For clarity, we bin pairs of encodings by the degree ofoverlap between the encodings, measured by the Deviationof the set-difference between the two encodings d(E2 \ E1);Higher d(E2 \ E1) implies less overlap. Values of y-axis fallwithin each bin are visualized by Matlab boxplot (i.e., theblue box indicates the range within standard deviation andred/black crosses are outliers). Intuitively, all points abovezero on the y-axis (i.e., d(E2)−d(E1) > 0) are pairs of encod-ings where Deviation order agrees with containment order.This is the case for virtually all encoding pairs.

Additive Separability of Deviation. We also observefrom Figures 4a and 4b that agreement between Deviationand containment order is correlated with overlap; More sim-ilar encodings are more likely to have agreement. Combinedwith Proposition 2, this first shows that, for similar encod-ings Reproduction Error is likely to be a reliable indicatorof Deviation. This also suggests that Deviation is additively

separable: The information loss (measured in d(E2)−d(E1))by excluding encoding E2 \E1 from E2 closely correlates withthe quality (i.e., d(E2 \ E1)) of encoding E2 \ E1 itself:

E2 ⊃ E1 → d(E2)−d(E1) < 0 and d(E2 \E1) ≈ d(E2)−d(E1)

Error Correlates With Deviation. As a supplement,Figures 4c and 4d empirically confirm that that Reproduc-tion Error (x-axis) indeed closely correlates with Deviation(y-axis). Mirroring our findings above, correlation betweenthem is tighter at lower Reproduction Error.

Error Correlates With KL-Divergence. Figures 4eand 4f show the relationship between Reproduction Error(x-axis) and KL-Divergence between the true distributionρ∗ and the space representative distribution ρS (y-axis), asdiscussed in Section 4.1. The two are tightly correlated.

Error and Feature-Correlation. Figure 4g and 4h showthe relationship between Reproduction Error (y-axis) andthe feature-correlation score corr rank (x-axis), as definedin Section 6.4. Values of y-axis are computed from the naiveencoding extended by a single pattern b containing multi-ples features (up to 3). One can observe that ReproductionError of extended naive encodings almost linearly correlateswith corr rank(b). In addition, one can also observe thatcorr rank becomes higher when the pattern b encodes morecorrelated features.

7.4 Feature-Correlation RefinementIn this section, we design experiments serving two pur-

poses: (1) Evaluating the potential reduction in Error from

10

(a) Naive Mixture v. Naive Mixture+LaserLight or MTV

(b) Naive Mixture v. LaserLight or MTV alone

(c) Running Time Comparison

Figure 5: Naive Mixture Encodings (US bank)

refining naive mixture encodings through state-of-the-artpattern based summarizers, and (2) Evaluating whether wecan replace naive mixture encodings by the encodings cre-ated from summarizers that we have plugged-in.

Experiment Setup. To serve both purposes, we constructpattern mixture encodings under three different configura-tions: (1) Naive mixture encodings; (2) Naive mixture en-codings refined/plugged-in by pattern based encodings and(3) The pattern mixture encoding that summarizes eachcluster using only pattern based summarizers (i.e., replacingthe naive mixture encoding). We first choose KMeans withEuclidean distance from which naive mixture encodings areconstructed. We then choose two state-of-the-art patternbased summarizers to generate pattern based encodings: (1)Laserlight [12] algorithm, which aims at summarizing multi-dimensional data D = (X1, . . . , Xn) augmented with an ad-ditional binary attribute A; (2) MTV [31] algorithm, whichaims at mining maximally informative patterns as encodingsfrom multi-dimensional data of binary attributes.

The experiment results are shown in Figure 5 which con-tains 3 sub-figures. All sub-figures share the same x-axis,i.e., the number of clusters. Figure 5a evaluates the possiblechange in Error (y-axis) by plugging-in MTV and Laserlight.Figure 5b compares the Error (y-axis) between the naivemixture encoding and the pattern mixture encoding ob-tained from only using patterns from MTV and Laserlight.Figure 5c compares the running time (y-axis) between con-structing naive mixture encodings and applying pattern basedsummarizers. We only show the results for US bank dataset as results for PocketData give similar observations.

7.4.1 Replacing Naive Mixture EncodingsFigure 5b and 5c show that replacing naive mixture encod-

ings by pattern based encodings is not recommended fromtwo perspectives.

Error Perspective. We observe from Figure 5b that Er-rors of naive mixture encodings are orders of magnitudelower than Errors of summarizing each cluster using onlypatterns generated from Laserlight or MTV. Note that thecurve of MTV overlaps with that of Laserlight. In otherwords, a naive mixture encoding is the basic building blockof a more general pattern mixture encoding.

Computation Efficiency Perspective. Furthermore, asone can observe from Figure 5c, that the running time ofconstructing naive mixture encodings is significantly lowerthan that of Laserlight and MTV.

7.4.2 Refining Naive Mixture EncodingsThe experiment result is shown in Figure 5a. Note that we

offset y-axis to show the change in Error. We observe fromthe figure that reduction on Error contributed by plugging-in pattern based summarizers is small for both algorithms.This is due to (1) restriction on feature vector dimensionand (2) pattern diversification failure.

Vector Dimension Restriction. Unrestrictedly high di-mensional feature vectors can cause problems in storing andanalyzing them. Thus in real life implementations, there isrestriction on vector dimensions, e.g. Laserlight is imple-mented in PostgresSQL 9.1 which has a threshold of 1000features/columns for a table. Dimension reduction meth-ods based on matrix decomposition, e.g. PCA, transforminteger-valued feature vectors into a real-valued space wherepatterns cannot be defined. Instead, practically we simplyprune and keep top 1000 features according to variation oftheir values. This pruning process inevitably reduces theeffectiveness of Laserlight.

12 17 22 27 32 37 42 47 52 57 62 67 72 77 82 87 92 97 102 107# of Patterns

0

20

40

60

# of

Dis

tinct

Pat

tern

s

(a) Laserlight

12 17 22 27 32 37 42 47 52 57 62 67 72 77 82 87 92 97 102 107# of Patterns

0

10

20

30

# of

Dis

tinct

Pat

tern

s

(b) MTV

Figure 6: Distinct Patterns v. Number of PatternsPattern Diversification Failure. Recall in Section 6.4that pattern diversification can be time-consuming. As aresult, both algorithms implement heuristics that sacrificethe capability of pattern diversification to some extent. Inother words, increase in the total number of patterns minedfrom Laserlight and MTV may not lead to commensurateincrease in the number of distinct patterns (i.e., pattern du-plication implies failure in pattern diversification). Specifi-cally, we run MTV and Laserlight on each cluster (30 clus-ters in total) and vary the number of patterns configured for

11

mining from 12 to 107. We collect the number of distinctpatterns that they have mined as well as the running timeunder each configuration. The experiment result is shownin Figure 6 where y-axis is the number of distinct patternsand x-axis is the total number of patterns mined throughLaserlight and MTV. We observe that Laserlight and MTVfail to extensively explore hidden feature-correlation in ourchosen datasets.

12 17 22 27 32 37 42 47 52 57 62 67 72 77 82 87 92 97 102 107# of Patterns

0

5

10

15

20

25

Run

ning

Tim

e (S

ec)

(a) Laserlight

12 17 22 27 32 37 42 47 52 57 62 67 72 77 82 87 92 97 102 107# of Patterns

0

200

400

600

800

Run

ning

Tim

e (S

ec)

(b) MTV

Figure 7: Running Time v. Number of Patterns

Time Restriction. Computation efficiency will also in-fluence effectiveness of pattern based summarizers when ittakes too long to mine a potentially large set of informativepatterns under from the data. The experiment result forrunning time analysis is shown in Figure 7. We observe thatLaserlight shows a close-to-linear growth rate. For MTV therunning time spikes at 17 patterns and remains oscillatingbetween high levels afterwards.

8. RELATED WORKAn extensively studied problem Text Summarization is

closely-related. Its objective is condensing the source text,which is a collection/sequence of sentences into a shorter ver-sion preserving its information content and overall meaning.Methods achieving such objective can be classified into twocategories [18]: (1) abstractive and (2) extractive.

An extractive summarization is simply ranking and ex-tracting representative or relevant records from the sourcelog. Different extractive methods only differ in the mea-sure of relevance. The simplest measure would be Termfrequency-inverse document frequency (TF-IDF) [15]. Moresophisticated measures include but not limited to LexicalChain based [3], graph-based lexical centrality [13], latentsemantic analysis based [16], machine learning based [32],hidden markov model based [9], neural network based [23],query based [38], mathematical regression based [14] andfuzzy-logic based [29].

A survey on extractive methods [18] pointed out two oftheir problems: (1) Not all text in extracted records arerelevant, resulting in unnecessary verbosity and (2) Rele-vant information tends to either overlap or spread amongrecords, resulting in unexpectedly large amount of recordsextracted to achieve reasonable coverage on information con-tent. These problems can be solved by extracting only pat-terns or fragments commonly shared by records, e.g frequentpattern mining [19]. Frequency is not the only measure of

relevance for patterns. Mampaey et al. [31] study the prob-lem of summarizing multi-dimensional vectors where all at-tributes are binary. The summary is represented as a setof most informative patterns which maximize the BayesianInformation Criterion (BIC) score. Gebaly et al. [12] aimat summarizing multi-dimensional categorical-valued vec-tors augmented by a binary attribute. The relevance ofpattern depends on whether it can explains the valuationof the augmented attribute.

However, there is still controversy on summary evalua-tion for extractive methods. Evaluation measures such asROGUE [40] and BLEU [34] are human-involved. Since hu-man can only participate as reference summarizers in datasets limited in size and number, it is controversial that theperformance of a summarizer evaluated on existing limiteddata sets will generalize to unseen real life data sets.

An abstractive summarization attempts to go beyond ex-traction and builds up probabilistic generative models. Thegoal is to search for relevant topics [4] or abstracts [26] rep-resented by latent variables in the model inferred from thedata in the log. A probabilistic model is usually called gener-ative as it is able produce a world of possible logs where thelog representing the actual data has the maximum likelihoodto be produced (i.e. Maximum Likelihood Estimate). Typ-ical models used for summarization are probabilistic topicmodels [4, 39] and noisy-channel model [26].

Abstractive summarization using probabilistic models hasits own problems. Firstly, goodness of fit on data (i.e.,likelihood) is model-dependent and cannot be used to com-pare different models. As a result, the general practice ofevaluating probabilistic models is also using human as ref-erence summarizers (see [26, 39]). Hence similar contro-versy in summary evaluation still exists. In addition, as [18]pointed out, the world of logs that any model can produce(i.e., model capacity) is limited. There may exist logs thatexceeds model capacity. Finally, unlike understanding ex-tracted records or shared patterns, it may require a steeplearning curve for an human observer to consume and uti-lize information conveyed by probabilistic models.

9. CONCLUSIONIn this paper, we introduced the problem of log compres-

sion and defined a family of pattern based log encodings.We precisely characterized the information content of logsand offered three principled and one practical measures ofencoding quality: Verbosity, Ambiguity, Deviation and Re-production Error. To reduce the search space of patternbased encodings, we introduced the idea of partitioning logsinto separate components, which induces the family of pat-tern mixture as well as its simplified form: naive mixtureencodings. Finally, we experimentally showed that naivemixture encodings are more informative and can be con-structed more efficiently than encodings constructed fromstate-of-the-art pattern based summarization techniques.

12

10. REFERENCES[1] Aligon, J., Golfarelli, M., Marcel, P., Rizzi,

S., and Turricchia, E. Similarity measures for olapsessions. Knowledge and Information Systems 39, 2(May 2014), 463–489.

[2] Aouiche, K., Jouve, P.-E., and Darmont, J.Clustering-based materialized view selection in datawarehouses. In ADBIS (2006).

[3] Barzilay, R., and Elhadad, M. Using lexicalchains for text summarization. In In Proceedings ofthe ACL Workshop on Intelligent Scalable TextSummarization (1997), pp. 10–17.

[4] Blei, D. M. Probabilistic topic models. Commun.ACM 55, 4 (Apr. 2012), 77–84.

[5] Boyd, S., and Vandenberghe, L. ConvexOptimization. Cambridge University Press, New York,NY, USA, 2004.

[6] Bruno, N., and Chaudhuri, S. Automatic physicaldatabase tuning: A relaxation-based approach. InACM SIGMOD (2005).

[7] Chandra, B., Joseph, M., Radhakrishnan, B.,Acharya, S., and Sudarshan, S. Partial markingfor automated grading of sql queries. Proc. VLDBEndow. 9, 13 (Sept. 2016), 1541–1544.

[8] Chatzopoulou, G., Eirinaki, M., Koshy, S.,Mittal, S., Polyzotis, N., and Varman, J. S. V.The QueRIE system for personalized queryrecommendations. IEEE Data Eng. Bull. (2011).

[9] Conroy, J. M., and O’leary, D. P. Textsummarization via hidden markov models. InProceedings of the 24th Annual International ACMSIGIR Conference on Research and Development inInformation Retrieval (New York, NY, USA, 2001),SIGIR ’01, ACM, pp. 406–407.

[10] Darroch, J. N., and Ratcliff, D. Generalizediterative scaling for log-linear models. Ann. Math.Statist. 43, 5 (10 1972), 1470–1480.

[11] Dwork, C. ICALP 2006, Proceedings, Part II.Springer, 2006, ch. Differential Privacy.

[12] El Gebaly, K., Agrawal, P., Golab, L., Korn,F., and Srivastava, D. Interpretable andinformative explanations of outcomes. Proc. VLDBEndow. 8, 1 (Sept. 2014), 61–72.

[13] Erkan, G., and Radev, D. R. Lexrank:Graph-based lexical centrality as salience in textsummarization. J. Artif. Int. Res. 22, 1 (Dec. 2004),457–479.

[14] Fattah, M. A., and Ren, F. Automatic textsummarization. World Academy of Science,Engineering and Technology 37 (2008), 2008.

[15] Garca-Hernndez, R. A., and Ledeneva, Y. Wordsequence models for single text summarization. In2009 Second International Conferences on Advances inComputer-Human Interactions (Feb 2009), pp. 44–48.

[16] Gong, Y., and Liu, X. Generic text summarizationusing relevance measure and latent semantic analysis.In Proceedings of the 24th Annual International ACMSIGIR Conference on Research and Development inInformation Retrieval (New York, NY, USA, 2001),SIGIR ’01, ACM, pp. 19–25.

[17] Grant, M., and Boyd, S. CVX: Matlab software fordisciplined convex programming, version 2.1.

http://cvxr.com/cvx, Mar. 2014.

[18] Gupta, V., and Lehal, G. A survey of textsummarization extractive techniques.

[19] Han, J., Cheng, H., Xin, D., and Yan, X. Frequentpattern mining: Current status and future directions.Data Min. Knowl. Discov. 15, 1 (Aug. 2007), 55–86.

[20] Jain, A. K. Data clustering: 50 years beyondk-means. Pattern Recogn. Lett. 31, 8 (June 2010),651–666.

[21] Jaynes, E., and Bretthorst, G. ProbabilityTheory: The Logic of Science. Cambridge UniversityPress, 2003.

[22] Johnson, S. C. Hierarchical clustering schemes.Psychometrika 32, 3 (Sep 1967), 241–254.

[23] Kaikhah, K. Automatic text summarization withneural networks. In Intelligent Systems, 2004.Proceedings. 2004 2nd International IEEE Conference(June 2004), vol. 1, pp. 40–44 Vol.1.

[24] Kannan, R., Vempala, S., and Vetta, A. Onclusterings: Good, bad and spectral. J. ACM 51, 3(May 2004), 497–515.

[25] Kennedy, O., Ajay, J. A., Challen, G., andZiarek, L. Pocket data: The need for tpc-mobile. InTPC-TC (2015).

[26] Knight, K., and Marcu, D. Summarization beyondsentence extraction: A probabilistic approach tosentence compression. Artif. Intell. 139, 1 (July 2002),91–107.

[27] Kul, G., Luong, D., Xie, T., Coonan, P.,Chandola, V., Kennedy, O., and Upadhyaya, S.Ettu: Analyzing query intents in corporate databases.In Proceedings of the 25th International ConferenceCompanion on World Wide Web (2016), pp. 463–466.

[28] Kullback, S., and Leibler, R. A. On informationand sufficiency. Ann. Math. Statist. 22, 1 (03 1951),79–86.

[29] Kyoomarsi, F., Khosravi, H., Eslami, E.,Dehkordy, P. K., and Tajoddin, A. Optimizingtext summarization based on fuzzy logic. In SeventhIEEE/ACIS International Conference on Computerand Information Science (icis 2008) (May 2008),pp. 347–352.

[30] Makiyama, V. H., Raddick, M. J., and Santos,R. D. Text mining applied to SQL queries: A casestudy for the SDSS SkyServer. In SIMBig (2015).

[31] Mampaey, M., Vreeken, J., and Tatti, N.Summarizing data succinctly with the mostinformative itemsets. ACM Trans. Knowl. Discov.Data 6, 4 (Dec. 2012), 16:1–16:42.

[32] Neto, J. L., Freitas, A. A., and Kaestner, C.A. A. Automatic text summarization using a machinelearning approach. In Proceedings of the 16th BrazilianSymposium on Artificial Intelligence: Advances inArtificial Intelligence (London, UK, UK, 2002), SBIA’02, Springer-Verlag, pp. 205–215.

[33] O’Donoghue, B., Chu, E., Parikh, N., and Boyd,S. Conic optimization via operator splitting andhomogeneous self-dual embedding. Journal ofOptimization Theory and Applications 169, 3 (Jun2016), 1042–1068.

13

[34] Papineni, K., Roukos, S., Ward, T., and Zhu,W.-J. Bleu: A method for automatic evaluation ofmachine translation. In Proceedings of the 40th AnnualMeeting on Association for Computational Linguistics(Stroudsburg, PA, USA, 2002), ACL ’02, Associationfor Computational Linguistics, pp. 311–318.

[35] Park, H.-S., and Jun, C.-H. A simple and fastalgorithm for k-medoids clustering. Expert Syst. Appl.36, 2 (Mar. 2009), 3336–3341.

[36] Pavlo, A., Angulo, G., Arulraj, J., Lin, H., Lin,J., Ma, L., Menon, P., Mowry, T. C., Perron,M., Quah, I., Santurkar, S., Tomasic, A., Toor,S., Aken, D. V., Wang, Z., Wu, Y., Xian, R., andZhang, T. Self-driving database managementsystems. In CIDR (2017), www.cidrdb.org.

[37] Pedregosa, F., Varoquaux, G., Gramfort, A.,Michel, V., Thirion, B., Grisel, O., Blondel,M., Prettenhofer, P., Weiss, R., Dubourg, V.,Vanderplas, J., Passos, A., Cournapeau, D.,Brucher, M., Perrot, M., and Duchesnay, E.Scikit-learn: Machine learning in Python. Journal ofMachine Learning Research 12 (2011), 2825–2830.

[38] Pembe, F. C. Automated query-biased andstructure-preserving document summarization for websearch tasks.

[39] Wang, D., Zhu, S., Li, T., and Gong, Y.Multi-document summarization using sentence-basedtopic models. In Proceedings of the ACL-IJCNLP2009 Conference Short Papers (Stroudsburg, PA,USA, 2009), ACLShort ’09, Association forComputational Linguistics, pp. 297–300.

[40] yew Lin, C. Rouge: a package for automaticevaluation of summaries. pp. 25–26.

14