Denny Lee's Windows Live Space

Reporting Services Performance and Scalability Technical Notes

Tue, 01 Jul 2008 09:15:29 GMT

Over the next few months, I will be publishing a series of technical notes on sqlcat.com that provide guidance on how to build and deploy large scale SQL Server Reporting Services environments. This series provides general guidance on how to set up, implement, and optimize an enterprise scale-out architecture for your SQL Server Reporting Services (SSRS) environment; these notes provide guidance for both SQL Server 2005 and 2008 Reporting Services.

Reporting Services Scale-Out Architecture: The focus of this technical note is the Reporting Services scale-out architecture, which is referenced throughout this technical note series.

Report Catalog Best Practices: Provides guidance and best practices on the report server catalogs—the underlying databases that provide metadata (parameters, snapshots, history, etc.) used by Reporting Services to provide your reports.

SSRS Scale-Out Deployment Best Practices [link provided when published]: Provides guidance and best practices on deployment details for scaling out your Reporting Services environment including configurations and the use of File System snapshots.

SSRS Performance Optimization Configurations [link provided when published]: Provides guidance and best practices on using specific Reporting Services features and configurations to optimize the performance of your Reporting Services environment.

SSRS Troubleshooting Tips [link provided when published]: Provides various troubleshooting tips that are helpful to better understand issues that may occur within your Reporting Services environment

Great Data Mining resource

Mon, 02 Jun 2008 17:40:26 GMT

To learn more information about Data Mining, check out the Rafal Lukawiecki's TechNet Spotlight at: http://www.microsoft.com/emea/spotlight/event.aspx?id=99

Data Mining and Business Intelligence for Enterprises
In this one-day seminar, Rafal Lukawiecki aims to show IT Professionals how data mining can be used in IT infrastructure to support real business scenarios demystifying the perception that Data Mining is complex, untested or only for specialists. This has become possible since Microsoft has taken the technology to new levels making it accessible to all. In four easy-to-understand yet packed with practical information sessions you will learn about what Data Mining and Business Intelligence can do for you, how to deploy and manage it, how to use it, and how to make it available to other parts of your IT environment.

Introduction to Data Mining

Working with Data Mining

Using Data Mining with your IT Systems (Part 1)

Using Data Mining with your IT Systems (Part 2)

Enjoy!

Analysis Services Distinct Count Optimization

Thu, 17 Apr 2008 22:15:59 GMT

Finally, after about 7 months of analysis, customer validation, and just general randomization - I have finally propped up the Analysis Services Distinct Count Optimization whitepaper which is available here: http://sqlcat.com/whitepapers/archive/2008/04/17/analysis-services-distinct-count-optimization.aspx

Quick summary of this whitepaper:

Distinct count (such as unique visitor counts on a Web site) calculations provide valuable information but come with a number of performance challenges. This white paper describes tests that were performed to determine how best to optimize these calculations and includes best practices based on the test results.

Introducing SQLCAT.com

Sun, 03 Feb 2008 21:22:15 GMT

The SQL Customer Advisory Team has put the final touches on the site http://sqlcat.com/ which is our new hub for all things that are part of the SQLCAT! Our new site is a portal to all SQLCAT resources including:

Top 10 Lists: Summary list of Best Practices and Recommendations
Technical Notes: Deep level technical short papers
Technical Spotlights: Technical end-to-end customer case studies
Searchable and Tagger friendly; post comments and provide feedback!
Search all of our SQLCAT Best Practices Whitepapers
Easily find our SQLCAT Blogs and other materials

The site is regularly updated with deep technical information on enterprise SQL implementations.

SQL 2008 Case Study on Auditing, DMF, Encryption, Performance, Resource Governor, and Reporting Services

Tue, 11 Dec 2007 22:36:09 GMT

One of the first case studies for SQL Server 2008 was developed by Caregroup Healthcare Group using various features of SQL Server 2008 for their 2TB patient information system. The case study goes into their use of Advanced Data Auditing, Transparent Data Encryption, Declarative Management Framework, Performance Data Collection, Resource Governor, and Reporting Services to provide a high performance Patient Billing and Lab Results database. For more information, please refer to the Caregroup SQL Server 2008 case study.

Correction to our PASS Reporting Services Slides

Thu, 08 Nov 2007 07:38:30 GMT

As some of you may or may not know, Lukasz Pawlowski and I had presented the deck Building & Deploying Large Scale SSRS farms using Lessons Learned from Customer Deployments (DBA-416-M) at the 2007 SQL PASS conference. In one of our slides, I had indicated inexplictly that "RS runs only on x64 only". I must have been guilty of copying/pasting from some other slides because RS 2005 indeed does work on IA64 (there are many customers that can attest to that). In general, x64 is a more common deployment for RS because it is often less expensive (and IA64 being reserved for SQL). Saying this, yes, RS2005 does work on IA64.

If you want to know more information about Reporting Services, please don't forget to head to Lukasz's excellent blog Musings on Reporting Services and Notification Services.

Analysis Services: For Distinct Count measure NULL = 0

Fri, 02 Nov 2007 07:07:55 GMT

If you are to look at the table of values where you want to do a distinct count on the ID column

ID	ColA
NULL	blah
NULL	blah
0	blah
3	blah
1	blah
1	blah
2	blah
2	blah

Within SQL, you will get a value of 4 in which there are four distinct values, 0, 1, 2, 3 and NULL is not counted.

But within Analysis Services, if you were to put a distinct count measure on top of the ID column, you would also get a value of 4 for four distinct values, but those distinct values are 1, 2, 3, and 0. In this situation, NULL and 0 are the same value. This is a little bit more apparent if your table had the values of

ID	ColA
1	blah
2	blah
2	blah
3	blah
NULL	blah

Within SQL, you will get a value of 3 (distinct values of 1, 2, and 3) but within AS, you will get a value of 4 (distinct values of 1, 2, 3, and NULL or 0). There are various philosophical reasons why this is happening ranging from the fact that there are actually quite a few definitions for what NULL is (I really don't want to get into that) and within AS we're looking at things from a multi-dimensional point of view (i.e. from the dimension members) hence the exclusion of a NULL value implies exclusion of the rows. Regardless of the philosophical point of view on this, one should just be aware of this when working with their distinct count measures.

Oh note, thanks to John Lam for reminding me that if you turn on the NullProcessing property it will preserve the NULL value - i.e. the first table will have 5 distinct values of 0, 1, 2, 3, and NULL.

CMU/MSR Mindswap on Privacy

Tue, 23 Oct 2007 00:59:46 GMT

As some of you may have noticed in some of my more recent blog postings, I have started writing about my interest in the field of privacy. With all that is going on these days with tonnes of information floating on the web and the ability to join disparate data sources together to reveal interesting patterns (or individuals) - it will become imperative that we find ways to guarantee privacy of the individual if we are ever to find interesting patterns within our data.

The example that I had used with my most recent blog on the subject of privacy and Channel 8 interview was that of data mining in medical research. In this specific example, I had noted that I had performed data mining (using Analysis Services of course) against phenotypic (i.e. not genetic) information of Asthmatic patients. An interesting tid bit I like quoting from this research is that if an asthmatic patient misses their regular scheduled appointments, s/he may have 2x times greater chance of suffering from an asthmatic adverse event (death, hospitalization, ER visit). Now, to give context, the number of adverse events were quite small to begin with and the subsequent analysis can explain that this most likely has to do with the fact that people who didn't skip their visits were typically more proactive to their health instead of reactive (i.e. would not wait until they were really sick before getting a checkup or visit to prevent their asthma from getting worse).

One of the issues that I had while I was doing this analysis was that of the issues revolving around privacy. I (rightly so) had to go through a lot of hoops in order to make sure that I had the data within a safe environment and the analysis I was doing would not reveal who an individual was from the medical records. Saying this, the Analyzing Data while Protecting Privacy - A Case Study blog is one of the various postings that I have written (and will continue to write) on the subject.

But what it comes down to is these theme: It will not be possible for us to perform interesting analytics (e.g. data mining, machine learning, etc.) to help patients (e.g. build a concept of prognostics) unless we can guarantee the privacy of the patient.

Saying this, what does this have to do CMU/MSR Mindswap on Privacy as per the title of this blog? Well, if you refer to the linked blogs, you'll notice that the concepts of differential privacy (also termed in the blog as privacy preserving data analysis) are based on the research from MSR (Microsoft Research). As well, you may notice that I reference some examples of privacy from Latanya Sweeney whom is from CMU (Carnagie Mellon University). Last week, the Center for Computational Thinking at CMU had setup a mindswap event which combines some of the top researchers from both institutions to get together and swap information on the advancing field of research into privacy. You can find out more information by referring to the link with powerpoint slide references at: CMU/MSR Mindswap on Privacy.

Scalable Shared Databases

Mon, 22 Oct 2007 23:50:16 GMT

There have been some questions that have come to my attention concerning the concept of Scalable Shared Databases and comparing it within the context of Oracle RAC. If you want to read the SSD vs. Oracle RAC comparison, you can refer to the link Comparing SQL Server 2005 and Oracle RAC. As well, you can also refer to the SQL Server Books Online content on the subject of Scalable Shared Databases on the subject.

Saying this, the purpose of Scalable Shared Databases is to make use of SAN technology in order to allow you to attach a single read-only database to multiple server instances so that way you can have scale out many concurrent queries of your SQL database to the aforementioned multiple server instances. We have versions of this approach for Analysis Services one specific to using SANs (Scale-Out Querying with Analysis Services using SAN Snapshots) and one not specific to the use of SANs (Scale-Out Querying with Analysis Services). Saying this, you could always rename the concept of Scalable Shared Databases as Scale-Out Querying with SQL Server.

But I digress, extracted directly from the technical (hence most important) link is the Scalable Shared Databases are supported by SQL Server 2005 from Microsoft Support:

Scalable shared databases
Scalable shared databases let you attach a read-only reporting database to multiple server instances over a storage area network (SAN). A reporting database is a read-only database that is built from one or more production databases that are used exclusively for reporting purposes. To be made into a scalable shared database, a reporting database must reside on one or more dedicated read-only volumes. The primary purpose of these read-only volumes is to host the reporting database or a coordinated set of reporting databases. These volumes are known as reporting volumes.

Benefits
Scalable shared databases offer the following benefits: • Provide workload scale-out of reporting databases by using commodity servers. A scalable shared database is a cost-effective way of making read-only data marts or data warehouses available to multiple server instances for reporting purposes, such as running queries or using SQL Server 2005 Reporting Services.
• Provide workload isolation. Each server uses its own memory, CPU, and tempdb database.
• Guarantee the same view of reporting data from all servers if all the server instances are configured identically. For example, all servers would use a single collation.

Note Optionally, you can update the reporting database on a second reporting volume. For more information, see the "Maximize the availability of a scalable shared database" section.

Restrictions
The following restrictions exist for a scalable shared database: • The database must be on a read-only volume.
• The data files can be accessed over an SAN.
• Scalable shared databases are supported only on Microsoft Windows Server 2003 Service Pack 1 (SP1) or a later version of Windows Server 2003.

For the technical details, please refer to Scalable Shared Databases are supported by SQL Server 2005

Using ByAttribute or ByTable Processing Group Property with Analysis Services 2005

Fri, 19 Oct 2007 20:30:16 GMT

For any of you whom are considering using the ByTable (vs. ByAttribute) Processing Group property, I've propped up a blog called Using ByAttribute or ByTable Processing Group Property with Analysis Services 2005 with help from Richard Tkachuk, Akshai Mirchandani, and Eric Jacobsen. Basically, while using ByTable can at times be helpful, you really need to be careful on how you use it. Read the blog for more info, eh?!

Incorrect Impersonation Information may crash or hang Analysis Services

Fri, 12 Oct 2007 16:48:12 GMT

If you are processing your AS cube using impersonation mode, if you incorrectly place the impersonation information as MYDOMAIN/UserName instead of MYDOMAIN\UserName, you may crash or hang Analysis Services. A quick cursory examination noted that with Sybase and DB2 relational data sources, AS ended up crashing. If SQL Server or Oracle is your relational data source, then the processing is exceedingly slow to the point where the server was hanging; in the end eventually failing.

Thanks to John Lam, Nicholas Birke, and Wei Zhang

Precision Considerations for Analysis Services Users Whitepaper now available

Tue, 09 Oct 2007 21:42:41 GMT

For those of you whom want to know a little more about precision considerations for Analysis Services users, please check out this recently released whitepaper at http://www.microsoft.com/downloads/details.aspx?familyid=bae8beec-9892-4ecd-a9db-292254895f9c&displaylang=en.

This white paper covers accuracy and precision considerations in SQL Server 2005 Analysis Services. For example, it is possible to query Analysis Services with similar queries and obtain two different answers. While this appears to be a bug, it actually is due to the fact that Analysis Services caches query results and the imprecision that is associated with approximate data types. This white paper discusses how these issues manifest themselves, why they occur, and best practices to minimize their effect.

Authors: Denny Lee and Eric Jacobsen

Data Mining applied to Medical Research

Fri, 28 Sep 2007 18:46:20 GMT

As a follow up to my blog below concerning analyzing medical data and privacy, check out my channel8.msdn.com interview concerning the application of data mining to medical research and the reason why privacy is so important.

http://channel8.msdn.com/Posts/Denny-Lee-from-SQL-CAT-Data-Mining-applied-to-medical-research/

Analyzing Data while Protecting Privacy - A Case Study

Mon, 24 Sep 2007 22:51:48 GMT

Abstract

Analysis and sharing of aggregate data (e.g., number of users whose favorite color is blue) is crucial to understanding patterns of the population being studied. The problem is that even summary data can expose the individuals who make up this information. Therefore, we are studying the use of privacy preserving data analysis techniques that will protect the individual and allow analysts to understand general trends. We believe that while there are unique perturbations of the data with these techniques, analysts will be able to use the data and protect the users at the same time. The case study involves applying these algorithms to MSN reporting data. One group focused on event usage (e.g., number of page views on Moneycentral.com) while another group focused on usage data (e.g., the number and frequency of users who use MSN Messenger). After four months of analysis, the first group did not like the effects of privacy preserving data analysis. In contract, the second group is prepared to use this type of reporting in production. Further discussions and inquiries revealed that the first group had perceived data trust issues that conflicted with use of the algorithms. But, the second group had no trust issues with the data and was very familiar with privacy issues, hence the successful outcome. Therefore, if users trust the data it is possible to use this privacy preserving algorithm to allow the analysis of data while protecting privacy.

Introduction

Based on an analysis of the 1990 US Census, 87% of the United States population is uniquely identifiable by the three attributes of zip code, date of birth, and gender [1]. Latanya Sweeney’s breakthrough research with the Governor William Weld case clearly depicts that the masking or hiding of publicly available information does not adequately protect the privacy of an individual. Sweeney was able to obtain masked medical data from the Group Insurance Commission of Massachusetts whom is responsible for state employees’ health insurance. The masked medical data contained only non-identifiable information such as ethnicity, visit date, diagnosis, procedure, medication, total charge, zip code, date of birth, and gender. For a cost of $20, Sweeney then obtained the publicly available Cambridge, MA voter list. Referring to the Venn diagram below, each circle graphically represents the two data sources and by itself reveals little information. The masked medical data on the left provides only medical information where only gender, date of birth, and zip code were identified. The voter list on the right provides personal information but limited only to voting information, address, date of birth, and gender. But recall that 87% of the US population is uniquely identifiable by only the three attributes of zip code, date of birth, and gender. In the case of the Massachusetts governor, there were only six people in Cambridge, MA whom had the same date of birth and only three of them were men. Of the men remaining, he was the only person to live in his particular zip code. Through these two pieces of information joined only by gender, date of birth, and zip code; Sweeney was able to identify and reveal the medical records of then Governor William Weld.

Figure 1: Unmasking of masked medical data

As one can see, this particular scenario stresses the inadequacies of ensuring privacy by masking medical data; it will require us to change our perceptions of what data privacy really entails. It takes only a small amount of information to reveal the individual underneath the data.

Many current privacy solutions involve the concept of masking the data such that personally identifiable information remains hidden. Regulatory bodies such as HIPAA provide very explicit instructions on what information can and cannot be revealed in different scenarios [2]. Businesses such as Microsoft® provide detailed statements (e.g., “Microsoft Online Privacy Statement”) detailing the personal information collected, uses of the information, and the choice to opt-out [3]. Academic institutions, such as Oregon Health & Science University, have requirements in addition to HIPAA standards staging the permitted uses and disclosures associated with protected health information [4]. Yet, as one can see from the William Weld case, the masking and explicit statements of use and disclosures may not necessarily insure privacy. There are many other masking solutions and/or perturbations of data as can be seen in J.C. Cannon and A. Cavoukian’s book “Privacy: What Developers and IT Professionals Should Know” [5]. But the potential weakness of these approaches is that the solutions may end up being too complicated to implement or that the modification of data will result in changing the meaning of the data. This latter point is especially important because of its affect on analysis and research. If statistical analysis ranging from mean/median to advanced data mining techniques result in inconsistent values, the results and conclusions based on these statistics may be incorrect.

How is it then possible to protect an individual’s privacy in a relatively simple manner while ensuring consistent statistical analysis for research purposes? This is the purpose of “Privacy Preserving Data Analysis” which is based on the work of Microsoft Research (MSR) researchers Cynthia Dwork and Frank McSherry (as well as S Chawla, K Talwar, A Blum, K Nissim, and A Smith) [6, 7, 8]. The basic premise of their research is that the addition of noise based on the exponential distribution to the data will be able to protect the individuals underneath the aggregate data. Recall that to attack aggregate data, one need only to ask enough questions to drill down to a specific individual with very distinct attributes. In the Governor Weld case, the first question would be the number of people who had his date of birth (answer is 6). The next question is number of those people who were male (answer is 3). The final question is the number of those people who lived in his 5-digit zip code (answer is 1). In this example, it required only three questions for the author, Sweeney, to drill down to Governor Weld and his medical records [6]. But, if we were to add exponential noise (some integer value between –∞ to +∞) to the consistently change the above values, it would be impossible to drill down to this one person. For example, if the noise values to be applied to these questions were that of (-2, +1, +6), then the results of the above questions would be:

Question	Original Answer	Noise Values	PPH-applied Answer
How many users with Governor Weld’s date of birth	6	-2	4
How many of those users are male	3	+1	4
How many of those users are in Governor Weld’s Zip Code	1	+6	7

When looking at the PPH-applied answers, the additional noise has made it impossible to drill down to the single individual, therefore the data is “privacy preserving”. In this particular example, the noise is too large but in the methods section we describe how to better calibrate the noise. Ultimately, the key is to add enough noise to the system so that the answer changes but the overall statistics do not. To prevent attacks to the noise algorithm itself, more noise needs to be added as more questions are asked. The background section of this paper provides more details on how this works. The efficacy of this methodology is not in question for this case study as this has already been amply researched and verified. Therefore, the purpose of this case study is to determine the applicability of this noise algorithm in an actual reporting environment.

Background

The privacy preserving data analysis concepts involve the addition of noise to the data in order to protect the individuals underneath the data. This case study involved the use of the privacy preserving histogram (PPH), which uses exponentially-distributed noise (the algorithm is better described in the methods section). These concepts are based on the research in “Practical Privacy: The SuLQ Framework” [7]. The next few background sections describe both the sanitization concept and the privacy mechanism theorem associated with it.

Sanitization Concept

To protect the individuals comprising the data, we will mask these individuals within the data by creating a sanitization point between the user interface and the data.

Figure 2: Sanitization Concept

The left green shape on the left represents the database while the right-most circle represents the answer or result set provided to the user interface. The middle section is the interactive sanitizer, defined К, where it introduces random noise to produce uncertainty, hence privacy. Note the magnitude of the noise is given by the theorem:

If many queries f₁, f₂, … are to be made, noise proportional to Σ_iΔf_i suffices. For many sequences, we can often use less noise than Σ_iΔf_i . Note that Δ Histogram = 1, independent of number of cells

The sanitizer requires the creation of a carefully detailed algorithm and will be discussed in more detail in the differential privacy section below. A safe answer on the amount of noise to apply is that of standard deviation equal to the total number of queries. If the number of queries is not known, then the standard deviation can be proportional to the square of the queries asked so far. As for the noise itself, it should be newly seeded each time a query is applied.

By doing this, this algorithm will be able to address all attacks. Consequently, for each person, the increase in probability of the individual being attacked (or anyone else for that matter) due to the contribution of their data is nominal. The example given is foiled for two reasons: a) the addition of noise will (formally) complicate the polynomial reconstruction and b) the number of queries is limited by the degree of privacy guaranteed, and N is generally going to be way too many queries.

Mathematically, at this sanitization point, the PPH will apply of a little bit of noise within each cell of the histogram. Descriptively, if one’s result set from the database is a report with a set of rows and columns, for each value within each row and column cell a small bit of error is added to the original number. Provided that the sanitization point can limit the number of questions being asked and/or add more noise as more questions are being asked, then the PPH can guarantee the privacy of the individuals that make up these aggregates.

Differential Privacy

Our privacy mechanism, К, gives ε-differential privacy for all transcripts t, all databases DB, and all data items (rows in the DB) Me, the ratio

Figure 3: Differential Privacy Formulae

The differential privacy theorem is a simple mathematical formula that describes the fact that nothing more can be learned about an individual when her information is in the DB (DB+Me) than when it is not in the DB (DB-Me). This is important from the context of joining one set of data that is in the DB (e.g., the masked medical data) with another set of data that is not in the DB (e.g., Cambridge, MA voter list). If there is no noticeable difference between f(DB-Me) and f(DB+Me) then there is no perceptible risk by joining the two data sets together. Therefore, to achieve this differential privacy, we will need to add scaled symmetric noise ∝ exp(-|x| ε/ Δf).

Figure 4: Noise depends on sensitivity

Note that possible responses, R, is defined as R = Δf / ε. The black line represents the f(DB-Me) while the red line represents the f(DB+Me). This means that increasing the value of R will flatten the curve; the flatter the curve the more privacy is provided. The flatter curve means that no response is much more likely in one case in comparison to other.

The question that is incurred then is what difference must noise obscure or how much can f(DB+Me) exceed f(DB-Me). This goes back to the above noted formula of differential privacy:

D f = max_{DB, Me} |f(DB+Me) – f(DB-Me)|

where the noise depends on the sensitivity of the system.

Figure 5: Example of noise and sensitivity

Basically, this example shows the real value is f(DB-Me) = 104 while the added noise value of f(DB+Me) = 105.2. The statistical difference between these two values seems insignificant, but this depends on the sensitivity of one’s statistics. If you have highly sensitive data where a 1.2 difference results in a $1.2 billion sale price, then any change to the data is unacceptable. While if your data is relatively insensitive (and most data analyses are), this slight error of difference is well within an acceptable error margin. A key presumption of this design is that one will need to calibrate the noise to ε and the number of queries. More explicitly to this latter point, as the number of queries increase, the more noise will need to be added in order to insure that the noise algorithm itself can counter an attack. The vast majority of analytical queries do not require a substantial increase in noise due to the relatively low number of questions asked. As seen below, noise is independent of the database size so privacy is insured but accuracy varies; the larger the database the higher the accuracy.

Figure 6: Effect of noise

Case Study Data

This case study used MSN visitor data where the privacy preserving noise algorithms were applied to the data to determine reporting efficacy. MSN data has 550 million Passport users (as of February 2006) that contain visitor self-reported data such as gender, birth date, occupation, country, and zip code. The web traffic data associated with MSN also has additional attributes including IP address, pages viewed, page view duration, browser, and operating system. MSN uses this data to provide customizable experiences of their users and to better understand how visitors are using the various services. But at the same time, there are various major privacy issues including identity theft, fraud, and/or bad press (e.g., AOL released search engine queries that ended up revealing their users). If user expectations are not satisfied, customers will no longer trust the services provided. As data is accumulated, it becomes easier to segment the population and potentially identify individual users without directly using personally identifiable information. Hence, there was an interest within MSN to use the MSR research to determine the latter’s applicability for all reporting.

Methods

We have devised a way to mask the individuals within the aggregate data using the privacy preserving histogram without losing the meaning of the data. To test the applicability of this technique within a reporting environment, we used MSN visitor data and had two different analytics groups analyze this data. The “Sampled Users Web Analytics” group is a set of users who want to understand what MSN web sites people are using (e.g. the MSN home page, Moneycentral, MSN Autos, etc.). The “Customer Churn analytics” group is a set of users who are trying to better understand how customers are using the features of MSN (e.g. Messenger, Search, Hotmail, etc.). Considerable amount of time was spent with both groups to determine the reporting features and the metrics they wanted. Upon determination, an Analysis Services database was also created so customers could easily pivot through all of the information and perform ad-hoc queries. Once they were happy with the reports, the PPH was introduced so they could view the reports and provide feedback on the issues between the original reports and the reports with PPH applied.

User Groups

Sampled Users Web Analytics Group

To provide the reports that this group desired, we built a new reporting solution based on an existing web analytics solution. Upon loading the data into a SQL Server 2005 database for filtering and transformation, an Analysis Services 2005 cube (OLAP cube) was built. It provided the analysts with the ability to view the data from multiple dimensions using a custom web UI. Multiple iterations had occurred with this group to determine the exact reports they would like to view (by what event, demographics, time period, etc.). In this particular case, the reporting was specific for the Channel, Search, and Money teams.

Customer Churn Analysis Group

To provide the reports that this group desired, we built a brand new reporting solution. The customers were familiar with this data because it was built on an existing targeted marketing system. Similar to the “Sampled Users Web Analytics Group”; a SQL Server 2005 database was created to initially filter and transform the data. Upon processing completion, an OLAP cube and a custom web UI was built on this data to provide the reporting interface. This new reporting system allowed the analyst to understand how MSN services (Messenger, Mail, Search, Spaces, etc.) were being used. Multiple iterations were also performed with this customer group insuring they had received the data they desired. A key difference between the groups is while the first group was able to use legacy reporting systems; the second group did not have access to any reporting. Within a few weeks of their request to us, these customers had received a working beta version that they could use and provide feedback.

PPH: Generating the Noise

In both types of reporting solutions (and for that matter, many reporting solutions), we are primarily concerned with counts and summations. Specifically, these reporting systems involve unique visitor counts, event transaction counts, and page view summations. As we are dealing with discrete data, instead of continuous data, the basic PPH algorithm to implement is:

where

	This is a pseudo-random number generator (RNG) such as SRAND
R	This is a magnitude of the noise to be applied to the system. The larger the number, the more error is added. More error means more privacy but could skew the meaning of the numbers if the value is too high.
Seed for A	This is the seed that is used generate an array of numbers where A is the original query.
n₁, n₂, …	An array of numbers that will alter the counts, in effect adding noise.

The routine, , is based on the property that for any interval of the density function

we can analytically find the point y such that . A single random bit can tell us on which side of y our sample should be drawn, and we can recursively apply the technique to the appropriate subinterval (i.e.: either one of or ).

To generate the noise, the RNG will create a stream of numbers, for example:

0 0 1 1 1 … 1 0 0 0 0 1

The resulting exponential distribution translation of this stream is:

- . 2 + 1 … + . . . . 6

Recall that the point of the PPH is to generate noise that will be applied to the result set data. The generation of noise uses the above RNG (there is no such thing as a true random number generator in mathematics), to create the stream of 0s and 1s. We then take the stream of numbers and translate it into the noise. For example, if you look at the right most set of numbers (starting after the …) within the array, you’ll notice 1, then 5 0s, then 1 again. The first 1 denotes a positive value (vs. negative), the 5 0s represent a count of 5, and the final 1 represents the full stop. Hence, these seven values represent a positive 5 count + 1 count with full stop equaling +6. For a code example, please refer to the Appendix.

Effect on Data

This stream of numbers is then applied directly to the results. Recall, that the stream of noise values was -2, +1, …, +6 and the original values are that of A = 36, B = 22, …, N = 102.

Figure 7: Effect of noise

The noise added to the system provides a new result of A = 34, B = 23, …, N = 108. By adding this noise to the system, it is not possible for one to drill down to a value of 1, which would expose a single individual (e.g., A = 1). After all, if you are able to drill down to one individual, even through what is perceived as non-identifiable attributes (e.g., birth date, zip code, and gender); it becomes possible to identify this individual. But the additional noise will never allow you to get down to a single individual of any attributes (or combination thereof). If the numeric answer to your question represents a single individual (e.g., A = 1), one is not sure if this truly represents an individual or if this is due to the noise applied.

An issue of concern is if we apply too much noise (e.g., +1000) then we risk changing the meaning of the data completely. If too little noise (e.g., +0, +1, -0, -1, etc.) is applied we risk not protecting the data very well. Hence, we followed the safe rule that the magnitude of the noise applied to the RNG is the standard deviation of the total number of queries. In our case, the total number of queries per user ranged from 90 to 110 queries. Therefore, the standard deviation was 10 and the magnitude applied to the RNG, R, is 10. We limited the number of questions asked of the system otherwise it would have become possible to break the noise pattern. Since the noise generated by the RNG requires some seed value (i.e., a starting point), if you ask enough questions it becomes mathematically possible to determine how the RNG is generating its values. Once this is determined, it becomes possible to reverse engineer the system and determine the original set of values. Hence the importance of either limiting the number of questions asked (e.g., a hundred questions) or adding more noise to the system as more questions are being asked thus preventing an attack of this nature.

Results

The effect on the customer data by the application of noise is reflected in the tables below. In Figure 8, the left and right tables are two of the same queries executed a few seconds of each other with the PPH noise applied.

Figure 8: Effect on data

For example, reviewing the country Afghanistan, the “Unknown” value is 121561 in one case and 121599 in another. Because of this random exponentially distributed noise, we do not know what is the “real” value. The visual effect to this data is minimal, as depicted in the image below.

Figure 9: Graphical Effect on data

Sample Users Web Analytics Group

We first received feedback from the “Sample Users Web Analytics Group” which wanted to understand what visitors were using on the MSN.com and Windows Live web sites. The concept of PPH was introduced to this group after building a new reporting solution on an existing web analytics solution specific to their business requirements. As well, an Analysis Services database was built for this new reporting solution to allow the group the ability to view the data from multiple dimensions – something that they had desired for quite some time.

Figure 10: Totaling issues for Sample Users Web Analytics Group

Unfortunately, the resulting feedback was negative; the basic problem was that this group could not accept any amount of error in their data. For example, an initial query provided the number of visitors per country, where the total US visitors was 202. A subsequent query against the data which broke out the same US visitors by gender would result in a total that was 203. While it could be understood that the added noise to the system could explain these differences, this group insisted that these numbers had to match at all times. Note, it did not matter that these numbers were not used for financial reconciliation and was only to be used for analysis purposes.

From further discussions with this group, it appeared that they had been utilizing reporting systems that had perceived accuracy issues. It is this perception that resulted in the groups’ negative feedback to additional noise being added to the resulting data.

Customer Churn Analysis Group

Based on this feedback, we were originally a little disheartened about the prospects of applying this type of privacy functionality into reporting systems. But after some conversations with other analysts (including members in the healthcare field), it appeared that they did not have issues with the effects of the additional noise to insure individual privacy.

Therefore, we proceeded with the next case study group: the Customer Churn Analysis group. Upon determining the group’s reporting requirements, an Analysis Services database was built based on an existing targeted marketing system. Like the first group, there were multiple iterations of this database so the analysts were better able to understand how MSN services such as Messenger, Mail, Search, and Spaces were being used. The major difference between these two groups was that the “Customer Churn Analysis Group” never had access to reporting data before. To their surprise, within a few weeks of their initial request they were able to interact, validate, and provide feedback on a working reporting solution. Most importantly, they were able to analyze and re-analyze the data to determine the precision and accuracy of the data.

To our delight, once we had introduced PPH into their churn reports (with the additional noise being seen in the result set), they were satisfied with the results. It even got to the point where when the customers were viewing the reports, they had forgotten that a privacy algorithm was applied – even though the numbers in the reports were changing (due to the additional noise) and the statement “Privacy Preserving Histogram Applied” was applied directly into the reports. Based on conversations and surveys, it was very apparent that the collaborative effort between us and the customer led to the customer trusting the data – this is a key difference in comparison to the first group. And because of this trust, the small amount of error introduced into the system to ensure customer privacy was well within a tolerable error margin. It also helped that this group is a direct marketing group; so they were more familiar with the concept of customer privacy.

Discussion

Ultimately, it was very important to develop trust of the data to accept the application of the privacy preserving histogram. That is, if customers trust and understand the data, the side effects of the privacy preserving histogram algorithm are well within a tolerable error margin. Customers who regularly deal with personally identifiable information are more interested in this concept and more willing to accept the additional noise. More continued analysis will be required to insure that its applicability is not just limited to these types of reporting scenarios, but the case study does provide us with enough positive feedback for further future analysis.

References

[1]. Sweeney L. k-anonymity: a model for protecting privacy. International Journal on Uncertainty, Fuzziness and Knowledge-based Systems, 2002: 10 (5), pp. 557-570.

[2] US Department of Health and Human Services (Office for Civil Rights), HIPAA Administrative Simplification [Regulated Text]. February 16, 2006. Available from: http://www.hhs.gov/ocr/AdminSimpRegText.pdf

[3] MSN, Microsoft Online Privacy Notice. C2007. Available from: http://privacy.microsoft.com/

[4] OHSU Healthcare System (Administrative Policy Manual), Permitted Uses & Disclosures of Protected Health Information (ADM 04.22). April 14, 2004. Available from: http://www.ohsu.edu/cc/hipaa/docs/04-22.shtml

[5]. Cannon JC, Cavoukian A. Privacy: What Developers and IT Professionals Should Know. Boston, MA. Addison-Wesley Professional. 2004.

[6]. Dwork C, McSherry F, Nissim K, Smith A. Calibrating Noise to Sensitivity in Private Data Analysis. The Third Theory of Cryptography Conference (TTC 2006); 2006 March 4-7; New York, NY: International Association for Cryptologic Research; 2006. pp. 265-284.

[7]. Blum A, Dwork C, McSherry F, Nissim K. Practical Privacy: The SuLQ Framework. The 24th Symposium on Principles of Database Systems (PODS 2005); 2005 June 13-16; Baltimore, MD: Association for Computing Memory; 2005. pp. 128-138.

[8]. Chawla S, Dwork C, McSherry F, Talwar K. On the Utility of Privacy-Preserving Histograms [link on the internet]. The 21st Conference on Uncertainty in Artificial Intelligence (UAI 2005); 2005 July 26-29; Edinburgh, Scotland: Association for Uncertainty in Artificial Intelligence; 2005. http://research.microsoft.com/research/sv/DatabasePrivacy/cdmt.pdf

[9]. HIMSS Privacy and Security Toolkit [homepage on the internet]. Chicago, IL. C2007. Available from: http://www.himss.org/ASP/privacySecurityTree.asp?faid=78&tid=4

Appendix

Code Example#include "stdio.h"
#include "stdlib.h"
#include "string.h"
#include "math.h"
#include "time.h"

/* The following routine is based on the happy property that for any interval [x,z] of the density function

            p(x) ~= exp(-|x|/R)

we can analytically find the point y such that p([x,y]) = p([y,z]). A single random bit can tell us on which side of y our sample should be drawn, and we can recursively apply the technique to the appropriate subinterval (ie: either one of [x,y] or [y,z]). */

/* The way we get at random bits */
/* This can be extended/altered for an arbitrary pseodorandom generator */
int randombit() {return(rand()%2);}

/* Produces integer valued noise */
int intnoise(double R)
{
      double tally = 0.0;
//    double tally = 0.5 - R * log((exp(1.0/R) + 1.0)/2.0);

      // stage 1: flip a lot of coins
      while (randombit() != 0)
            tally += R * log(1.0/2.0);

      // stage 2: now sample from this interval
      double x = R * log(1.0/2.0);

      // loop until the integer part is fixed
      while (round(tally) != round(tally+x))
      {
            double midpoint = R * log((1.0 + exp(x/R))/2.0);

            // grab one random bit.
            if (randombit())
            {
                  tally += midpoint;
                  x = x - midpoint;
            }
            else
                  x = midpoint;
      }

      return(randombit() ? round(tally) : -round(tally));
}

/* First argument is the magnitude R of the noise. Second parameter is number of trials to conduct. */
int main(int argc, char** argv)
{
      srand(time(NULL));      // sets random seed to a "random" value. This

should be done carefully, but ok for testing.

for (int i = 0; i < atoi(argv[2]); i++)
printf("noise: %03d\n", intnoise(atof(argv[1])));

}

SQLCAT tracks at 2007 SQL PASS

Wed, 12 Sep 2007 18:53:46 GMT

As you may already know from Brian Moran's SQL Server Magazine article "SQLCAT to Offer Six Sessions at PASS", the SQLCAT team will be providing 6 SQLCAT tracks at the 2007 SQLPASS event in Denver this year. As of today's schedule, below are the SQLCAT tracks schedule:

Wednesday, September 19th 9:45am-11:00am
DBA-410-M
Designing for Petabyte using Lession Learned from Customer Experiences
Lubor Kollar, Microsoft; Kevin Cox, Microsoft
Korbel 1C/1D

Wednesday, September 19th 1:30pm-2:45pm
DBA-411-M
Building High Performance Microsoft SQL Systems Using Lessons Learned From Customer Deployments
Michael Thomassy, Microsoft; Burzin Patel, Microsoft
Korbel 2A/2B

Thursday, September 20th 9:45am-11:00am
DBA-412-M
ISV Configuration & Implementation using Lessons Learned from Customer Deployments
Juergen Thomas, Microsoft; Mike Ruthruff, Microsoft
Korbel 1A/1B

Thursday, September 20th 1:30pm-2:45pm
DBA-413-M
Building Highly Available Microsoft SQL Server implementations using Lessons Learned from Customer Deployments
Prem Mehra, Microsoft; Lindsey Allen, Microsoft; Sanjay Mishra, Microsoft
Korbel 2A/2B

Friday, September 21st 9:45am-11:00am
DBA-416-M
Building & Deploying Large Scale SSRS farms using Lessons Learned from Customer Deployments
Denny Lee, Microsoft; Lukasz Pawlowski, Microsoft
107/109

Friday, September 21st 1:00pm-2:15pm
DBA-415-M
Building & Maintaining Large Cubes Using Lessons Learned from Customer Deployments
Nicholas Dritsas, Microsoft; Eric Jacobson, Microsoft
108/110/112

Security Issues when Profiling Multiple Analysis Services databases

Thu, 02 Aug 2007 01:19:05 GMT

Problem: A user with full permissions within a database cannot see any profiling events when the user has full permissions to two or more AS databases and is not a server admin. The user will be able to trace any query related events for the first database via Profiler but he/she cannot capture any similar events for the other databases.

Reason: This is a known limitation because the trace is normally a feature restricted to server Admins. DB admins can only see the trace output whenever it is safe to assume from a security perspective that the events produced are for a specific database only. If its not possible to guaratee events related to a single databse, then the events are not exposed to the user.

Alternative Solution: An alternative solution to this problem is to go ahead to create multiple profiler traces, one for each database. When you connect to SSAS from the Profiler, you will be able to choose to profile any of the databases that you have full admin access. In this case, you will open up multiple profilers, one for each database and now you are profiling the AS databases desired.

Thanks to contributions by John Lam, Edward Melomed!

Renaming an Analysis Services 2005 cube

Fri, 20 Jul 2007 23:36:09 GMT

There is a question on how to rename an Analysis Services 2005 cube since you cannot do that within SSMS (you can rename a database but you cannot a cube). If you want to rename a cube prior to its deployment, you can alter it through XMLA. To do this:

<Cube ...><ID>Blah</ID><Name>Foo</Name>...

As you can see from above, the <Name> node can be changed so that while the ID for this cube is still "blah", now your name can be "Foo".

But if you want to change the name of your cube after its already been deployed, there are an additional number of steps that will need to be performed. First you will need to go the Olap database folder, e.g.

C:\Program Files\Microsoft SQL Server\MSSQL.2\olap\Data\[Database Name].0.db

and then access the cube XML definition file within that folder, such as: [Cube Name].0.cub. The XML within this file will look like (with a cube name of “Blah”)

<Cube><Name>Blah</Name><ID>Blah</ID>...

So you need only to change the name of the <Name> node (e.g. now “Foo”) to:

<Cube><Name>Foo</Name><ID>Blah</ID>...

You will also need to stop/restart the AS service for it to register the new name.

SSAS 2005 Error Codes and Messages

Wed, 18 Jul 2007 21:17:57 GMT

Thanks to Edward Melomed and Eric Jacobsen for these quick tips!

In order to view the full list of error codes and messages for SQL Server Analysis Services 2005, you can open up Visual Studio and look at the resources within the msmdsrv.rll file. A quick and handy way to view the RLL file is to use Mark Russinovich's Strings utility from Sysinternals - you can find it at: http://www.microsoft.com/technet/sysinternals/Miscellaneous/Strings.mspx. Note that this RLL file has the tracedefinition90.xml file embedded inside it.

Analysis Services 2005 Trace Event Definitions

Wed, 18 Jul 2007 07:50:33 GMT

In the Best Practices whitepaper Analysis Services Processing Best Practices (http://www.microsoft.com/technet/prodtechnol/sql/bestpractice/ssaspbpr.mspx), I had noted in the Troubleshooting Best Practices > Create a system-wide trace file section that you could create a Analysis Services Processing Trace via XMLA. Many thanks again to Dave Wickert for providing this example.

But I had forgot to note where one can get all of the trace event definitions from. To do this, go to the [%Olap Data Folder%]\bin\Resources\1033 folder (by default [%Olap Data Folder%] is C:\Program Files\Microsoft SQL Server\MSSQL.2\Olap) and open up the file tracedefinition90.xml. In there, you can find all of the trace event definitions.

Distinct Count Optimization for Analysis Services 2005

Fri, 13 Jul 2007 23:49:56 GMT

In reference to my blog on Distinct Count Optimization at http://denster.spaces.live.com/blog/cns!125D53A08EC75357!1156.entry, I would like to expand it slightly specifically for Analysis Services 2005. Based on customer visits and more extensive testing, I have found that following most of the advice in my original blog entry will help improve distinct counts.

But, for Analysis Services 2005, it will be better to partition where the distinct value (e.g. users) are placed in the same partition. This is different from Analysis Services 2000 where the partitioning strategy was to take that same distinct value and spread it across as many partitions as possible. For AS2k5, there was significant improvement when using this new partitioning strategy. Over the next couple of months, I'll update this blog entry when I finally get a best practices whitepaper to provide more details on this.

Photo Album: Blog Images

Mon, 24 Sep 2007 22:48:27 GMT

Blog Images

More Photos...

Photo Album: Outdoor

Fri, 29 Dec 2006 21:24:41 GMT

Outdoor

Looking into Puget Sound

Lake Serene, Mt. Index

Methow River Rafting

Mt. Rainier Emmons Route

Mt. Rainier Climb w/ Kelly Hedlund

Mt. Rainier Climb w/ Denny

Mt. Rainier Near Summit Day

Mt. Rainier Near Summt Dawn

Mt. Rainier, Camp Schurmann view

Mt. Rainier, Camp Schurmann Dusk

More Photos...

Photo Album: Blog Images

Wed, 27 Dec 2006 23:37:01 GMT

Blog Images