Memory-Efficient and Flexible Detection of Heavy Hitters in High-Speed Networks

He Huang, Jiakun Yu, Yang Du, Jia Liu, Haipeng Dai, Yu-E Sun
{"title":"Memory-Efficient and Flexible Detection of Heavy Hitters in High-Speed Networks","authors":"He Huang, Jiakun Yu, Yang Du, Jia Liu, Haipeng Dai, Yu-E Sun","doi":"10.1145/3617334","DOIUrl":null,"url":null,"abstract":"Heavy-hitter detection is a fundamental task in network traffic measurement and security. Existing work faces the dilemma of suffering dynamic and imbalanced traffic characteristics or lowering the detection efficiency and flexibility. In this paper, we propose a flexible sketch called SwitchSketch that embraces dynamic and skewed traffic for efficient and accurate heavy-hitter detection. The key idea of SwitchSketch is allowing the sketch to dynamically switch among different modes and take full use of each bit of the memory. We present an encoding-based switching scheme together with a flexible bucket structure to jointly achieve this goal by using a combination of design features, including variable-length cells, shrunk counters, embedded metadata, and switchable modes. We further implement SwitchSketch on the NetFPGA-1G-CML board. Experimental results based on real Internet traces show that SwitchSketch achieves a high Fβ-Score of threshold-t detection (consistently higher than 0.938) and over 99% precision rate of top-k detection under a tight memory size (e.g., 100KB). Besides, it outperforms the state-of-the-art by reducing the ARE by 30.77%\\sim99.96%. All related implementations are open-sourced.","PeriodicalId":498157,"journal":{"name":"Proceedings of the ACM on Management of Data","volume":"34 8","pages":"0"},"PeriodicalIF":0.0000,"publicationDate":"2023-11-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"0","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"Proceedings of the ACM on Management of Data","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.1145/3617334","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}
引用次数: 0

Abstract

Heavy-hitter detection is a fundamental task in network traffic measurement and security. Existing work faces the dilemma of suffering dynamic and imbalanced traffic characteristics or lowering the detection efficiency and flexibility. In this paper, we propose a flexible sketch called SwitchSketch that embraces dynamic and skewed traffic for efficient and accurate heavy-hitter detection. The key idea of SwitchSketch is allowing the sketch to dynamically switch among different modes and take full use of each bit of the memory. We present an encoding-based switching scheme together with a flexible bucket structure to jointly achieve this goal by using a combination of design features, including variable-length cells, shrunk counters, embedded metadata, and switchable modes. We further implement SwitchSketch on the NetFPGA-1G-CML board. Experimental results based on real Internet traces show that SwitchSketch achieves a high Fβ-Score of threshold-t detection (consistently higher than 0.938) and over 99% precision rate of top-k detection under a tight memory size (e.g., 100KB). Besides, it outperforms the state-of-the-art by reducing the ARE by 30.77%\sim99.96%. All related implementations are open-sourced.
查看原文
分享 分享
微信好友 朋友圈 QQ好友 复制链接
本刊更多论文
高速网络中高效内存和灵活的重磅攻击检测
重攻击检测是网络流量测量和网络安全的一项基础性工作。现有工作面临着受动态、不均衡交通特征影响或降低检测效率和灵活性的困境。在本文中,我们提出了一个灵活的草图,称为SwitchSketch,它包含动态和倾斜的流量,以实现高效和准确的重磅检测。SwitchSketch的关键思想是允许草图在不同模式之间动态切换,并充分利用每一位内存。我们提出了一种基于编码的切换方案以及灵活的桶结构,通过使用可变长度单元、收缩计数器、嵌入元数据和可切换模式等设计特征的组合来共同实现这一目标。我们进一步在NetFPGA-1G-CML板上实现SwitchSketch。基于真实互联网痕迹的实验结果表明,在较紧的内存大小(例如100KB)下,SwitchSketch实现了较高的阈值t检测Fβ-Score(始终高于0.938),top-k检测准确率超过99%。此外,它比最先进的技术降低了30.77% / 99.96%的ARE。所有相关的实现都是开源的。
本文章由计算机程序翻译,如有差异,请以英文原文为准。
求助全文
约1分钟内获得全文 去求助
来源期刊
自引率
0.00%
发文量
0
期刊最新文献
Verification of Unary Communicating Datalog Programs Postulates for Provenance: Instance-based provenance for first-order logic Tight Lower Bounds for Directed Cut Sparsification and Distributed Min-Cut Containment of Graph Queries Modulo Schema Bag Semantics Conjunctive Query Containment. Four Small Steps Towards Undecidability.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
已复制链接
已复制链接
快去分享给好友吧!
我知道了
×
扫码分享
扫码分享
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1