of the targeted system by sending a large number of query from a botnet • Group queries by their top-level domain and investigate most popular domains • Alert if we detect many different non-existent ci,j return min(f[1], f[2], …, f[p]) ??? Vasiliki Kalavri | Boston University 2020 24 Computing top-k ??? Vasiliki Kalavri | Boston University 2020 24 • Additional to the array of counter, we allocate: so far • a heap X* of up to k potential heavy hitters and their frequency estimations Computing top-k ??? Vasiliki Kalavri | Boston University 2020 24 • Additional to the array of counter, we allocate:

average of a stream on integers? • The number of distinct users who have visited a website? • The top-10 queries inserted in a search engine? • The connected components of accounts in a stream of financial purpose-built and query-specific • different synopsis to count distinct elements than to keep track of top-K events 33 Vasiliki Kalavri | Boston University 2020 Dataflow Streaming Model Vasiliki Kalavri

cell tower load • Continuously maintain call signatures for fraud detection • call frequency • top-K cell towers used 25 Vasiliki Kalavri | Boston University 2020 Web activity analysis • Visualization

Bourne Identity” What’s the cheapest way to reach Zurich from London through Berlin? These are the top-10 relevant results for the search term “graph” ??? Vasiliki Kalavri | Boston University 2020 Basics