FlockStream: a Bio-inspired Algorithm for Clustering Evolving Data Streams

Transcription

1 FlockStream: a Bo-nspred Algorthm for Clusterng Evolvng Data Streams Agostno Forestero, Clara Pzzut, Gandomenco Spezzano Insttute for Hgh Performance Computng and Networkng, ICAR-CNR Va Petro Bucc, 41C Rende (CS), Italy {folno,pzzut,spezzano}@car.cnr.t Abstract Exstng densty-based data stream clusterng algorthms use a two-phase scheme approach consstng of an onlne phase, n whch raw data s processed to gather summary statstcs, and an offlne phase that generates the clusters by usng the summary data. In ths paper we propose a data stream clusterng method based on a mult-agent system that uses a decentralzed bottom-up self-organzng strategy to group smlar data ponts. Data ponts are assocated wth agents and deployed onto a 2D space, to work smultaneously by applyng a heurstc strategy based on a bo-nspred model, known as flockng model. Agents move onto the space for a fxed tme and, when they encounter other agents nto a predefned vsblty range, they can decde to form a flock f they are smlar. Flocks can jon to form swarms of smlar groups. Ths strategy allows to merge the two phases of densty-based approaches and thus to avod the offlne cluster computaton, snce a swarm represents a cluster. Expermental results show the capablty of the bo-nspred approach to obtan very good results on real and synthetc data sets. 1. Introducton In recent years, many organzatons are collectng tremendous amount of data, often generated contnuously as a sequence of events and comng from dfferent locatons. Credt card transactonal flows, telephone records, sensor network data, network event logs are just some examples of data streams. The desgn and development of fast, effcent, and accurate technques, able to extract knowledge from these huge data sets too large to ft nto the man memory of computers, pose sgnfcant challenges. Frst of all, data can be examned only once, as t arrves. Second, usng an entre data stream of a long perod could mslead the analyss results due to the weght of outdated data consdered n the same way as more recent data. Snce data streams are contnuos sequences of nformaton, the underlyng clusters could change wth tme, thus gvng dfferent results wth respect to the tme horzon over whch they are computed. Tradtonal clusterng approaches are not suffcently flexble to deal wth data that contnuously evolves wth tme, thus, n the last few years, many proposals to data stream clusterng have been presented [2, 3, 4, 5, 11, 12, 10, 1, 14]. Aggarwal et al. [1] have been the frst to address the problem of the mpossblty to revse a data stream durng the computaton. They suggested that a stream clusterng algorthm should be separated n an onlne mcro-clusterng component, that gathers approprate summary statstcs on the data stream, and an offlne macro-clusterng component that makes use of the nformaton stored to provde the clusterng results. One of the man drawback of ther CluStream algorthm s that t s unable to dscover clusters of arbtrary shapes, furthermore the number k of clusters must be fxed a-pror. A more amenable approach to clusterng data streams s that based on the concept of densty ntroduced by DBSCAN [9]. Densty-based approach [4, 5] apply the two-phase scheme [1] descrbed above n a densty-based framework. In partcular, the former, Den- Stream, extensvely descrbed n the next secton, extends the concept of core pont ntroduced n DBSCAN and employs the noton of mcro-cluster to store an approxmate representaton of the data ponts n a damped wndow model. The latter apples analogous concepts by assocatng a decay factor to the densty of each data pont and by parttonng the data space nto dscretzed grds where new data ponts are mapped. The authors study the relaton between tme horzon, decay factor, and data densty to guarantee the generaton of hgh qualty clusters. The man drawback of these methods s the executon tme requred when dealng wth large data sets of hgh dmensonalty. In fact, both the methods, when a new data pont arrves, n order to determne whether t should be merged nto an exstng cluster or consder t as the seed for a new group, need to do a comparson wth all the clusters generated so far.

2 In ths paper a densty-based data stream clusterng method, named FlockStream, that employs a mult-agent system usng a decentralzed bottom-up self-organzng strategy to group smlar data ponts, s proposed. Each data pont s assocated wth an agent. Agents are deployed onto a 2D space, called the vrtual space, and work smultaneously by applyng a heurstc strategy based on a bonspred model known as flockng model [8]. Agents move onto the space for a fxed tme and when they encounter other agents nto a predefned vsblty radus they can decde to form a flock (.e a mcro-cluster) f they are smlar. However, the partcpaton of an agent to a group s not defntve snce, f durng the space exploraton a more smlar agent s encountered, the current flock can be dropped and the agent can jon to the nearest agents flock. The movement of the agents n the 2D space s not random, but t s guded by the smlarty functon that aggregates the agents to ther closer neghbors. As dfferent smlar mcroclusters can be created, by applyng the flockng rules, they are aggregated to form swarms of close mcro-clusters. FlockStream ntroduces two man noveltes. Frst, t replaces the exhaustve search of the nearest neghbor of a pont, necessary to assgn t to the approprate mcro-cluster, wth a local stochastc mult-agent search that works n parallel. The method s thus completely decentralzed as each agent acts ndependently from each other and communcates only wth ts mmedate neghbors n an asynchronous way. Localty and asynchronsm mples that the algorthm s scalable to very large data sets. Second, snce flocks of agents can jon together nto swarms of smlar groups, the two-phase scheme of data stream clusterng methods mentoned above s replaced by a unque onlne phase, n whch the clusterng results are always avalable. Ths means that the clusterng generaton on demand by the user can be satsfed at any tme by smply showng all the swarms computed so far. The paper s organzed as follows. The next secton descrbes the DenStream algorthm. Secton 3 ntroduces the Flockng model. Secton 4 descrbes our approach. In secton 5, fnally, the results of the method on synthetc and real lfe data sets are presented. 2. DenStream Algorthm DenStream [4] s a densty-based clusterng algorthm for evolvng data streams that uses summary statstcs to capture synopss nformaton about the nature of the data stream. These statstcs are exploted to generate clusters wth arbtrary shape. The algorthm assumes the damped wndow model to cluster data streams. In ths model the weght of each data pont decreases exponentally wth tme t va a fadng functon f(t) = 2 λt, where λ > 0. The weght of the data stream s a constant W = v, where 1 2 λ v s the speed of the stream,.e. the number of ponts arrved n one unt tme. Hstorcal data dmnshes ts mportance when λ assumes hgher values. The authors extend the concept of core pont ntroduced n DBSCAN [9] and employ the noton of mcro-cluster to store an approxmate representaton of the data ponts. A core pont s an object n whose ɛ neghborhood the overall weght of the ponts s at least an nteger µ. A clusterng s a set of core objects havng cluster labels. Three defntons of mcro-clusters are then ntroduced: the coremcro-cluster, the potental core-mcro-cluster, and the outler mcro-cluster. A core-mcro-cluster (abbrevated c-mcro-cluster) at tme t for a group of close ponts p 1,..., p n wth tme stamps T 1,..., T n s defned as CMC(w, c, r), where w s the weght, c s the center, and r s the radus of the c- mcro-cluster. The weght w = n j=1 f(t T j) must be such that w µ. The center s defned as n j=1 c = f(t T j)p j w and the radus n j=1 r = f(t T j)dst(p j, c) w s such that r ɛ. dst(p j, c) s the Eucldean dstance between the pont p j and the center c. Note that the weght of a mcro-cluster must be above a predefnes threshold µ n order to be consdered core. The authors assume that clusters wth arbtrary shape n a data stream can be descrbed by a set of c-mcro-clusters. However, snce as data flows t can change, structures apt to ncremental computaton, smlar to those proposed by [1] are ntroduced. A potental c-mcro-cluster, abbrevated p-mcro-cluster, at tme t for a group of close ponts p 1,..., p n wth tme stamps T 1,..., T n s defned as {CF 1, CF 2, w}, where the weght w, as defned above, must be such that w βµ. β, 0 < β 1 s a parameter defnng the outlerness threshold relatve to c-mcro-clusters. CF 1 = n j=1 f(t T j)p j s the weghted lnear sum of the ponts, CF 2 = n j=1 f(t T j)p 2 j s the weghed squared sum of the ponts. The center of a p-mcro-cluster s c = CF 1 and CF 2 the radus r ɛ s r = w ( CF 1 w )2 A p-mcro-cluster s a set of ponts that could become a mcro-cluster. An outler mcro-cluster, abbrevated o-mcro-cluster, at tme t for a group of close ponts p 1,..., p n wth tme stamps T 1,..., T n s defned as {CF 1, CF 2, w, t 0 }. The defnton of w, CF 1, CF 2, center and radus are the same of the p-mcro-cluster. t 0 = T 1 denotes the creaton of the o-mcro-cluster. In an outler mcro-cluster the weght w must be below the fxed threshold, thus w < βµ. However w

3 t could grow nto a potental mcro-cluster when, addng new ponts, ts weght exceeds the threshold. The algorthms conssts of two phases: the onlne phase n whch the mcro-clusters are mantaned and updated as new ponts arrve onlne; the off-lne phase n whch the fnal clusters are generated, on demand, by the user. Durng the onlne phase, when a new pont p arrves, DenStream tres to merge p nto ts nearest p-mcro-cluster c p. Ths s done only f the the radus r p of c p does not augment above ɛ,.e. r p ɛ. If ths constrant s not satsfed, the algorthm tres to merge p nto ts nearest o-mcro-cluster c o, provded that the new radus r o ɛ. The weght w s then checked f w βµ. In such a case c o s promoted to p- mcro-cluster. Otherwse a new o-mcro-cluster s generated by p. Note that for an exstng p-mcro-cluster c p, f no new ponts are added to t, ts weght wll decay gradually. When t s below βµ, c p becomes an outler. The off-lne part of the algorthm uses a varant of the DBSCAN algorthm n whch the potental mcro-clusters are consdered as vrtual ponts. The concepts of denstyconnectvty and densty reachable, adopted n DBSCAN, are used by DenStream to generate the fnal result. Den- Stream cannot be used to handle huge amounts of data avalable n large-scale networks of autonomous data sources snce t needs to fnd the closest mcro-cluster for each newly arrved data pont and t assumes that all data s located at the same ste where t s processed. In the next secton a computatonal model that overcome these dsadvantages s descrbed. 3 The Flockng model The flockng model [8] s a bologcally nspred computatonal model for smulatng the anmaton of a flock of enttes. In ths model each ndvdual (also called brd) makes movement decsons wthout any communcaton wth others. Instead, t acts accordng to a small number of smple rules, dependng only upon neghborng members n the flock and envronmental obstacles. These smple rules generate a complex global behavor of the entre flock. The basc flockng model was frst proposed by Crag Reynolds [13], n whch he referred to each ndvdual as a bod. Ths model conssts of three smple steerng rules that a bod needs to execute at each nstance over tme: separaton (steerng to avod collson wth neghbors); algnment (steerng toward the average headng and matchng the velocty of neghbors); coheson (steerng toward the average poston of neghbors). These rules descrbe how a bod reacts to other bods movement n ts local neghborhood. The degree of localty s determned by the vsblty range of the bod s sensor. The bod does not react to the flockmates outsde ts sensor range. A mnmal dstance must also be mantaned among them to avod collson. (a) Fgure 1. Algnment rule. (a) Fgure 2. Separaton rule. A Multple Speces Flockng (MSF) model [7] has been developed to more accurately smulate flockng behavor among an heterogeneous populaton of enttes. MSF ncludes a feature smlarty rule that allows each bod to dscrmnate among ts neghbors and to group only wth those smlar to tself. The addton of ths rule enables the flock to organze groups of heterogeneous mult-speces nto homogeneous subgroups consstng only of ndvduals of the same speces. The basc behavor rules [6] of a sngle entty of the MSF model are llustrated n fgures 1, 2, 3. Let R 1 and R 2, wth R 1 > R 2, be the radus ndcatng the vsblty range of the bods and the mnmum dstance that must be mantaned among them respectvely, and d(f, A c ) the dstance between the current agent A c and a flockmate F. The algnment rule means that a bod tends to move n the same drecton of the nearby bods,.e. t tres to algn ts velocty vector wth the average velocty vector of the flocks n ts local neghborhood. Ths rule s depcted n fgure 1 and t s formally descrbed as f d(f, A c ) R 1 d(f, A c ) R 2 v ar = 1 n (b) (b) v where v ar s the velocty drven by the algnment rule, d(f, A c ) s the dstance between the bod A c and ts neghbor flockmate F, v s the velocty of the bod F, and n s the number of neghbors. The separaton rule avods that a bod be too close to another bod, thus f d(f, A c ) 2R 2 v sr = v + v c d(f, A c )

4 where v sr s the separaton velocty, v c and v are the veloctes of the current bod and of the -th flockmate, respectvely. Ths rule s shown n fgure 2. The advantage of the flockng algorthm s the heurstc prncple of the flock s searchng mechansm. The heurstc searchng mechansm helps bods to quckly form a flock. Snce the bods contnuously fly n the vrtual space and jon the flock consttuted by bods more smlar to them, new results can be quckly re-generate when addng enttes bods or deletng part of bods at run tme. Ths feature allows the flockng algorthm to be appled to clusterng to analyze dynamcally changng nformaton stream. (a) (b) 4 The FlockStream algorthm Fgure 3. Coheson rule. The coheson rule moves a bod towards other nearby bods (unless another bod s too close) orentng the velocty vector of the bod n the drecton of the centrod of the local flock. d(f, A c ) R 1 d(f, A c ) R 2 v cr = (P P c ) where V cr s the coheson velocty and (P P c ) calculates a drectonal vector pont, beng P and P c the postons of the current bod A c and a neghbor bod F. Fgure 3 depcts the coheson rule. When two bods are too close, the separaton rule overrdes the other two, whch are deactvated untl the mnmum separaton s acheved. Smlar bods try to stay close usng the strength of the attractng force, that s proportonal to the dstance between the bods and the smlarty between the bods feature values. Ths strength s computed as v sm = (Sm(F, A c ) d(p, P c )) where v sm s the velocty drven by feature smlarty, Sm(F, A c ) s the smlarty value between the features of bods A c and F, and d(p, P c ) s the dstance between ther postons n the 2D space. Dssmlar bods try to stay away from other bods that have dssmlar features by a repulsve force that s nversely proportonal to the dstance between the bods and the smlarty between the bods. v dsm = 1 Sm(F, A c ) d(p, P c ) where v dsm s the velocty drven by feature dssmlarty. The overall flockng behavor can be expressed by a weghted lnear combnaton of the veloctes calculated by all the rules that represent the net velocty vector v of the bod n the vrtual space. FlockStream s a heurstc densty-based data stream clusterng algorthm bult on the Multple Speces Flockng model. The algorthm uses agents wth dstnct smple functonaltes to mmc the flockng behavor. Each multdmensonal data tem s assocated wth an agent. In our approach, n addton to the standard acton rules of the flockng model, we ntroduce an extenson to the flockng model by consderng the type of an agent. The agents can be of three types: basc (representng a new pont arrvng n one tme unt), p-representatve and o-representatve (correspondng to p- or o- mcro-clusters). FlockStream dstngushes between the ntalzaton phase, n whch the vrtual space s populated of only basc agents, and the mcrocluster mantenance and clusterng, n whch all the three types of agents are present. Intalzaton. At the begnnng a set of basc agents,.e. a set of ponts, s deployed randomly onto the vrtual space. The basc agents work n parallel for a predefned number of teratons and move accordng to the MSF heurstc. Analogously to brds n the real world, agents that share smlar object vector features wll group together and become a flock, whle dssmlar brds wll be moved away from the flock. Agents uses a proxmty functon to dentfy objects that are smlar. In our algorthm we use the Eucldean dstance to measure the dssmlarty between data ponts A and B, and assume that A and B are smlar f ther Eucldean dstance d(a, B) ɛ. Whle teratng, the behavor (velocty) of each agent A wth poston P a s nfluenced by all the agents X wth poston P x n ts neghborhood. The agent s velocty s computed by applyng the local rules of Reynolds and the smlarty rule. The smlarty rule nduces an adaptve behavor to the algorthm snce the agents can leave the group they partcpate for another group contanng agents wth hgher smlarty. Thus, durng ths predefned number of teratons, the ponts jon and leave the groups formng dfferent flocks. At the end of the teratons, for each created group, summary statstcs are computed and the stream of data s dscarded. As result of ths ntal phase we have the two other types of agents: p-representatve and o-representatve agents. Representatve Mantenance and Clusterng. When a

5 new data stream bulk of agents s nserted nto the vrtual space, at a fxed stream speed, the mantenance of the p- and o- representatve agents and onlne clusterng are performed for a fxed number of teratons. Analogously to DenStream, dfferent cases can occur (see fgure 4) : a p-representatve c p or an o-representatve c o encounters another representatve agent. If the dstance between them s below ɛ then they compute the velocty vector by applyng the Reynolds and smlarty rules (step 5), and jon to form a swarm (.e. a cluster) of smlar representatves (step 6). A basc agent A meets ether a p-representatve c p or an o-representatve c o n ts vsblty range. The smlarty between A and the representatve s computed and, f the new radus of c p (c o respectvely) s below or equal to ɛ, A s absorbed by c p (c o ) (step 9). Note that at ths stage FlockStream does not update the summary statstcs because the aggregaton of the basc agent A to the mcro-cluster could be dropped f A, durng ts movement on the vrtual space, encounters another agent more smlar to t. A basc agent A meets another basc agent B. The smlarty between the two agents s calculated and, f d(a, B) ɛ, then the velocty vector s computed (step 11) and A s joned wth B to form an o- representatve (step 12). At the end of the maxmum number of teratons allowed, for each swarm, the summary statstcs of the representatve agents t contans are updated and, f the weght w of a p-representatve dmnshes below βµ, t s degraded to become an o-representatve. On the contrary, f the weght w of an o-representatve becomes above βµ, a new p-representatve s created. It s worth to note that, the swarms of representatve agents avod the off-lne phase of DenStream to apply a clusterng algorthm to get the fnal result. In fact a swarm represents a cluster, thus the clusterng generaton on demand by the user can be satsfed at any tme by smply showng all the swarms computed so far. Fgure 5 llustrates the vrtual space at a generc teraton. The fgure ponts out the presence of swarms of agents, as well as the presence of solated agents not yet aggregated wth other smlar agents. In the next secton we show that our approach successfully detects clusters n evolvng data streams. 5. Expermental Results In ths secton we study the effectveness of FlockStream on real and synthetc datasets. The algorthm has been mplemented n Java and all the experments have been performed on an Intel(R) Core(TM) havng 2 Gb 1. for =1... MaxIteratons 2. foreach agent (all) 3. f (typeagent s (p-representatve o-representatve)) 4. then{ 5. computeveloctyvector(flockmates, MSF rules); 6. moveagentandformswarm( v);} 7. else{ 8. f (typeagent s (basc n neghborhood of a smlar swarm) ) 9. then agent temporary absorbed n the swarm; 10. else{ 11. computeveloctyvector(flockmates, MSF rules); 12. moveagentandformswarm( v);}} 13. end foreach 14. end for Fgure 4. The pseudo-code of the Flock- Stream algorthm. of memory. The synthetc datasets used, named DS1, DS2 and DS3, are showed n Fgure 6(a). Each of them contans 10,000 ponts and they are smlar to those employed by Cao et al. n [4] to evaluate DenStream. For a far comparson, the evolvng data stream, denoted EDS, has been created by adoptng the same strategy of Cao et al. Each dataset has been randomly chosen 10 tmes, thus generatng an evolvng data stream of total length 100,000 havng a 10,000 ponts block for each tme unt. The real dataset used to test the performances of FlockStream s the KDD Cup 1999 Data set ( Ths data set comes from the 1998 DARPA Intruson Detecton Evaluaton Data and contans tranng data consstng of 7 weeks of network-based ntrusons nserted n the normal data, and 2 weeks of network-based ntrusons and normal data for a total of 4,999,000 connecton records descrbed by 41 characterstcs. The man categores of ntrusons are four: Dos (Denal Of Servce), R2L (unauthorzed access from a remote machne), U2R (unauthorzed access to a local super-user prvleges by a local un-prvleged user), PROBING (survellance and probng). The data set has been transformed nto a data stream by takng the nput order as the streamng order. For all the datasets the true class label s known, thus the clusterng qualty can be evaluated by the average purty of the clusters. The average purty of a clusterng s defned as: purty = K C d =1 C K 100%; where K ndcates the number of clusters, C d denotes the

6 Fgure 5. Vsualzaton of swarms of agents and solated agents on the vrtual space at a generc teraton. DS1 DS2 DS3 (a) DS1 DS2 DS3 (b) (c) Fgure 6. (a) Synthetc data sets.(b) Clusterng performed by FlockStream on the synthetc datasets. (c) Clusterng performed by FlockStream on the evolvng data stream EDS. number of ponts wth the domnant class label n cluster, and C denotes the number of ponts n cluster. The purty s calculated only for the ponts arrvng n a predefned wndow (horzon), snce the weght of ponts dmnshes contnuously. The parameters used by FlockStream n the experments are analogous to those adopted by Cao et al., that s ntal ponts/agents Na = 1000, stream speed v = 1000, decay factor λ = 0.25, ɛ = 16, µ = 10, outler threshold β = 0.2 and MaxIteratons = Intally we evaluated the FlockStream algorthm on the non-

7 Fgure 7. Clusterng qualty for evolvng data stream EDS wth horzon=2 and stream speed=2000. Fgure 8. Clusterng qualty for evolvng data stream EDS wth horzon=10 and stream speed=1000. evolvng datasets DS1, DS2 and DS3, to check the ablty of the method to get the shape of each cluster. The results are reported n Fgure 6(b). In ths fgure the crcles ndcate the mcro-cluster detected by the algorthm. We can see that FlockStream exactly recovers the cluster shape. The results obtaned by FlockStream on the evolvng data stream EDS, at dfferent tmes, are shown n fgure 6(c). In the fgure, ponts ndcate the raw data whle crcles denote the mcro-clusters. It can be seen that FlockStream captures the shape of each cluster as the data streams evolve. The purty results of FlockStream compared to DenStream on the EDS data stream are shown n fgure 7. Here, the horzon s set to 2 and the stream speed s set to 2000 ponts per tme unt. We can see the very good clusterng qualty of FlockStream, n fact t s always hgher than 95% and comparable to DenStream. Fgure 8 shows the results of FlockStream when the stream speed s set to 1000 ponts per tme unt and the horzon s set to 10 on the EDS data stream. The results show that FlockStream, smlarly to DenStream, s nsenstve to the horzon. The comparson between FlockStream and DenStream on the Network Intruson data set s shown n Fgures 9 and 10. We selected the same tme ponts, when some partcular attacks happen, chosen by DenStream, and we report the results obtaned at these moments. In the former fgure the horzon s set to 1, whereas n the latter the horzon s set to 5; the stream speed s set to 1000 for both. We can see how FlockStream clearly ouperforms DenStream n almost all the tme unts chosen and the very hgh clusterng qualty acheved also on ths dataset. The purty of FlockStream compared to DenStream n a dataset wth nose s calculated and the clusterng purty results of EDS wth 1% and 5% nose are shown n fgures 11 and 12 respectvely. The results demonstrate that FlockStream acheves hgh clusterng qualty, comparable to DenStream, also when nose s present. Fgure 9. Clusterng qualty for Network Intruson dataset wth horzon=1 and stream speed= Conclusons A heurstc densty-based data stream clusterng algorthm, bult on the Multple Speces Flockng model, has been presented. The method employs a local stochastc mult-agent search strategy that allows agents to act ndependently from each other and to communcate only wth mmedate neghbors n an asynchronous way. Decentralzaton and asynchronsm makes the algorthm scalable to very large data sets. Another man novelty of the approach s that the two-phase scheme of densty-based data stream clusterng methods s replaced by a unque onlne phase, n whch the clusterng results are always avalable. Ths means that the clusterng generaton on demand by the user can be satsfed at any tme by smply showng all the swarms computed so far. Expermental results on real and synthetc data sets confrm the valdty of the approach proposed. Future work ams at extendng the method to a dstrbuted framework, more apt to real lfe applcatons.

8 References Fgure 10. Clusterng qualty for Network Intruson dataset wth horzon=5 and stream speed=1000. Fgure 11. Clusterng qualty for evolvng data stream EDS wth horzon=2, stream speed=2000 and wth 1% nose. Fgure 12. Clusterng qualty for evolvng data stream EDS wth horzon=10, stream speed=1000 and wth 5% nose. [1] C. C. Aggarwal, J. Han, J. Wang, and P. Yu. On clusterng massve data streams: a summarzaton paradgm. In n Data Streams- Models and Algorthms, Charu C. Aggarwal eds., pages Sprnger, [2] B. Babock, M. Datar, R. Motwan, and L. O Callaghan. Mantanng varance and k-medans over data stream wndows. In Proceedngs of the 22nd ACM Symposum on Prncples of Data base Systems (PODS 2003), pages , [3] D. Barbará. Requrements for clusterng data streams. SIGKDD Exploratons Newsletter, 3(2):23 27, [4] F. Cao, M. Ester, W. Qan, and A. Zhou. Densty-based clusterng over evolvng data stream wth nose. In Proceedngs of the Sxth SIAM Internatonal Conference on Data Mnng (SIAM 2006), pages , [5] Y. Chen and L. Tu. Densty-based clusterng for real-tme stream data. In Proceedngs of the 13th ACM SIGKDD Internatonal conference on Knowledge dscovery and data mnng (KDD 07), pages ACM, [6] X. Cu, J. Gao, and T. E. Potok. A flockng based algorthm for document clusterng analyss. Journal of Systems Archtecture, 52(8-9): , [7] X. Cu and T. E. Potok. A dstrbuted agent mplementaton of multple speces flockng model for document parttonng clusterng. In Cooperatve Informaton Agents, pages , [8] R. C. Eberhart, Y. Sh, and J. Kennedy. Swarm Intellgence (The Morgan Kaufmann Seres n Artfcal Intellgence). Morgan Kaufmann, March [9] M. Ester, H.-P. Kregel, J. Sander, and X. Xu. A denstybased algorthm for dscoverng clusters n large spatal databases wth nose. In Proceedngs of the Second ACM SIGKDD Internatonal conference on Knowledge dscovery and data mnng (KDD 96), pages, [10] S. Gua, A. Meyerson, N. Mshra, R. Motwan, and L. O Callaghan. Clusterng data strams: Theory and practse. IEEE Transactons on Knowledge and Data Engneerng, 15(3): , [11] S. Gua, N. Mshra, R. Motwan, and L. O Callaghan. Clusterng data streams. In Proceedngs of the Annual IEEE Symposum on Foundatons of Computer Scence, pages , [12] L. O Callaghan, N. Mshra, N. Mshra, and S. Gua. Streamng-data algorthms for hgh qualty clusterng. In Proceedngs of the 18th Internatonal Conference on Data Engneerng (ICDE 01), pages , [13] C. W. Reynolds. Flocks, herds and schools: A dstrbuted behavoral model. In SIGGRAPH 87: Proceedngs of the 14th annual conference on Computer graphcs and nteractve technques, pages 25 34, New York, NY, USA, ACM. [14] A. Zhou, F. Cao, W. Qan, and C. Jn. Trackng clusters n evolvng data streams over sldng wndows. Knowledge and Informaton Systems, 15(2): , 2007.