Source code for synapse.ml.cyber.anomaly.complement_access

__author__ = 'rolevin'

from typing import List, Optional

from synapse.ml.cyber.utils.spark_utils import DataFrameUtils, ExplainBuilder

from pyspark.ml import Transformer
from pyspark.ml.param.shared import Param, Params
from pyspark.sql import DataFrame, functions as f, types as t
import random


class ComplementAccessTransformer(Transformer):
    partitionKey = Param(
        Params._dummy(),
        "partitionKey",
        "The name of the partition_key field name"
    )

    indexedColNamesArr = Param(
        Params._dummy(),
        "indexedColNamesArr",
        "The name of the fields to use to generate the complement set from"
    )

    complementsetFactor = Param(
        Params._dummy(),
        "complementsetFactor",
        "The estimated average size of the complement set to generate"
    )

    """
    Given a dataframe it returns a new dataframe with access patterns sampled from
    the set of possible access patterns which did not occur in the given dataframe
    (i.e., it returns a sample from the complement set).
    """

    def __init__(self,
                 partition_key: Optional[str],
                 indexed_col_names_arr: List[str],
                 complementset_factor: int):

        super().__init__()

        # we assume here that all indices of the columns are continuous within their partition_key
        ExplainBuilder.build(
            self,
            partitionKey=partition_key,
            indexedColNamesArr=indexed_col_names_arr,
            complementsetFactor=complementset_factor
        )

    @staticmethod
    def _min_index_token(curr_col_name: str) -> str:
        return '__min_{0}__'.format(curr_col_name)

    @staticmethod
    def _max_index_token(curr_col_name: str) -> str:
        return '__max_{0}__'.format(curr_col_name)

    @staticmethod
    def _tuple_token() -> str:
        return '__tuple__'

    def _transform(self, df: DataFrame) -> DataFrame:
        """ generate a dataframe which consists of a sample from the complement set

        Parameters
        ----------
        df: a given dataframe containing the columns in 'indexed_col_names_arr'

        Returns
        -------
        dataframe which which consists of a sample from the complement set
        """
        complementset_factor = self.complementset_factor

        if complementset_factor == 0:
            return DataFrameUtils.make_empty(df)

        the_partition_key = self.partition_key
        indexed_col_names_arr = self.indexed_col_names_arr

        if the_partition_key is None:
            partition_key = '__dummy_partition_key__'
            df = df.withColumn(partition_key, f.lit(0)).cache()
        else:
            partition_key = the_partition_key
            df = df.cache()

        limits_dfs = [df.select(
            partition_key, curr_col_name
        ).distinct().groupBy(partition_key).agg(
            f.min(curr_col_name).alias(ComplementAccessTransformer._min_index_token(curr_col_name)),
            f.max(curr_col_name).alias(ComplementAccessTransformer._max_index_token(curr_col_name))
        ).orderBy(
            partition_key
        ) for curr_col_name in indexed_col_names_arr]

        def make_randint(factor):
            schema = t.ArrayType(
                t.StructType([t.StructField(
                    curr_col_name, t.IntegerType()
                ) for curr_col_name in indexed_col_names_arr])
            )

            @f.udf(schema)
            def randint(min_index_arr, max_index_arr):
                return [tuple([random.randint(min_index, max_index) for min_index, max_index
                               in zip(min_index_arr, max_index_arr)]) for _ in range(factor)]

            return randint

        pre_complement_candidates_df = df.cache()

        for limits_df in limits_dfs:
            pre_complement_candidates_df = pre_complement_candidates_df.join(limits_df, partition_key).cache()

        cols = [f.col(partition_key)] + [f.col(curr_col_name) for curr_col_name in indexed_col_names_arr]
        randint = make_randint(complementset_factor)

        complement_candidates_df = pre_complement_candidates_df.withColumn(
            ComplementAccessTransformer._tuple_token(),
            f.explode(randint(
                f.array([f.col(ComplementAccessTransformer._min_index_token(curr_col_name)) for curr_col_name
                         in indexed_col_names_arr]),
                f.array([f.col(ComplementAccessTransformer._max_index_token(curr_col_name)) for curr_col_name
                         in indexed_col_names_arr])
            ))
        ).select(
            *([partition_key] + [f.col('{0}.{1}'.format(
                ComplementAccessTransformer._tuple_token(),
                curr_col_name
            )).alias(curr_col_name) for curr_col_name in indexed_col_names_arr])
        ).distinct().orderBy(*cols)

        tuples_df = df.select(*cols).distinct().orderBy(*cols)

        res_df = complement_candidates_df.join(
            tuples_df,
            [partition_key] + indexed_col_names_arr,
            how='left_anti'
        ).select(*cols).orderBy(*cols)

        if the_partition_key is None:
            res_df = res_df.drop(partition_key)

        return res_df