Efficient detection of multivariate correlations with different correlation measures

Correlation analysis is an invaluable tool in many domains, for better understanding the data and extracting salient insights. Most works to date focus on detecting high pairwise correlations. A generalization of this problem with known applications but no known efﬁcient solutions involves the discovery of strong multivariate correlations, i.e., ﬁnding vectors (typically in the order of 3–5 vectors) that exhibit a strong dependence when considered altogether. In this work, we propose algorithms for detecting multivariate correlations in static and streaming data. Our algorithms, which rely on novel theoretical results, support four different correlation measures, and allow for additional constraints. Our extensive experimental evaluation examines the properties of our solution and demonstrates that our algorithms outperform the state-of-the-art, typically by an order of magnitude.


Introduction
Correlation analysis is one of the key tools in the arsenal of data analysts for understanding the data and extracting insights.For example, in neuroscience, a strong correlation between activity levels in two regions of the brain indicates that these regions are strongly interconnected [20].In finance, correlation plays a crucial role in finding portfolios of assets that are on the Pareto-optimal frontier of risk and expected returns [30], and in genetics, correlations help scientists detect cause factors for potentially hereditary syndromes. 1In databases, similarity measure like correlations are occasionally used in theta joins to allow for softer joining conditions than pure object equality [21].Furthermore, when treated as a generalization of functional dependencies, correlations are also used for optimizing access paths in databases [47].
Multivariate correlations, also known as high-order correlations, extend the concept of pairwise correlations to relationships among three or more variables.These variables may represent various forms of data, such as time series or other high-dimensional data stored as vectors. 2 Multivariate correlations should not be confused with pairwise correlations of multivariate time series.The former refers to correlations involving three or more distinct variables/vectors, whereas the latter deals with correlations of only two multivariate time series.In the last few years, multivariate correlations found extensive use in diverse domains.Detection of ternary correlations in fMRI time series improved the understanding of how different brain regions work in cohort for executing different tasks [2,3].For instance, the activity of the left middle frontal region was found to have a high correlation with the total activity of the right superior frontal and left inferior frontal regions while the brain was processing audiovisual stimulus.This insight suggests that the left middle frontal has an integrative role of assimilating information from the other two regions, which was not possible to find by looking only at pairwise correlations.In climate science, a ternary correlation led to the characterization of a new weather phenomenon and to improved climate models [29].In machine learning, multivariate information-theoretic measures have increasingly served as learning objectives or regularizers for training of neural networks aimed at optimizing the correlation among multiple variables.Usage of such regularizers lead to improved robustness, generalizability, and interpretability of the models [4,7,8].It is also stipulated that a more thorough look at multivariate correlations will open doors in the fields of genomics [6,52] and medicine [28,32].
Accordingly, several measures and algorithms for discovering strong multivariate correlations have been proposed, such as Tripoles [2], Multipoles [3], Canonical Correlation Analysis (CCA) [23], and Total Correlation (TC) [35,36,46,52].However, the proposed algorithms do not sufficiently address the fundamental impediment on the discovery of strong multivariate correlations, which is the vast search space-all combinations of vectors that need to be examined.Unfortunately, apriori-like pruning techniques do not apply for the general case of multivariate correlations.For example, consider the three time series from finance, presented in Fig. 1.In this example, the pairwise correlation between all pairs of the three time series is comparatively low, whereas the time series created by averaging QAN and RDF is strongly correlated to MCP. 3 Therefore, a correlation value of any pair of vectors does not provide sufficient information as of whether these vectors may participate together in a ternary (or higher-order) correlation.Simultaneously, an exhaustive algorithm that iterates over all possible combinations implies combinatorial complexity, and cannot scale to reasonably large datasets.Indicatively, in a small data set of 100 vectors, detection of all ternary high correlations requires iterating over 1 million candidates, whereas finding quaternary high correlations on 1000 vectors involves 1 trillion combinations.The mere generation and enumeration of these combinations already becomes challenging.Therefore, smart algorithms are needed to drastically reduce the search space and computational complexity.
Existing algorithms follow at least one of the following approaches: (a) they consider constraining definitions of multivariate correlations that enable apriori-like filtering [3,35,52], (b) they rely on hand-crafted assumptions of the user query, which may be too constraining for other application scenarios [2,3,52], or, (c) they offer approximate results, with no guarantees [2,3].Even though these algorithms are very useful for their particular use cases, they are not generally applicable. 3Weighted averages of stock prices are commonly considered in risk management to evaluate portfolio performance, diversity, and volatility [38].In this work, we follow a more general direction.First, we also consider correlation measures that are not suitable for apriori-like pruning.Second, in contrast to some of the earlier work, we abide by Ockham's razor: we prioritise discovery of the less complex multivariate correlations-the ones that contain the smallest number of vectors.We opt for this approach since correlations between a few variables are more intuitive and interpretable than their counterparts with many variables.Third, we consider different algorithmic variants: an exact threshold variant that returns all correlations higher than a threshold τ , and an exact top-κ variant that returns the top-κ highest correlations.We also discuss the case of progressively finding results, and extend the proposed algorithms to a dynamic context, for handling streaming updates.
We evaluate our algorithms on 7 datasets and compare them to the state-of-the-art.Our evaluation demonstrates that we outperform the existing methods, frequently by several orders of magnitude.Finally, we show that the progressive version of the algorithm produces around 90% of the answers in 10% of the time.
The remainder of the paper is structured as follows.In the next section, we formalize the problem and discuss the preliminaries and related work.We then propose the algorithmic variants for the case of static data (Sect.3), and the streaming extension of the algorithm (Sect.4).Section 5 summarizes the experimental results.We conclude in Sect.6.

Preliminaries
We start with a discussion of the multivariate correlation measures that we will be considering in this work.We then formalize the problem and discuss prior work on similar multivariate correlation measures.

Correlation measures
Our work focuses on both types of multivariate correlation measures: a bivariate correlations over aggregated vectors (two-sided), and b specialized multivariate measures (onesided).Bivariate correlations over aggregates.Given two sets of vectors X and Y , a bivariate correlation over aggregated vectors is defined as Corr(X , Y ) = Corr(Agg(X ), Agg(Y )) (1) with Corr being a bivariate correlation function such as Pearson Correlation, and Agg(X ) being a linear combination of the vectors in X .In this work, we consider element-wise averaging combined with Pearson Correlation and Euclidean Similarity [42], referred to as PC and ES, respectively.Pearson Correlation is defined as ρ(x, y) = cov(x,y) σ x σ y with σ x denoting the standard deviation of some vector x, and is a widely used measure for measuring the linear dependence between two variables.Euclidean Similarity is defined as ES(x, y) = 1 1+d(x,y) with d(•, •) denoting the Euclidean distance, and is extensively used for k-nearest neighbors queries and range queries [13,15].Multipole.The multipole correlation MP(X ) measures the linear dependence of an input set of vectors X [3].Specifically, let x1 , . . ., xn denote n z-normalized input (column) vectors, and X = [x 1 , . . ., xn ] the matrix formed by concatenating the vectors.Then: The value of MP(X ) lies between 0 and 1.The measure takes its maximum value when there exists perfect linear dependence, meaning that there exists a vector v with norm 1, such that var(X • v T ) = 0. Notice that multipoles is not equivalent to, nor a generalization of PC or ES.By definition, MP assumes optimal weights (vector v is such that the variance is minimized), whereas for PC and ES, the aggregation function for the vectors (e.g., averaging) is determined at the definition of the measure.Furthermore, MP(•) expresses the degree of linear dependence within a single set of vectors, whereas for bivariate measures, two distinct, non-overlapping vector sets are considered.Total correlation.Total correlation TC(X ) (also known as multi-information [43] or multivariate constraint [18]) is a generalization of the (pairwise) mutual information measure.It measures the redundancy or dependence among a set of n random variables X = {X 1 , . . ., X n } as the KL-divergence from the joint distribution p(X 1 , . . ., X n ) to the product of the marginal distributions p(X 1 ) . . .p(X n ) [46].This can be reduced to the difference of entropies: with H (X i ) denoting Shannon's entropy of X i ∈ X .

Problem definition
Consider a set V = {v 1 , v 2 , . . .v n } of d-dimensional vectors, and a multivariate correlation measure Corr, both provided by the data analyst.Function Corr accepts either one or two vector sets (subsets of V) as input parameters, and returns a scalar.Hereafter, we will be denoting the correlation function with Corr(X , Y ), with the understanding that for the definitions of Corr that expect one input (i.e., MP and TC), Y will be empty.We consider two query types: Query 1: Threshold query: For a user-chosen correlation function Corr, correlation threshold τ , and parameters p l , p r ∈ N, find all pairs of sets Query 2: Top-κ query: For a user-chosen correlation function Corr, and parameters κ, p l , p r ∈ N, find the κ pairs of sets The combination of p l and p r controls the desired complexity of the answers.Smaller p l + p r values yield results that are easier to interpret, and arguably more useful to the data analyst.
Complementary to the two query types, users may also want to specify additional constraints, relating to the targeted diversity and significance of the answers.We consider two different constraints, but other constraints (e.g., the weakcorrelated feature subset constraint of [52]) can also be integrated in the algorithm into a similar manner: Irreducibility constraint: For each (X , Y ) in the result set, there exists no (X , Y ) in the result set such that X ⊆ X , Y ⊆ Y , and X , Y = (X , Y ).Intuitively, if Corr(X , Y ) ≥ τ , then no supersets of X and Y should be considered together.This constraint prioritizes simpler answers.Minimum jump constraint: For each (X , Y ) in the result set, there exists no This constraint, which was first proposed in [2], discards solutions where a vector in X ∪ Y contributes less than δ to the increase of the correlation.
For top-κ queries, these constraints are ill-defined.For example, consider the irreducibility constraint, and assume Corr(X , Y ) = 0.9, and Corr(X , Y ) = 0.8, where X ⊂ X and Y ⊂ Y .In this case, the definition of top-κ does not dictate which of (X , Y ) or (X , Y ) should be in the answer set.
For conciseness, we will use Corr( p l ) and Corr( p l , p r ) to denote the combination of the correlation measure, and the user-chosen values of p l and p r .For example, PC(2, 1) will identify the combinations of sets of vectors of size 2 and 1 with high Pearson correlation, whereas pattern MP(4) will identify the combinations of 4 vectors with high multipole correlation.

Related work
Several algorithms exist for efficiently finding highly correlated pairs in large data sets of high-dimensional vectors, e.g., time series.For example, StatStream [53] and Mueen et al. [34] both map pairwise correlations to Euclidean distances.They then exploit Discrete Fourier Transforms, grid-based indexing and dynamic programming to reduce the search space.Other works also enable indexing of high-dimensional vectors in the Euclidean space [11,40].However, these works are not applicable for multivariate correlations, since two vectors may have a low pairwise correlation with a third vector, whereas their aggregate may have a high correlation (see, e.g., the example of Fig. 1).Prior work addressing multivariate correlations propose algorithms that rely on additional constraints for their pruning power.Agrawal et al. investigate the problem of finding highly-correlated tripoles [2].Tripoles is a special case of the PC measure, where |X | = 2 and |Y | = 1 (i.e., PC(2, 1)).Their algorithm, named CoMEt, relies on the minimum jump constraint for effective pruning.Compared to tripoles, our work handles the more general definition of Pearson correlation over aggregated vectors, allowing more vectors on the left-and right-hand side.Moreover, our work relies on novel theoretical results to prune the search space and can scale to larger datasets regardless of the introduction of any additional constraints (e.g., minimum jump or irreducibility).
Algorithms for discovering high correlations according to the Multipole measure (Eq.2) were first proposed in [3], with the introduction of the CoMEtExtended algorithm.Both CoMEt and CoMEtExtended are approximate and rely on clique enumeration to efficiently explore the search space.Their efficiency depends on a parameter ρ that trades off result completeness for performance.The minimum jump constraint also becomes relevant to reduce computational effort.For settings of ρ that result in reasonable computation times, the two algorithms yield a substantially more complete result set compared to methods like l 1 -regularization and structure learning-based techniques.Still, the two algorithms do not come with completeness or accuracy guarantees.In contrast, our work is exact-it always retrieves all answersand outperforms both algorithms.
With respect to Total Correlation, Nguyen et al. [35] propose an algorithm for groups of columns in a database with high Total Correlation.The method analyzes patterns in pairwise correlations (i.e., mutual-information) to identify quasi-cliques of highly correlated column groups, and compute lower bounds on their total correlation.However, it misses strongly correlated groups with low pairwise cor-relations, which are arguably the most interesting cases.As such, the method is effectively an approximation algorithm.
In another work, Zhang et al. developed an algorithm that discovers sets of binary vectors with a high total correlation value [52].However, the method is again approximate, limited to data with binary features only, and relies on a limiting weak-correlated subset constraint.In contrast, our work returns a guaranteed complete set of results and works on all major data types.
In the supervised learning context, subset regression appears to be closely related to multivariate correlation mining.The goal of this feature selection problem is to select the best p predictors out of n candidate features [10].Our problem differs from the above in that we aim to find interesting patterns in the data, rather than finding the best predictors for a given dependent variable.Furthermore, instead of finding only the highest correlated vector set, our goal is to find a diverse set of results as we argue that that will help domain expert assess the results more on qualitative aspects, gaining more insights.
Another similar problem is that of similarity search on multivariate time series [49,50].Here, the goal is to find all pairs of multivariate time series (e.g., weather sensors measuring both temperature and wind speed) with a high similarity value, based on some specialized measure such as the PCA similarity factor [45], or the extended Frobenius norm [48].Effectively, this extends classic similarity search by adding a degree of freedom (DoF) in the number of variables per time series, increasing the search space cardinality from O(n 2 ) to O(( pn) 2 ) for p-variate time series.In contrast, our problem extends classic similarity search by adding a DoF in the number of time series per combination, growing the search space to O(n p ).Although this problem seems similar, its challenges differ significantly from similarity search on multivariate time series and can lead to different results and insights.
Table 1 summarizes the properties of the most closely related work out of the discussed ones.

Detection of multivariate correlations in static data
The main challenge in detecting strongly correlated vector sets stems from the combinatorial explosion of the number of candidates that need to be examined.In a dataset of n vectors, there exist at least O p l + p r p=2 n p possible combinations for a correlation pattern Corr ( p l , p r ).Even if each possible combination can be checked in constant time, the enumeration of all combinations still requires significant computational effort.Our algorithm-Correlation Detective, abbreviated as CD-exploits the insight that vectors often exhibit (weak) correlations between each other.For example, securities of companies that participate in the same conglomeration (e.g., Fig. 2a, GOOGL and GOOG) or are exposed to similar risks and opportunities (e.g., STMicroelectronics and ASML) typically exhibit a high correlation between their stock prices.CD exploits such correlations, even if they are weak, to drastically reduce the search space.
CD works as follows: rather than iterating over all possible vector combinations that correspond to the correlation pattern, CD clusters the vectors based on their similarity, and enumerates the combinations of only the cluster centroids.For each of these combinations, CD computes upper and lower bounds on the correlations of all vector combinations in the Cartesian product of the clusters.Based on these bounds, CD decides whether or not the combination of clusters (i.e., all combinations of vectors derived from these clusters) should be added to the result set, can safely be discarded, or, finally, if the clusters should be split into smaller subclusters for deriving tighter bounds.This approach effectively reduces the number of combinations that need to be considered, making CD at least an order of magnitude faster than existing methods.
In the remainder of this section, we will present the key elements of CD, explaining how the two types of queries presented in Sect. 2 are handled.We will start with a brief description of the initialization phase, which includes data pre-processing and clustering.In Sects.3.2 and 3.3, we will describe how CD answers threshold and top-κ queries, respectively.
The second part of the initialization phase considers constructing a hierarchical clustering of all vectors, again using a measure-specific distance measure (shown in Table 2).We will discuss the selection of distance measures in Sect.3.2.2.
The clustering algorithm operates in top-down fashion.A root cluster containing all vectors is first created to initialize the hierarchy.The algorithm then consists of three steps.First, K vectors are picked from the root cluster and used as the initial top-level centroids in the hierarchy.These vectors are picked using the seeding strategy of K -means ++ [5].The use of K -means ++ (as opposed to sampling K random vectors) ensures that these initial centroids are well-distributed over the metric space, and not very close to each other.In the second step, we run the standard K -means algorithm for at most r 1 iterations, or until convergence using the average function to recompute the cluster centroids after each iteration.The clustering is evaluated using the Within-Cluster Sum of Squares (WCSS) (the sum of the variances within all clusters).In the third step, steps one and two are repeated r 2 times (i.e., with different centroids), and the clustering with the lowest WCSS is kept as the final clustering assignment for the first level of the hierarchy.These three steps are executed recursively on each individual cluster with non-zero radius, to construct the second, third, etc. levels of the hierarchy, until all leaf nodes contain only one vector.
There is a clear tradeoff between the cost of the clustering algorithm and the clustering quality.Increasing the values of r 1 and r 2 will generally result in a higher clustering quality (lower WCSS), but will take longer to compute.However, the quality of the clustering does not affect the correctness of CD-in fact, regardless of the employed hierarchical clustering algorithm, CD always returns the same correct result set.A poor clustering only affects the computational efficiency of CD.Still, our experiments show that as long as the clustering is reasonable, a suboptimal clustering is not detrimental to CD's efficiency.More precisely, we found that the value of r 1 (max.iterations of K -means, after the initial centroids were decided) had no observable effect on CD's efficiency.Therefore, we simply set r 1 = 1.The same generally holds for r 2 , although to prevent ruinous effects due to coincidentally very poorly chosen initial centroids, we set r 2 = 50.Still, the clustering takes at most a few seconds in our experiments, which is negligible compared to the total execution time of the algorithm.

Threshold queries
CD receives as input the cluster tree produced by the hierarchical clustering algorithm, a correlation pattern, and a correlation threshold τ .It then forms all possible combinations of the correlation pattern with the child clusters of the root.In the example of Fig. 2b, for a desired correlation pattern of PC(2, 1), the following combinations of clusters are examined: Note that we now present the algorithm for finding all interesting triplets following correlation pattern PC (2,1).In reality, CD also considers all sub-patterns of the queried correlation pattern (e.g., PC(1, 1)) by re-running the same algorithm on those sub-patterns.
A combination of clusters compactly represents the combinations created by the Cartesian product of the vectors inside the clusters.For example, assuming that |C x | = 4 and |C y | = 3, the cluster combination (C x , C y ) represents a set of 12 vector combinations, which we will refer to as its materializations.For each cluster combination, the algorithm computes lower and upper bounds on the correlation of its materializations, denoted with L B and U B, respectively (Algorithm 1, line 1).These bounds guarantee that any possible materialization of the cluster combination, i.e., replacing each cluster with any one of the vectors in that cluster, will always have a correlation between L B and U B.
The next step is to compare the bounds with the userchosen threshold τ (lines 2, 4, 6 is decisive negative-no materialization yields a correlation higher than the threshold τ .Therefore, this cluster combination does not need to be examined further.If L B ≥ τ , the combination is decisive positive, guaranteeing that all possible materializations of this cluster combination will have a correlation of at least τ .Therefore, all materializations are inserted in the result.Finally, when L B < τ and U B ≥ τ , the combination is indecisive.In this case, the algorithm (lines 7-11) chooses the cluster C max with the largest radius, 4 and recursively checks all combinations where C max is replaced by one of its sub-clusters.In the example of Fig. 2b, assume that the algorithm examined an indecisive combination of clusters C 1 , C 2 , C 3 , and C 2 is the cluster with the largest radius.The algorithm will drill down to consider the three children of C 2 , and examine their combinations with C 1 and C 3 .The recursion continues until each combination is decisive.
We will refer to this process as traversing the comparison tree.Decisive combinations are typically found at high levels of the cluster tree, thereby saving many comparisons.In the following, we will discuss two different approaches for deriving L B and U B for arbitrary correlation patterns.The first approach (theoretical bounds) has constant complexity in the number of materializations a cluster combination covers.The second approach (empirical bounds) extends the theoretical bounds with additional information.It has a slightly higher cost, but typically leads to much tighter bounds.

Theoretical bounds
We first present a lemma for bounding the cosine similarity between only two clusters, which serves as a stepping stone for bounding multivariate correlations.
Lemma 1 Let cos(θ x,y ) denote the cosine similarity between two vectors x and y, with θ x,y being the angle formed by these vectors.Consider four vectors u 1 , u 2 , v 1 , and v 2 , such that θ v 1 ,u 1 ≤ θ 1 and θ v 2 ,u 2 ≤ θ 2 .Then, cosine similarity cos(θ u 1 ,u 2 ) can be bounded as follows: where Proof All proofs are included in Appendix A of the Technical Report [12] Lemma 1 bounds the cosine similarity between two vectors u 1 and u 2 that belong to two clusters with centroids v 1 and v 2 , respectively, by using: (a) the angle between the two centroids, and, (b) upper bounds on the angles between u 1 and v 1 , and between u 2 and v 2 .For instance, in the running example (Fig. 2b), we can bound the cosine between a and b if we have the cosine of the two cluster centroids d and e, the cosines of a with d, and of h with e (as h is the furthest point in C 2 from the centroid e).The bounds are tightened if the maximum angle formed by each centroid with its corresponding cluster vectors is reduced.We now extend our discussion to cover multivariate correlations, which involve three or more clusters.

Theorem 1 (Bounds for PC) For any pair of clusters C i , C j , let l(C i , C j ) and u(C i , C j ) denote lower/upper bounds on the pairwise correlations ρ between the cluster pair's materializations, i.e., l(C
Then, for any two sets of z-normalized vectors 5 As Pearson correlation is equivalent to cosine similarity when computed over z-normalized vectors, we can use Lemma 1 to compute bounds on the pairwise correlations between any pair of clusters, which allows us to compute the bounds in Theorem 1. Consequently, we can bound the multivariate correlation of any cluster combination that satisfies the PC correlation pattern, without testing all its possible materializations.For example, for combination ((C 1 , C 2 ), C 3 ) from our running example, we first use Lemma 1 to calculate bounds for all cluster pairs in O(1) per pair, which leads to values for L(•, •) and U (•, •).The bounds on PC((C 1 , C 2 ), C 3 ) then follow directly from Theorem 1.

Theorem 2 (Bounds for MP) For any pair of clusters C i , C j , let l(C i , C j ) and u(C i , C j ) denote lower / upper bounds on the pairwise correlations between the cluster's materializations, i.e., l(C
is the smallest eigenvalue of matrix L+U 2 .
Similar to Theorem 1 for PC, we can use Lemma 1 to compute the bounds on the pairwise correlations between any pair of clusters, which allows us to compute the bounds of Theorem 2, and to analyze the MP values of all materializations of the cluster combination in one go.
Theorems 1-3 are built on the observation that the multivariate correlation of a set of vectors can be expressed as a function of the pairwise relations exhibited by the vectors in that set.Then, this (exact) expression of a multivariate correlation among individual vectors is extended to bounds on the multivariate correlation among clusters of vectors, which are in turn bounded by Lemma 1.
Although the Total Correlation of a set of vectors X cannot be expressed as a function of cosine similarities, it can be bounded by other pairwise relations, namely conditional entropies with two variables [35].This enables us to express bounds the TC-value of a set of vectors as a function of correlation bounds between pairs of clusters, similar to the previous Theorems [52].How these bounds on cluster pairs are computed (and tightened) in the absence of Lemma 1 will be discussed in the following section.
Note that Theorem 4 bounds apply to both discrete and continuous data, using differential entropy for the latter case.In case exact probability functions are unknown for continuous data, one can derive empirical distribution functions through discretization.

Tightening the bounds
Empirical pairwise bounds.The bounds of Lemma 1-which are used for deriving the bounds of Theorems 1, 2, and 3tend to be pessimistic, as they always account for the worst theoretical case.In the example of Fig. 2c, the theoretical lower bound (resp.upper bound) accounts for the case that hypothetical vectors (depicted in pink) are located on the clusters' edges, resulting in the smallest (resp.largest) possible distance between any pair of points in the clusters.
Tightening the bounds on cosine similarities will in turn tighten the bounds on PC, MP, and ES, which will lead to more aggressive pruning power of the algorithm described earlier in this section.The empirical bounds approach builds on the observation that the cosine similarities of any pair of vectors x i , x j drawn from a pair of clusters C i , C j , respectively, is typically strongly concentrated around (l(C i , C j ) + u(C i , C j ))/2, especially for high-dimensional vectors.The approach works as follows.At initialization, we compute all (pairwise) cosines and store these in an upper-triangular matrix.Then, during execution of Algorithm 1, we compute l(C i , C j ) and u(C i , C j ), when required, as follows: with cos(θ x,y ) retrieved from the upper-triangular matrix.The computed l(C i , C j ) and u(C i , C j ) are also cached and reused whenever (C i , C j ) is encountered in another cluster combination.
It is important to note that the empirical bounds do not induce errors, since they trivially satisfy the requirements of Theorems 1-3 that l(C i , C j ) ≤ min x∈C i ,y∈C j cos(θ x,y ) and u(C i , C j ) ≥ max x∈C i ,y∈C j cos(θ x,y ).Therefore, the bounds of multivariate correlations derived using these empirical bounds are still correct.Finally, they are at least as tight as the bounds of Lemma 1, since they account only the vectors that are actually present in the clusters and not the hypothetical worst case.
There is a clear tradeoff between the cost of computing the empirical pairwise bounds (worst case, quadratic to the number of vectors), and the performance improvement of CD from the tighter bounds.Indicatively, in our experiments, the theoretical pairwise bounds computed from Lemma 1 were typically between two to eight times wider compared to the empirical pairwise bounds.Exploiting the tighter empirical bounds led to a reduction of the width of the bounds of Theorem 1 by 50% to 90% (for PC(1, 2)), which empowered CD to reach to decisive combinations faster.As a result, total execution time of the algorithm with empirical bounds was typically an order of magnitude less than the time with the theoretical bounds.Therefore, all reported results will be using the empirical bounds.
Lastly, note that the empirically-bounded versions of Theorem 1 and 2 do not require z-normalization.Still, it is performed in both cases to optimize pairwise cache computation and to ensure that MP ∈ [−1, 1], as suggested in [3].However, z-normalization does not impact relative distances and therefore the top-κ query answers are identical.Total Correlation bounds.The empirical bounding approach can also be used to compute bounds on the (conditional) entropies between pairs of clusters, which are key in computing the TC bounds of Theorem 4. As H (A|B) = H (A, B) − H (B), this can be done by (a) pre-computing and caching all marginal entropies and (pairwise) joint entropies of vectors, and, (b) iterating over the Cartesian products of clusters to derive bounds on the entropies of cluster materializations.
Notice that the lower bound of TC(X ) (see Theorem 4) involves iterating over S in sequence, which indicates a dependency on the ordering of clusters in S. Thereby, finding the optimal permutation of S that produces the tightest bound will increase the lower bound without introducing errors in the result set.The total number of permutations is O( p!), where p is the number of vectors in the correlation pattern.
Here we introduce a heuristic that costs O( p 2 ).The heuristic, shown in Algorithm 2, computes a tight upper bound Output: Upper bound on the joint entropy of materializations of on the joint entropy H (X ), 7 by iterating over the sorted list of marginal and conditional entropies to find a selection of entropies that closely estimates H (X ).Note that, for conciseness, Algorithm 2 line 3 indicates we always fetch a conditional entropy H (C i |C j ) from the head of the queue H.However, as H also contains marginal entropies H (C i ), the condition may also be empty.Choosing a distance measure for clustering.The empirical pairwise bounds tighten the bounds on correlations between cluster pairs, leading to also tighter multivariate correlation bounds, and improved efficiency of CD.Tightness of the empirical bounds depends on the cluster radius-clusters with large radii lead to weaker, albeit correct, bounds.This is clear for PC, ES, and MP, where triangle inequality is also present in the theoretical bounds (see Sect. 3.2.1).However, our experiments have shown that tuning the clustering distance measure also benefits TC queries, even though TC does not satisfy the triangle inequality.Therefore, the clustering distance measure always impacts the pruning power of the algorithm.
As Lemma 1 is based on angular distance, clustering for PC and MP employs the clustering loss function (WCSS) with angular radii.For ES, Euclidean distance is the obvious choice, since it also considers vector norms, which are not captured with the angular radii but are included in Theorem 3. Finally, for TC, our experiments showed that the normal- (first introduced in [27]) leads to tight multivariate correlation bounds.The intuition behind this observation is that D(X , Y ) measures information proximity, similar to TCin fact, D(X , Y ) is simply a transformation of the pairwise total correlation (i.e., mutual information) between two variables to a strict distance metric ranging between 0 and 1 [26].Table 2 summarizes these choices.

Handling of additional constraints
CD supports both the irreducibility and minimum jump constraints, as described in Sect. 2. For irreducibility, the process of identifying whether a simpler combination exists requires testing whether a combination of any of the subsets of S l and S r is already contained in the answers.
To avoid the cost of enumerating all O(2 |S l |+|S r | ) subsets during the execution of Algorithm 1, only the pairwise correlations between any two clusters C l ∈ S l and C r ∈ S r are examined.
Precisely, we use l(C l , C r ), which is already computed for Theorems 1-4.If there exist C l , C r s.t.l(C l , C r ) ≥ τ , then any solution that can be derived from further examining the combination (S l , S r ) cannot satisfy the irreducibility constraint.Therefore, (S l , S r ) can be discarded.The case of minimum jump is analogous: where UB is calculated as in line 1 of Algorithm 1, then the combination is discarded.
By considering only the pairwise correlations during the pruning process may lead to inclusion of answers that do not satisfy the constraints.Such combinations are filtered from the query result before returning it to the user.Since the number of answers is typically in the order of a few tens to thousands, this final pass takes negligible time.
Both MP and TC have the property that correlation can only increase when adding an extra variable (i.e., TC(X ∪ {y}) ≥ TC(X ).We refer to this property as the monotonicity over increasing pattern length.This reduces the relevance of MP and TC threshold queries without any constraints, as for any TC(X ) ≥ τ with X ⊂ V, all supersets of X will be in the result set, making it more cluttered.Therefore, we disallow such queries for MP and TC, defaulting to the addition of the irreducibility constraint.Note that we could still answer unconstrained queries on MP and TC, essentially cost-free, by expanding the result set R as follows: However, we refrain from doing so as these additional results do not provide new insights to the user.

Top-k queries
The top-κ variant addresses this issue by allowing users to set the desired number of results, instead of τ .The answer then includes the κ combinations of vectors with the highest correlation that satisfy the correlation pattern.
Assuming an oracle that can predict the τ that would yield exactly κ results, the top-κ queries could be transformed to threshold queries and answered with the standard CD algorithm.Since such an oracle is impossible, many topκ algorithms (e.g., Fagin's threshold algorithm [16]) start with a low estimate for τ , and progressively increase it, by observing the intermediate answers.The performance of these algorithms depends on how fast they can approach the true value of τ , thereby filtering candidate solutions more effectively.
The top-κ variant of CD (see Algorithm 3) follows the same idea.The algorithm has the same core as the thresholdbased variant, and relies on three techniques to rapidly increase τ .Top-κ pairwise correlations First, at initialization, input parameter τ is set to the value of the κ'th highest pairwise correlation.Since all pairwise correlations are computed for the empirical bounds, this causes zero additional cost.Exploiting (soft) monotonicity.The second technique is inspired by the property of monotonicity of MP and TC, which implies that multivariate correlations can only increase when adding an additional variable (i.e., vector) to the set (i.e., correlation pattern).Thereby, given the top-κ combinations of size s, R s , one can guarantee that any combination of size s + 1 that is a superset of a combination in R s will have a correlation greater than the lowest correlation in R s , and will lead to an increase of threshold τ .
This observation is exploited by exhaustively computing the correlations of all possible supersets of size s + 1 after finding R s , in order to quickly increase τ before traversing the comparison tree with combinations of size s + 1 to construct R s+1 .This technique showed to be very effective for all correlation measures (despite PC and ES not possessing the monotonicity property), as many of the supersets of R s were also included R s+1 .Prioritization of candidates The last technique is an optimistic refinement of the upper bound, aiming to prioritize the combinations with the highest correlations.The algorithm is executed in two phases.In the first phase, similar to Algorithm 1, the algorithm traverses the comparison tree in a Breadth-First manner (BFS), and computes the upper and lower bound per combination.However, it now artificially tightens the bounds by decreasing the value of the upper bound as follows; where γ ∈ [−1, 1] is a shrink factor parameter with a default value of 0. Now, decisiveness of cluster combinations is determined based on (L B, U B shrunk ) analogous to Algorithm 1, with an exception of the case where U B shrunk ≤ τ < U B (Algorithm 3 lines 3,7,12).In this case, the cluster combination is postponed for further inspection, and placed in a priority queue based on the combination's critical shrink factor γ * -the minimum value of γ for which U B shrunk surpasses τ (lines 12-14).Intuitively, a small γ * means that the combination (i.e., branch in the comparison tree) is more Algorithm 3: Top-κ-Query(S l , S r , Corr, τ , κ, γ ) Input: Sets of clusters S l and S r that adhere to the user-defined correlation pattern.correlation measure Corr, starting threshold τ , desired output set size κ, shrinkfactor γ .
Add the contents of (S l , S r ) to the result set R promising to lead to higher correlation values as a large portion of its bound range (U B − L B) exceeds τ .In the second phase (lines 15-18), postponed branches are traversed in a Depth-First manner (DFS) by invoking Algorithm 1 on each combination sequentially.Since τ continuously increases, and the first branches are likely to contain the highest correlation values, most lower-priority branches do not need many cluster splits to reach decisive combinations.Similar to the previous optimizations, the value of γ only impacts efficiency of the algorithm, and not completeness of the results.Our experiments (see Sect. 5) have shown that values of gamma around 0 lead to a good balance between DFS and BFS exploration.

Progressive queries
The prioritization technique of Algorithm 3 can also be used as a basis for a progressive threshold algorithm.Precisely, Algorithm 3 can be initialized with a user-chosen τ and with κ → ∞.This will prioritize the combinations that will yield the strongest correlations, and thus also the majority of correlations larger than τ .Prioritization is frequently useful in exploratory data analytics: the user may choose to let the algorithm run until completion, which will yield results identical to Algorithm 1, or interrupt the algorithm after receiving sufficient answers.Recent work also established accurate (any-time) prediction of result completeness and distance for kNN queries [14].Although valuable, their methods require significant adaptations for our queries and are thus deferred to future work.We evaluate CD on all proposed query types in Sect.5.2.

Detection of multivariate correlations in streaming data
Data is frequently observed as a live stream.For example, in finance, asset prices may need to be monitored in real-time for detecting strong correlations in a market, for portfolio diversification [39].In weather monitoring, real-time detection of correlations may reveal interesting short-term weather events, whereas in server monitoring, detection of unexpected correlations, e.g., on server requests originating from many different IP addresses, may reveal attempts of attacks [44].Similarly, in neuroscience, real-time analysis of fMRI streams to detect correlations brings novel exploitation opportunities, e.g., for neurofeedback training [22,31,54].
Our streaming algorithm, called CDStream, builds on top of CD such that it maintains CD's solution over a sliding window as new data arrives.CDStream does this efficiently by storing the decisive cluster combinations in a custom index, which can subsequently be used after each streaming update to quickly identify the potential changes to the result set.Clearly, the main challenge is to construct, maintain, and utilize this index efficiently, for processing streams with high update rates.CDStream supports PC and ES correlation measures.In the remainder of this section, we will explain the underlying stream processing model and CDStream algorithm in detail.We will also present an extension to CDStream named CDHybrid, which dynamically switches between CDStream and repeated execution of CD in order to adapt to sudden events and concept drift, and improve robustness.

Stream processing model
CDStream builds on the basic windows model, which is widely used for processing of data streams, e.g., in [19,24,51,53].The model works as follows: the sliding window, of length w, is partitioned to a set of smaller, fixed-length sub-windows (often called basic windows), each of length b.All stream updates received within a basic window are processed (typically aggregated), to generate a single value for that basic window.In other words, the basic windows define the time resolution handled by the algorithm.
The introduction of basic windows offers several benefits: (a) it makes the results robust to outliers, noise in the data, and time series with small-period oscillations, e.g., stocks with high trading volumes, (b) it allows for handling time-misaligned and out-of-order arrivals, which are fairly common in real-life data streams (e.g., stock ticks, sensors with variable measurement intervals, weak/slow network connections), and (c) it allows efficient handling of streams with high update rates.At the same time, this approach introduces a-potentially significant-delay on the results, which can be as large as b time units.The latter constraint becomes limiting when processing periods of high activity (e.g., in high-volatility periods of a stock market, or when a network is under a DDoS attack), where it is critical that the user observes intermediary results as soon as possible.
CDStream alleviates this limitation by disentangling the period of recomputing the results (the key reason behind the stale results) with the length of the basic window b.The model, called BW + hereafter, offers an extra knob to the user, called epoch, which controls the acceptable delay/lag for the algorithm to account for new data.When epoch is set to be equal to b, BW + degenerates to the standard basic windows model, e.g., as used in [53].However, by setting epoch to be less than b, the algorithm is instructed to recompute the results more than once within the period of a basic window, accounting also for the new arrivals in the incomplete basic window.The aggregation unit remains unchanged, i.e., the basic window of size b, which allows meaningful handling of time misalignment, noise and outliers.Furthermore, all completed basic windows are not impacted by the epochhence their aggregate values are not recomputed.However, whenever an epoch is completed, the algorithm updates the aggregate value for the incomplete basic window and updates the multivariate correlations, to include these new values.
As an example, consider the stream depicted in Fig. 3. Assume that epoch is set to 5 msec, and the basic and sliding window lengths, b and w, are set to 20 and 100 msec, respectively.Then, at time 100, BW + will have identical results to the standard basic windows model.At time 105, BW + will recompute the results, accounting for the values that arrived in basic windows 1-5, and within the first five seconds of the (still incomplete) basic window 6.Therefore, if in the period between time 100 and 105, there were drastic changes that led to updates of the results, these will be detected by BW + .The same process will be repeated at times 110 and 115, whereas at time 120, basic window 1 will expire and the results of BW + will again become identical to the output of the standard basic windows model (not shown in figure intact-it does not change their boundaries when an epoch is complete.As we will explain in the following section, this is leveraged by CDStream to optimize performance by avoiding to store, or recompute, fine-grained partial results.We will come back to the discussion about the properties of BW + , and its impact in terms of computational efficiency and accuracy/completeness of the results of the algorithm in Sect.4.4.Time-based vs arrival-based epoch.Even though our previous discussion assumed that epochs are defined in time units (seconds, minutes, etc.), this does not constitute a requirement of the model.Epochs can also be defined in number of arrivals (e.g., every 10 arrivals).A definition based on number of arrivals may be preferred in use cases where the arrival rate of the streams changes abruptly, e.g., during a market crash.

Algorithm core
We start with a high-level description of CDStream before going over the details of the underlying custom index, which is instrumental for increasing the throughput of the algorithm.CDStream receives as an input the set of streams, and the configuration parameters of the algorithm-length of the sliding window w and basic window b, epoch, and query threshold.The algorithm starts by executing CD on the last w arrivals in the given streams, and prints the initial results to the user.A byproduct of CD is an upper-diagonal matrix that stores the pairwise correlations between all pairs of streams.We will refer to this as the pairwise correlations cache.Then, CDStream enters the monitoring phase.In this phase, whenever an epoch is completed, the algorithm (shown in Algorithm 4) first detects all streams that have at least one update and recomputes the corresponding aggregate for the last (potentially still incomplete) basic window (line 2).It then refreshes the cache of pairwise correlations, to account for the new arrivals (lines 3-4).Notice that this step does not recompute the correlations from scratch; it updates them from the previous correlation values and the change in aggregate value for the running basic window.Following, the algorithm goes through all updates within the epoch, and checks whether these could lead to changes in the result set (either new additions in the result or removals).This process is supported by a custom-build index, which returns all decisive cluster combinations with bounds impacted by the newly arrived updates.These impacted bounds are then reassessed using Algorithm 1, in order to detect the potential changes in the result set, and to update the index (Algorithm 4 lines 5-9). 8The described steps are repeated for epoch/b epochs, after which a basic window is completed.In that case, CDStream will additionally remove the expired basic window, add the newly-completed basic window, and keep repeating the above process (not depicted in Algorithm 4).
In the remainder of this section we will look at the custom index, and how this is maintained and utilized by CDStream.The DCC index In short, the index is used for storing a collection of thresholds, that, when fired, signify a potential change in the answer set. 9Particularly, the core idea is to store decisive cluster combinations (abbreviated as DCCs) for all clusters, and enable re-validating only these after every stream update.Recall that each stream s belongs to a hierarchy of clusters.For example, vector e in Fig. 2b belongs to C 2 and C 7 .For a stream s, we denote the set of these clusters as C(s).By construction, the algorithm takes a decision concerning any stream s based solely on the decisive combinations including any cluster in C(s) (see the theoretical results in Sect.3.2.1).As long as those decisive combinations are still valid, the final result will remain correct and complete.
A naive approach would be to construct an inverted index that maps each cluster to the decisive cluster combinations it participates in.Then, after any update of a stream s, we would look at all clusters in C(s), and find and re-validate all their decisive combinations from the index.The use of this index could become too slow for some use cases, particularly for large correlation patterns, due to the potentially large number of decisive combinations associated with each cluster that need to be checked.Two key observations can be exploited to optimize the use of this index: (a) the empirical correlation bounds described in Sect.3.2.2do not depend on all streams contained in the cluster, but are determined solely by l(C i , C j ) and u(C i , C j ), the minimum and maximum pairwise correlations between all involved clusters in the combination, and (b) the previous applies independent of the number of the clusters contained in the left and right side of the cluster combination.Therefore, the DCC index is designed around these minimum and maximum pairwise correlations.Figure 4a depicts an example of the internal organization of the DCC index.At the outer layer, the index is an inverted index that maps each stream s to a list of extrema pairs.A pair of streams is called an extremum pair if there exists at least one cluster combination for which this pair constitutes a determining pair, i.e., it is the pair determining the value of l(C i , C j ) or u(C i , C j ).For example, in Fig. 2c, the minimum and maximum extrema pairs for (C 2 , C 3 ) are h, g and b, f , determining the minimum value l(C i , C j ) and maximum value u(C i , C j ), respectively.At the inner layer, for each extremum pair ep we keep a list of all opposite clusters, i.e., the clusters that do not include s, and participate in at least one decisive cluster combination having ep as an extremum pair.For example, focusing at c in Fig. 4a, we see that one of its extrema pairs is b, f , which is reused by both clusters C 2 and C 8 .The clusters are stored in decreasing size, i.e., the cluster at position i + 1 will be a sub-cluster of the cluster at position i.For each cluster, we store all decisive combinations, and whether these are positive or negative.In our running example, for cluster C 2 we have a negative combination (C 2 , C 3 ) and a positive combination (C 1 , (C 2 , C 3 )).This way of indexing and querying ensures that we only revalidate DCCs with an actual change in bounds, and that this set is complete (i.e., we do not miss any violations).
When an update is observed at stream s, the first step is to use the index for retrieving all extrema pairs that involve a cluster in C(s).For each extremum pair, we check the pairwise cache whether the pair has changed as a result of the last update.This will happen, e.g., if the update of s has caused s to form a new extremum pair with another stream, replacing an older pair.If the extremum pair has not changed, we can skip all contents grouped under this pair altogether.In our running example, if c has been updated, but b, f is still a valid extremum pair for cluster C 2 , no further validations are needed for any of the combinations involving C 2 .Furthermore, no validations are required for the combinations involving C 8 (and any other clusters following C 2 with the same extremum pair), since C 8 is a strict subset of C 2 (recall that the clusters are ordered based on their size).If, on the other hand, the update has invalidated an extremum pair, the algorithm drills into the contents of the inner layer, and goes over the clusters sharing this extremum pair.If, e.g., c was updated and b, f is no longer an extremum pair for C 2 , we need to check and adjust all combinations stored for C 2 (in this example, (C 2 , C 3 ) and (C 1 , (C 2 , C 3 ))).This is done by adjusting the extrema pairs and bounds using Theorems 1 and 3, re-validating whether the combination is still decisivepositive or negative, and updating the solution accordingly.In this step, the algorithm may even need to break a cluster to two or more sub-clusters, until it again reaches to decisive combinations.However, again, as soon as we find a cluster for which the extremum pair does not change after the update, we can move to the next extremum pair.

User constraints and top-Ä queries
To support the minimum jump and irreducibility constraints, additional triggering functionalities, further described below, are added to the index of CDStream.
We need to detect two additional cases: (1) (X , Y ) needs to be removed from the result set because (X , Y ) just surpassed τ , and, (2) (X , Y ) needs to be added in the result set, because (X , Y ) was just removed from the result set because its correlation dropped below τ .Both cases can be triggered by an update of a vector from X or Y (hence, also from X and Y ).Without the irreducibility constraint, the index contains the following extrema pairs: (a) for the negative decisive combinations, the pairs required for upper bounding the correlation, (b) for the positive decisive combinations, all pairs required for lower-bounding the correlation.The irreducibility constraint requires also monitoring of the upper bounds of positive decisive combinations (e.g., for case (1), when an increase of Corr(X , Y ) will cause the following condition to hold: Corr(X , Y ) > τ which will mean that (X , Y ) need to be removed from the result set) and the lower bounds of negative decisive combinations with any Corr(X , Y ) > τ.These decisive combinations are also added in the index, under the extrema pairs, and checked accordingly.Minimum jump constraint.Monitoring for the minimum jump constraint is analogous to the irreducibility constraint.The following cases need to be considered: (1) (X , Y ) needs to be removed from the result set because Corr(X , Y )+δ > Corr(X , Y ), and (2) (X , Y ) needs to be added in the result set because Corr(X , Y ) + δ < Corr(X , Y ).Both cases are identified using the discussed method for monitoring the irreducibility constraint.

Top-κ queries
Recall that CDStream is initialized with the result of CD.For a top-κ query, CDStream queries CD for a slightly larger number of results κ = b k * κ, where b k is a small integer, greater than 1.CDStream finds the minimum correlation in these results, and uses it as a threshold τ in the streaming algorithm.As long as the size of the result set is at least κ, the true top-κ results will always have a correlation higher than τ and will be contained in the top-κ results maintained by the algorithm.Therefore, the top-κ out of the detected top-κ correlations are returned to the user.
Scaling factor b k controls the tradeoff between the robustness of the streaming algorithm for top-κ queries, and its efficiency.Setting b k = 1 may lead to the situation that, due to an update, fewer than κ results exist with correlation greater than or equal to τ .CDStream then fails to retrieve enough results, and resorts to CD for computing the correct answer, and updating its index.Conversely, a large b k will lead to a larger number of intermediary results, and to more effort for computing the exact correlations of these results, which is necessary for retaining the top-κ results.Our experiments with a variety of datasets have shown that b k = 2 is already sufficient to provide good performance without compromising the robustness of CDStream.We evaluate CDStream in Sect.5.3.

Impact of the extended basic window model on CDStream
Recall that CDStream leverages the proposed extended basic window stream processing model (abbrev.as BW + ) in order to identify updates on the result set earlier.By construction, BW + is at least as good as the standard basic windows model in terms of completeness of the result set, since it replicates its behavior every time a basic window is completed.The further improvement that we can expect from BW + -compared to the standard basic windows model-depends on the volatil-ity of the input streams.In periods where the input streams contain negligible changes, BW + will detect very few additional correlations (if any), compared to the standard model.In periods of high volatility, such as market crashes, BW + will detect updates and new correlations faster.
To examine the importance of BW + and evaluate its impact on the computational efficiency of CDStream, we compared the results of CDStream, with and without BW + .Figure 4b presents the number of results (left axis) and runtime (right axis) of CDStream of the two models.The results correspond to processing of a stream with minute-granularity stock prices of 1000 stocks on 16 March 2020 (the dataset is further described in Sect.5).This day was selected because it was the day of the largest price drop in the 2020 Covid crash [1].As ground truth, we used the results of CD on the same input dataset (without basic windows), recomputed at the end of each epoch.
We see that BW + is able to identify jumps in the number of results significantly earlier than BW.Comparison with the ground truth revealed that BW + maintained a recall of 97.8% during this period while BW recall decreased to 69.0%.From epoch 0 to 60 (prior the crash), the recall of BW + was 100%.
It is also interesting to consider execution time per basic window.Since the new model subsumes the basic window model, it is slightly more expensive to maintain.However, extra computation is only around 10%, for the more-detailed epoch.This extra computation can of course be adjusted, by increasing the epoch length.Therefore, all experiments hereafter will only focus on the BW + model.

CDHybrid: combining CD and CDStream
Recall that CDStream handles the stream updates in epochs.The algorithm exhibits high performance when the updates do not drastically change the results set.In streams where the answer changes abruptly, it may be more efficient to simply run CD after the completion of each epoch and recompute the solution from scratch, instead of maintaining CDStream's index and the result through time.CDHybrid is an algorithm that orchestrates CD and CDStream, transparently managing the switch between the two algorithms based on the properties of the input stream.
To decide between CD and CDStream, CDHybrid needs to estimate the cost of both approaches for handling an epoch.A good predictor for this is the number of arrivals in the epochmore arrivals tend to cause more changes in the result, which takes longer for CDStream to handle.Therefore, CDHybrid starts with a brief training period, where it collects statistics on the observed arrival count and execution time of the two algorithms.Simple (online) linear regression is then used to model the relationship between execution time and the observed number of arrivals.Note that the coefficients of a simple linear regression model can be maintained in constant time and space.Therefore, the regression model is continuously updated, even after the training phase.Switching from one algorithm to the other works as follows.Switching from CDStream to CD.We cache the current results of CDStream (we will refer to these as R CDStream ) and stop maintaining the index.When an epoch is completed, the vectors are updated and passed to CD for computing the result.Switching from CD to CDStream.Since the stream index was not updated for some time, we need to update it before we can use it again.We compute the symmetric difference Δ of the current results of CD (denoted as R CD ) with the last results of CDStream R CDStream .Any result r contained in Δ ∩ R CDStream is due to a positive decisive combination that has now become negative, whereas any r contained in Δ∩R CD leads to a new positive decisive combination.In both cases, the algorithm updates the index accordingly.There is also the case that a decisive combination becomes indecisive.In this case, the algorithm recursively breaks the combination further, as shown in Algorithm 1.We evaluate CDHybrid in Sect.5.3.3.

Evaluation
The purpose of our experiments was twofold: (a) to assess the scalability and efficiency of our methods, and, (b) to compare them to a series of baselines.The baselines include the state-of-the-art algorithms for multivariate correlation discovery [2,3], two variants of an exhaustive search algorithm, as well as multiple modern database management systems (DBMS) that can be used to detect multivariate correlations.Our evaluation does not consider the practical significance of multivariate correlations, as this was already extensively demonstrated in earlier works and case studies from different domains, e.g., [2,3,29] (see Sect. 1 for more examples).Still, to ensure that our evaluation is conducted on data where detection of multivariate correlations has practical significance, we also compare our methods with the data used in these past case studies (or data of the same type, where the original data was inaccessible).Hardware and implementations.All experiments, except for the comparison with the DBMS systems, were executed on a server equipped with two Xeon E5-2697v2 12-Core 2.70 GHz processors, and 500GB RAM.For CoMEtExtended and CONTRa, we used the original implementations, which were kindly provided by the authors [2,3].We additionally configured the implementation of CoMEtExtended in order to use all available cores of our server.Consequently, all implementations, except CONTRa and two DBMS, were multi-threaded.Algorithm performance comparisons are exclusively made under matching execution styles (e.g., comparing single-threaded CD only to CONTRa and DBMS).All implementations, except of the UNOPT exhaustive search Datasets.We present extensive evaluation results on seven datasets, coming from distinct disciplines (neuroscience, finance, crypto trading, climate science, and machine learning).See GitHub for download links, pre-processing steps, instructions, and code for reading and processing the data.
• Stocks.Daily closing prices of 28678 stocks over the period Jan. 2, 2016 to Dec. 31, 2020 leading to 1309 observations.For the streaming experiments, we used the minute closing prices of the stocks.• fMRI.Functional MRI data of a person watching a movie. 10Five datasets were extracted by mean-pooling the data with kernels of different size, leading to 237, 509, 1440, 3152, and 9700 time series, respectively, all of 5470 observations.A similar dataset was used in the case study of [2].• SLP & TMP.Segment of the ISD weather dataset [37] containing sea level pressure (SLP) and atmospheric temperature (TMP) readings of 3222 sensors.CD was evaluated on the daily average values between January 1, 2016 and December 31, 2020, leading to 2927 readings per time series.Streaming experiments were run on hourly sensor measurements.
• SLP-small.Sea Level Pressure data [25], as used in the case study of [3].The dataset contains 171 time series, each with 108 observations.• Crypto.3-hour closing prices of 7075 crypto-currencies, each with 713 observations, covering the period from April 14, 2021 to July 13, 2021.Streaming experiments were run on minute-level closing prices.• Deep.A billion vectors of length 96, obtained by extracting the embeddings from the final layers of a convolutional neural network [41].
Whenever needed, we obtain subsets of these datasets with random sampling.To avoid repetition, in the following we will mention the experimental configuration only when this deviates from the default configuration, described in Table 3.The remaining section is organized as follows.We start with a comparison of our methods to the baselines (Sect.5.1), and then conduct an extensive sensitivity analysis of CD (Sect.5.2) and CDStream (Sect.5.3).

Comparison to the baselines
We start by comparing CD to the baselines: (a) two algorithms based on exhaustive search, (b) commercial and open-source modern database management systems, (c) CoMEtExtended [3], and (d) CONTRa [2].Our experiments compare both efficiency and recall of all systems for threshold queries.Comparison to exhaustive search baselines No other solution covers CD's range of queries and correlations.For reference on the complexity of the problem, we constructed two baselines (UNOPT and OPT) that exhaustively compute all multivariate correlations by iterating over all possible combinations of vectors.OPT reuses cached pairwise correlations (exploiting our results presented in Sect.3.2), whereas UNOPT recomputes them for every combination.This comparison only focuses on execution time, as all methods have perfect precision and recall.
Figure 5 plots the time required from CD, UNOPT, and OPT to execute a threshold query on different subsets of Stocks, with sizes up to 12,800 vectors.All algorithms were given at most 8 h to complete.The thresholds were selected such that all correlation measures bring approximately the same number of results on each dataset.Our first observation is that execution time of CD grows at a much slower rate compared to both baselines, for all correlation measures.Furthermore, the difference in efficiency increases with dataset size, which stresses the importance of having an efficient solution like CD.Therefore, CD can handle significantly larger datasets than the baselines.
Comparing OPT to UNOPT, we see that caching of the pairwise correlations improves performance for ES, PC, and MP, but not for TC.This is because TC is not amenable to the caching optimization, i.e., the TC of three or more vectors cannot be expressed as a linear combination of the pairwise TC values.Yet, even for the other three measures, OPT still times out for larger datasets.The fact that CD scales better than OPT indicates that its core performance boost comes from the way it utilizes the cluster bounds.Comparison to contemporary DBMS CD's operation can be expressed as an SQL query, as shown in Fig. 6a, which shows a PC(1, 2) threshold query on a (z-normalized) table named "fmri" in SQL.This observation allows us to compare performance of CD with general-purpose state-of-the-art RDBMS.Our experiment used four off-the-shelf databases, all configured with RAM-stored tables for equitable evaluation, given CD's RAM usage.DBMS1 and DBMS3 supported array attributes, so we developed array functions for Pearson correlation calculation.The other DBMSs stored data in long format (with columns corresponding to a primary key, vector id, time, and value), utilizing a SPSVERBc1 clause for Pearson correlation.Due to limited multi-threading support, all approaches, including CD, ran single-threaded with an eight-hour query limit.
Figure 6b shows the execution times for each system to detect PC(1, 2) on different resolutions of the fMRI dataset.The reported DBMS times do not include the one-off costs of loading the dataset in the DBMS and creating the indices.We see that CD outperforms all DBMS by several orders of magnitude, and the difference between CD and the baselines increases with dataset size.In particular, time complexity for all DBMS seems to follow O(n 3 ) for performing a triple nested loop (n is the number of vectors), whereas CD's execution time grows at a much slower rate.Furthermore, the results indicate that all DBMS perform similarly to an exhaustive search algorithm, iterating over the full search space.
Comparison to CoMEtExtended Our next experiment was designed to compare CD with CoMEtExtended [3].CoME-tExtended's goal differs slightly from our problem statement.First, CoMEtExtended is approximate without guarantees.Still, its recall can be tuned by parameter ρ CE , which takes values between −1 and 1.Values around 0 offer a reasonable tradeoff between efficiency and recall [3].In contrast, CD delivers complete answers, making execution time and recall both relevant in our comparison.Second, CoMEtExtended focuses on maximal strongly correlated sets, whereas CD finds all such sets (up to a specified cardinality).To ensure a fair comparison for CoMEtExtended, we also considered all subsets of the sets returned by CoMEtExtended.When a subset of a CoMEtExtended answer satisfied the query, we added it to the results, thereby increasing CoMEtExtended's recall.This post-processing step was not included in the execution time of CoMETExtended, i.e., it did not penalize its performance.Table 4 presents the number of results and execution time of CoMEtExtended and CD on the same dataset (SLP-small) and the configuration parameters used in [3].We only consider the MP measure, since CoMEtExtended does not support the other three measures.
We see that CD is consistently faster than CoMEtExtended -at least an order of magnitude-and often returns substantially more results.Indicatively, for MP(4), CoMEtExtended with ρ CE = 0 (resp.ρ CE = 0.02) is one to two (resp.two to three) orders of magnitude slower than CD.Notice that for queries with δ = 0.1, ρ CE = 0.02 and τ = 0.4, CoMEtExtended also found 281 results with 6 vectors, and one with 7.These amount to ∼ 0.3% of the total amount of discovered results.These were not discovered by CD, which was executed with p l = 5, prioritizing the simpler and more interpretable results.Nevertheless, even for these settings, CD still found 25% more results than COMEtExtended, and in one third of the time.Moreover, the case studies presented in [2,3] amongst others on this dataset demonstrate the usefulness and significance of relatively simple relationships, involving at most four time series.Other works on multivariate correlations also emphasize the discovery of relationships that do not contain too many time series [9].For these cases, with a fixed l max , CD is guaranteed to find a superset of COMEtExtended's result set, at a fraction of its cost.Comparison to CONTRa We also compared CD to CON-TRa [2] for discovery of tripoles (i.e., PC(1, 2) ≥ τ ).To ensure a fair comparison, CD was parameterized to find the same results as CONTRa and to utilize the same hardware, as follows: (a) CD was executed with τ = 0, i.e., pruning was solely due the minimum jump constraint, and (b) CD was configured to utilize at most one thread/core, since the implementation of CONTRa was single-threaded.CONTRa was configured to return exact results.
Table 5 includes execution time and number of results per method. 11We see that CD is more efficient than CONTRa for detecting identical results, even with τ = 0.However, τ = 0 yields an impractically large amount of results.As such, we also evaluate CD with τ = 0.5 (corresponding to the lowest correlation reported in the case studies of [2]), and with τ = 0.9, which gives a more reasonable amount of results.This further decreases the execution time of CD by one to two orders of magnitude, while preventing an overwhelming number of results.
Summary.Comparison of CD with two state-of-the-art algorithms, two exhaustive baselines, and four DBMS demonstrates that CD consistently outperforms all competitors, requiring at least an order of magnitude less time.This enables CD to find more complex query patterns on larger datasets.

CD on static data
The following experiments are designed to evaluate the efficiency of CD under different conditions (configurations, datasets, and queries).We first examine the impact of CD's configuration parameters (the shrink factor and the clustering distance) to CD's efficiency.We do not consider recall, since CD is exact, always giving complete answers.Then, we evaluate the performance of CD for top-κ and threshold queries.

Optimizing configuration parameters
We also tested the impact of the values of γ and K (shrink factor and number of sub-clusters per cluster) on CD's efficiency for different configurations.The results showed that both very small (γ = −0.8)and very large (γ = 0.8) shrink factor values lead to sub-optimal performance of CD (roughly 38-72% slower than the optimal γ value), as they delay the increase of the running threshold τ .Similarly, extreme values of K also led to sub-optimal performance, with executions being as much as 2x slower for ES, PC, and MP queries, and up to 4x slower for TC queries, compared to the execution times with optimal K values.Detailed results can be found in the technical report [12].However, setting γ = 0 and K = 10 led to near-optimal performance at all configurations-at most 17% worse than the optimal performance in each case.Therefore, for the following experiments we set γ = 0 and K = 10.

Top-Ä queries
Effect of κ. Figure 7a, b show the execution time of CD for different values of κ for Stocks and fMRI.We see that a decrease of κ typically leads to increased efficiency.A low value of κ allows for a rapid increase of the running threshold τ , leading to more aggressive pruning at Algorithm 1, line 4. Interestingly, this effect is not equally visible among all considered correlation measures.For example, a reduction of κ gives a significant boost to ES, but a much smaller boost for MP.This discrepancy is attributed to the correlation values in the result set and the tightness of the bounds.Indicatively, in this experiment, the lowest MP value in the result set only decreases from 0.998 (top-100) to 0.9972 (top-500) on the Stocks dataset.In contrast, the lowest ES value in the result set decreases from 0.694 (top-100) to 0.672 (top-500) on the same dataset.6 presents execution time of CD for different correlation patterns.As expected, increasing the complexity of the correlation pattern leads to an increase of the computational time.However, even though the size of the search space follows O n p l + p r , execution time of CD grows at a much slower rate.Indicatively, for the fMRI dataset, the search space size grows 5 orders of magnitude between PC(1, 2) and PC (1,4), whereas CD's execution time increases by only three orders of magnitude, indicating efficient pruning of the search space.Experiments with different datasets Fig. 7c shows the execution time of CD for all correlation measures on different datasets.We see that efficiency of CD does not vary significantly for ES and PC.However, performance for queries involving TC fluctuates significantly across datasets.This is again attributed to the inherent characteristics of the datasets: analysis of the distributions of the multivariate correlation values in the datasets revealed that the correlations in each dataset followed gamma-like distributions.For TC, it is sometimes the case that the mean of this distribution is very close to the minimum correlation in the answer set, i.e., the correlation of the top-κ'th answer.In other words, total correlation is not sufficiently discriminating on these datasets.These situations could be prevented by performing exploratory analysis on the correlation value distribution of a small sample of the dataset.If this analysis does not indicate exceptionally high correlations in the dataset, the data analyst could opt for an alternative correlation measure.

Threshold queries
Effect of threshold Figure 8 shows the effect of threshold τ on the execution time of CD for the Stocks (left Y -axis) and fMRI dataset (right Y -axis) for each correlation measure, and for different constraints.Our first observation is that increasing the threshold leads to higher efficiency for all correlation measures and both datasets.This is expected, since a higher threshold enables more aggressive pruning of candidate comparisons: the upper bounds derived by Theorems 1-4 will be below τ more often, leading to less recursions.For similar reasons, the addition of stronger constraints (i.e., higher δ or introduction of the irreducibility constraint) generally leads to better performance due to increased pruning power.Furthermore, CD is noticeably faster for PC compared to MP for the same τ values.This is due to two reasons: (a) the high complexity of the computation of eigenvalues of a matrix (cubic to p l ), which is required for computing the bounds for MP (Theorem 2), and, (b) MP typically results in higher correlation values and more answers for the same value of τ compared to PC. Progressive variant of CD It is desired for progressive algorithms to collect the majority of results quickly, in order to give early insights to the user about the results, and to enable them to modify/adjust their queries.To evaluate this characteristic of progressive CD (Sect.3.4), we modified our code such that it saves the discovered results at different time points, and compared these intermediary results with the ground truth, in order to compute recall.In this set of experiments, we focused exclusively on queries which take significant time to complete, since these are the ones that would mostly benefit from a progressive algorithm.Figure 9 plots the number of results returned by progressive CD at different time points, for all correlation measures on the Stocks dataset.We see that for all correlation measures, CD retrieves more than 90% of the results in the first few seconds -less than 10% of the total execution time.This property of CD is particularly appealing for cases where approximate results will suffice.
Summary.The default configuration parameters for CD (number of clusters and shrink factor) provide nearoptimal performance.Complexity of CD grows at a much slower rate compared to size of the search space, and CD is more efficient in scenarios where the chosen correlation measure and threshold are discriminating for the dataset.Finally, progressive CD retrieves more than 90% of the results within the first few seconds.

CDStream on streaming data
The third set of experiments was designed to evaluate the performance of CDStream.We used the timestamps contained in all datasets (except Deep, which did not contain the notion of time) for generating the streams.Hereafter, we will present detailed results for the Stocks dataset, and include results with the other datasets only when these provide additional insights.We start with experiments with a time-based epoch definition (Sect.5.3.1), and then investigate the performance of CDStream using arrival-based epochs (Sect.5.3.2).
In the technical report [12] we present additional experiments, including an analysis of the algorithm's performance when executed for a prolonged time period, and an analysis of the impact of the sliding window size on CDStream's efficiency.

Experiments with time-based epochs
Effect of number of streams Figure 10a presents the average processing time per epoch of CDStream, for different numbers of streams.Since there is no streaming baseline for CDStream, the plot includes the average execution time taken by CD, per epoch, to compute the answers, using the same sliding window data (of course, repeated executions of CD are needed to maintain the results with the streaming updates).We see that CDStream is more efficient than CD for small correlation patterns, requiring only a few milliseconds per epoch-an order of magnitude less compared to CD for both correlation measures.Also note that, even though the search space grows at a combinatorial rate with the number of vectors, the growth in execution time of CDStream is substantially slower.This is attributed to the grouping technique in the CDStream index, which effectively reduces the work for processing each update.Also notice that CD outperforms CDStream on more complex correlation patterns.This is because of the index maintenance cost of CDStream: for more complex correlation patterns, the number of combinations that need to be maintained in the index also grows, eventually surpassing the performance boost coming from the index.Since CD does not depend on this index, it avoids this cost.This observation clearly demonstrates the importance of an automated algorithm (similar to the hybrid algorithm proposed in Sect.4.5) that can dynamically switch between the two for optimizing performance.Effect of the query parameters Table 7 presents the effect of τ and additional constraint values (minimum jump and irreducibility) on CDStream's performance.We see that efficiency of CDStream is robust to constraints-a constraint only causes a small difference in the number of decisive com-  We also see that, for all configurations with ES, CDStream requires less cumulative time per basic window to maintain the results, compared to a single execution of CD at the end of the basic window.In other words, CDStream updates the results more frequently compared to CD (up to 10 times more frequently in this experiment), and still requires less total execution time.With PC, CDStream with 1 and 2 epochs per basic window has comparable performance with a single execution of CD.Increasing the number of epochs further enables CDStream to provide even more frequent updates compared to CD, yet with a slight degradation of efficiency (up to 20% more time).This discrepancy of results for the two correlation measures is due to the inherent distribution of the correlation values-the results for PC change more rapidly compared to the results for ES in this dataset, which causes a higher cost for maintaining the index.Top-κ queries Figure 10c plots the average processing time per epoch for top-κ queries PC(1, 2) and ES (1,2), for different κ values.The results correspond to the Stocks dataset with 1000 stocks.We see that processing time for both algorithms increases with κ for both correlation measures, but at a much slower rate for CDStream compared to CD.In CD, execution time grows almost linearly with κ (from 4.94 to 17.20 s for ES(1, 2)), whereas for CDStream the time increases by only 7% for the same queries.The reason for this notable difference in efficiency is that CDStream only maintains the top-κ solutions, already having a good estimate for the threshold of the top-κ highest correlation from previous runs, whereas CD has to start each run from scratch.Therefore, for CDStream, the only increase in execution time for higher κ-values comes from updating and sorting a slightly larger result set and buffer set.

Experiments with arrival-based epochs
Effect of epoch size Figure 11a plots the average processing time per arrival, for varying epoch sizes.As a reference, the plot also includes the average processing time for a periodic re-execution CD after the end of every epoch (amortized on the epoch's arrival).
We see that increasing the epoch size also increases CDStream's performance.This behavior is expected, since a larger epoch provides more opportunities to CDStream for reducing the number of DCCs that need to be checked.Therefore, similar to the case of time-based epochs (Sect.5.3.1),epoch size provides a knob to the user for fine-tuning the trade-off between freshness of results and CPU/total execution time.
Also observe that the execution time per arrival for CD approaches that of CDStream as the epoch size increases.In the case of PC, the processing time for the two algorithms  (1,2) threshold queries on all datasets.The cost of a periodic execution of CD at the end of every epoch is also included in the figure, as a reference.We see that, even though arrivals are processed in at most 50 msec, processing cost is noticeably higher for the two weather sensor datasets (SLP and TMP) compared to all others.This can be attributed to the lower time resolution in these two datasets(minimum arrival rate for these datasets is 1 h, compared to seconds/minutes for the others).This leads to a substantially higher volatility of the result set, and consequently, to more frequent updates in the DCC index.

Evaluation of CDHybrid
For the final set of experiments, we test the ability of CDHybrid to switch seamlessly and efficiently between CD and CDStream, in order to minimize processing cost in the presence of stream bursts.Since our streams did not present significant bursts that could cause noticeable differences to CDStream throughout the runtime of CDStream, we introduced an artificial burst at all streams between epochs 70 and 90, by temporarily increasing the arrival rate by a factor of 30 (i.e., speeding up all streams during these epochs).CDHybrid was allowed a small warmup period of 40 epochs, where it was processing the updates, but was also switching between CD and CDStream in order to collect initial measurements and train the cost regression model.Algorithm effectiveness Figure 12a depicts the processing time per epoch (moving averages over 5 epochs), for processing Stocks with CD, CDStream, and CDHybrid.The figure also includes the number of arrivals within each epoch (right Y axis).We observe that when the burst starts-at around epoch 70-CDStream becomes substantially slower than CD, whereas performance of CD is not impacted.CDHybrid immediately recognizes the burst and switches to CD, thereby maintaining peak performance.After the burst is completed (shortly after epoch 90), CDHybrid switches back to CDStream.This switch includes a small additional overhead for updating the DCC index.However, this overhead is insignificant.Effect of dataset Figure 12b, c show the average processing time per epoch for CD, CDStream, and CDHybrid on all datasets (excluding the warm-up time), for ES (1,2) and PC(1, 2) queries, respectively.We see that CDHybrid consistently outperforms both CD and CDStream.This means that neither CD nor CDStream is the best algorithm for processing the whole stream.Yet, CDHybrid efficiently switches between the two as a response to the varying arrival rate, thereby providing near-optimal performance for each epoch.

Summary.
CDStream outperforms CD in most scenarios for processing of streams.Epoch size provides a useful knob to the user, for balancing throughput of CDStream with freshness of results.Finally, CDHybrid seamlessly combines the execution of CD and CDStream, offering consistently better performance than both.

Conclusions
We considered the problem of detecting high multivariate correlations with four correlation measures, and with different constraints.We proposed three algorithms: (a) CD, optimized for static data, (b) CDStream, which focuses on streaming data, and (c) CDHybrid for streaming data, which autonomously chooses between the two algorithms.The algorithms rely on novel theoretical results, which enable us to bound multivariate correlations between large sets of vectors.A thorough experimental evaluation using real datasets showed that our contribution outperforms the state of the art typically by an order of magnitude.
The current methods are limited to correlations over linear combinations of vectors.Future work should extend them to also accommodate nonlinear aggregations like MIN and MAX, which find applications in the discussed domains.Furthermore, detailed analysis showed that caching pairwise statistics (through 'empirical bounds') greatly boosted CD's performance.While all proposed measures suited these bounds, future ones might not.Thus, optimizing the application of the more general theoretical bounds will be vital as the proposed techniques evolve.

Fig. 1
Fig. 1 Normalized daily closing prices for stocks traded at the Australian Securities Exchange

Fig. 2 a
Fig. 2 a Two groups of closely related stocks: ASML and STMicroelectronics are exposed to similar risks, while GOOG and GOOGL participate in the same conglomeration; b Running example in 2 dimen-

Algorithm 2 :
TCPermHeuristic(H) Input: A priority queue H with all marginal and conditional entropy upper bounds for a set of clusters S = {C i } p i=1

Fig. 3
Fig. 3 Example of a stream representation with the BW + model with w = 100, b = 20, epoch = 5.With red we denote the index/position of the basic window.The blue numbers correspond to the values of the corresponding windows.The updates in the running basic window and running epoch are shown in green color

Fig. 4 a
Fig. 4 a Visualization of the decisive combination index; b Number of results and execution time per basic window, with BW + and the standard basic window model.BW + is configured with epoch size 1.The results correspond to the Stocks dataset, with n = 1000, w = 120000, and b = 20

Fig. 11
Fig. 11 Effect of query parameters on CDStream's performance with an arrival-based epoch.a Effect of epoch size, with τ = 0.95, Stocks; b Effect of dataset

Table 1
Comparison to the most relevant related work for multivariate correlations

the combination Algorithm 1: ThresholdQuery
).If U B < τ, (S l , S r , Corr, τ ) 8Set SC ← C max .subclusters9 for S ∈ SC do 10 S l , S r ← (S l , S r ) with C max replaced by S 11 ThresholdQuery S l , S r , Corr, τ ).It is important to note that BW + with an epoch less than b is not equivalent to running the standard basic windows algorithm with b = epoch.BW + keeps the completed basic windows Set of streams S, set of arrivals A , pairwise correlations cache C, DCC Index I, correlation threshold τ Input: 2 Recompute S i 's last basic window's aggregate 3 for j = 1 to n do // Update pairwise cache C 4 C[i, j] ←Corr(S i , S j ) 8 ThresholdQuery(S l , S r , Corr, τ ) 9 UpdateIndex(S l , S r , Corr, τ, I)

Table 3
Default parameters for the experiments with static and streaming data

Table 6
Execution times of CD with different correlation patterns on Top-κ queries (seconds)

Table 7
Effect of τ and δ on .3660.365 0.346 0.342 0.051 0.045 0.045 0.046 0.045 temporary invalidations of DCCs-are dampened by other arrivals on the same stream.