r - 基于交替值的快速排序/过滤

Question

考虑以下示例数据表，

dt <- data.table(src = LETTERS[1:10], 
                 dst = LETTERS[10:1], 
                 src1 = letters[15:24], 
                 dst1 = letters[24:15])

#which looks like,
#    src dst src1 dst1
# 1:   A   J    o    x
# 2:   B   I    p    w
# 3:   C   H    q    v
# 4:   D   G    r    u
# 5:   E   F    s    t
# 6:   F   E    t    s
# 7:   G   D    u    r
# 8:   H   C    v    q
# 9:   I   B    w    p
#10:   J   A    x    o

第一个目标是根据 订购它反转 行成对元素(src - dst 和 src1 - dst1)可以按如下方式实现以创建 5 个“对”:

dt[, key := paste0(pmin(src, dst), pmax(src, dst), pmin(src1, dst1), pmax(src1, dst1))][order(key)]

#    src dst src1 dst1  key
# 1:   A   J    o    x AJox
# 2:   J   A    x    o AJox
# 3:   B   I    p    w BIpw
# 4:   I   B    w    p BIpw
# 5:   C   H    q    v CHqv
# 6:   H   C    v    q CHqv
# 7:   D   G    r    u DGru
# 8:   G   D    u    r DGru
# 9:   E   F    s    t EFst
#10:   F   E    t    s EFst

但是，在现实生活中，可能至少有一行没有一对(“不完全流”)。所以一个现实生活中的例子是，

#              cdatetime   srcaddr dstaddr  srcport   dstport     key    totals time_diff
# 1: 2017-05-12 14:58:32    IP_1    IP_2   54793    8080 182808054793      3        NA
# 2: 2017-05-12 14:58:32    IP_2    IP_1    8080   54793 182808054793      3         0
# 3: 2017-05-17 08:37:16    IP_1    IP_2   54793    8080 182808054793      3    409124
# 4: 2017-05-11 08:12:28    IP_1    IP_2   54813    8080 182808054813      3        NA
# 5: 2017-05-11 08:12:28    IP_2    IP_1    8080   54813 182808054813      3         0
# 6: 2017-05-17 08:37:16    IP_1    IP_2   54813    8080 182808054813      3    519888
# 7: 2017-05-02 06:51:16    IP_1    IP_2   50794    8080 182808050794      5        NA
# 8: 2017-05-02 06:51:16    IP_2    IP_1    8080   50794 182808050794      5         0
# 9: 2017-05-08 06:57:08    IP_1    IP_2   50794    8080 182808050794      5    518752
#10: 2017-05-11 06:32:49    IP_1    IP_2   50794    8080 182808050794      5    257741
#11: 2017-05-11 06:32:49    IP_2    IP_1    8080   50794 182808050794      5         0
#12: 2017-05-04 06:52:05    IP_1    IP_2   51896    8080 182808051896      5        NA
#13: 2017-05-04 06:52:05    IP_2    IP_1    8080   51896 182808051896      5         0
#14: 2017-05-04 10:22:26    IP_1    IP_2   51896    8080 182808051896      5     12621
#15: 2017-05-04 10:22:26    IP_2    IP_1    8080   51896 182808051896      5         0
#16: 2017-05-08 07:22:47    IP_1    IP_2   51896    8080 182808051896      5    334821
#17: 2017-05-15 05:56:00    IP_1    IP_2   62744     162  17016262744      3        NA
#18: 2017-05-17 10:41:00    IP_1    IP_2   62744     162  17016262744      3    189900
#19: 2017-05-18 09:31:00    IP_1    IP_2   62744     162  17016262744      3     82200

现在的第二个目标是删除那些不完整的流程。现在，为了识别那些“不完整的流”，我们计算它们之间的时间差并将 30 设置为阈值。棘手的部分来了；如果我们只有 2 行并且它们相隔超过 30 秒，那么将它们都过滤掉并且过滤 3 行(对于某个键)那么时间差异 > 30 的那一行需要去 - 或者如果其中两行 > 30相隔几秒钟，删除所有 3 个。 然而 ，当我们有 4 行或更多行时，我们需要删除时间差 > 30 没有另一对 < 30 .从上表中，第 3、6、9、16、17、18、19 行必须根据它们相隔 30 秒以上的条件进行删除。看着 cdatetime将阐明哪些是完整的流程。

预期输出为 ,

 #        cdatetime      srcaddr dstaddr srcport dstport          key totals time_diff
# 1: 2017-05-12 14:58:32    IP_1    IP_2   54793    8080 182808054793      3        NA
# 2: 2017-05-12 14:58:32    IP_2    IP_1    8080   54793 182808054793      3         0
# 3: 2017-05-11 08:12:28    IP_1    IP_2   54813    8080 182808054813      3        NA
# 4: 2017-05-11 08:12:28    IP_2    IP_1    8080   54813 182808054813      3         0
# 5: 2017-05-02 06:51:16    IP_1    IP_2   50794    8080 182808050794      5        NA
# 6: 2017-05-02 06:51:16    IP_2    IP_1    8080   50794 182808050794      5         0
# 7: 2017-05-11 06:32:49    IP_1    IP_2   50794    8080 182808050794      5    257741
# 8: 2017-05-11 06:32:49    IP_2    IP_1    8080   50794 182808050794      5         0
# 9: 2017-05-04 06:52:05    IP_1    IP_2   51896    8080 182808051896      5        NA
#10: 2017-05-04 06:52:05    IP_2    IP_1    8080   51896 182808051896      5         0
#11: 2017-05-04 10:22:26    IP_1    IP_2   51896    8080 182808051896      5     12621
#12: 2017-05-04 10:22:26    IP_2    IP_1    8080   51896 182808051896      5         0

以上真实案例数据

structure(list(cdatetime = structure(c(1494590312, 1494590312, 
1494999436, 1494479548, 1494479548, 1494999436, 1493697076, 1493697076, 
1494215828, 1494473569, 1494473569, 1493869925, 1493869925, 1493882546, 
1493882546, 1494217367, 1494816960, 1495006860, 1495089060), class = c("POSIXct", 
"POSIXt"), tzone = ""), srcaddr = structure(c(1L, 2L, 1L, 1L, 
2L, 1L, 1L, 2L, 1L, 1L, 2L, 1L, 2L, 1L, 2L, 1L, 1L, 1L, 1L), .Label = c("IP_1", 
"IP_2"), class = "factor"), dstaddr = structure(c(2L, 1L, 2L, 
2L, 1L, 2L, 2L, 1L, 2L, 2L, 1L, 2L, 1L, 2L, 1L, 2L, 2L, 2L, 2L
), .Label = c("IP_1", "IP_2"), class = "factor"), srcport = c(54793L, 
8080L, 54793L, 54813L, 8080L, 54813L, 50794L, 8080L, 50794L, 
50794L, 8080L, 51896L, 8080L, 51896L, 8080L, 51896L, 62744L, 
62744L, 62744L), dstport = c(8080L, 54793L, 8080L, 8080L, 54813L, 
8080L, 8080L, 50794L, 8080L, 8080L, 50794L, 8080L, 51896L, 8080L, 
51896L, 8080L, 162L, 162L, 162L), key = c(182808054793, 182808054793, 
182808054793, 182808054813, 182808054813, 182808054813, 182808050794, 
182808050794, 182808050794, 182808050794, 182808050794, 182808051896, 
182808051896, 182808051896, 182808051896, 182808051896, 17016262744, 
17016262744, 17016262744), totals = c(3L, 3L, 3L, 3L, 3L, 3L, 
5L, 5L, 5L, 5L, 5L, 5L, 5L, 5L, 5L, 5L, 3L, 3L, 3L), time_diff = c(NA, 
0, 409124, NA, 0, 519888, NA, 0, 518752, 257741, 0, NA, 0, 12621, 
0, 334821, NA, 189900, 82200)), .Names = c("cdatetime", "srcaddr", 
"dstaddr", "srcport", "dstport", "key", "totals", "time_diff"
), row.names = c(NA, -19L), class = c("data.table", "data.frame"
))

以上所有内容都将在一个数据集上运行大约。 180M 行，所以效率是这里的关键词。

Answer 1

显然这有效:

DT[, keep := 
  (!is.na(time_diff) & time_diff < 30) | 
  shift(time_diff, type="lead", fill = 999) < 30
, by=key]

DT[(keep), !"keep"]

              cdatetime srcaddr dstaddr srcport dstport          key totals time_diff
 1: 2017-05-12 07:58:32    IP_1    IP_2   54793    8080 182808054793      3        NA
 2: 2017-05-12 07:58:32    IP_2    IP_1    8080   54793 182808054793      3         0
 3: 2017-05-11 01:12:28    IP_1    IP_2   54813    8080 182808054813      3        NA
 4: 2017-05-11 01:12:28    IP_2    IP_1    8080   54813 182808054813      3         0
 5: 2017-05-01 23:51:16    IP_1    IP_2   50794    8080 182808050794      5        NA
 6: 2017-05-01 23:51:16    IP_2    IP_1    8080   50794 182808050794      5         0
 7: 2017-05-10 23:32:49    IP_1    IP_2   50794    8080 182808050794      5    257741
 8: 2017-05-10 23:32:49    IP_2    IP_1    8080   50794 182808050794      5         0
 9: 2017-05-03 23:52:05    IP_1    IP_2   51896    8080 182808051896      5        NA
10: 2017-05-03 23:52:05    IP_2    IP_1    8080   51896 182808051896      5         0
11: 2017-05-04 03:22:26    IP_1    IP_2   51896    8080 182808051896      5     12621
12: 2017-05-04 03:22:26    IP_2    IP_1    8080   51896 182808051896      5         0

我想有很多方法可以使它更快，但澄清它是否在做 OP 想要的事情可能更重要(考虑到代码比 OP 的规则简单得多)。