Proceedings of the Conference of the ACM Special Interest Group on Data Communication 2017
DOI: 10.1145/3098822.3098832
|View full text |Cite
|
Sign up to set email alerts
|

Constant Time Updates in Hierarchical Heavy Hitters

Abstract: Monitoring tasks, such as anomaly and DDoS detection, require identifying frequent flow aggregates based on common IP prefixes. These are known as hierarchical heavy hitters (HHH), where the hierarchy is determined based on the type of prefixes of interest in a given application. The per packet complexity of existing HHH algorithms is proportional to the size of the hierarchy, imposing significant overheads.In this paper, we propose a randomized constant time algorithm for HHH. We prove probabilistic precision… Show more

Help me understand this report
View preprint versions

Search citation statements

Order By: Relevance

Paper Sections

Select...
2
1
1
1

Citation Types

2
66
0
4

Year Published

2018
2018
2021
2021

Publication Types

Select...
5
2
2

Relationship

1
8

Authors

Journals

citations
Cited by 117 publications
(72 citation statements)
references
References 41 publications
2
66
0
4
Order By: Relevance
“…Recent work [41] also leverage switches to efficiently point to distributed end-host information for whole network visibility. Switch-based monitoring tools: Since hardware switches have limited memory resources for monitoring tasks, memoryoptimized sketching algorithms have been proposed to a variety of flow monitoring tasks, such as heavy hitters (frequent flows) [42,14,43,15], detecting hierarchical heavy hitters [20,21], counting distinct flows [44,18], estimating frequency moments [11], and change detection [45,18]. These sketching algorithms offer worst-case guarantees to arbitrary network workloads and use sublinear memory in terms of the number of distinct network flows.…”
Section: Related Workmentioning
confidence: 99%
See 1 more Smart Citation
“…Recent work [41] also leverage switches to efficiently point to distributed end-host information for whole network visibility. Switch-based monitoring tools: Since hardware switches have limited memory resources for monitoring tasks, memoryoptimized sketching algorithms have been proposed to a variety of flow monitoring tasks, such as heavy hitters (frequent flows) [42,14,43,15], detecting hierarchical heavy hitters [20,21], counting distinct flows [44,18], estimating frequency moments [11], and change detection [45,18]. These sketching algorithms offer worst-case guarantees to arbitrary network workloads and use sublinear memory in terms of the number of distinct network flows.…”
Section: Related Workmentioning
confidence: 99%
“…Our design is inspired by the rich literature of sketching algorithms in network flow monitoring, where the traffic is modeled as a stream of elements [11]. A number of sketching algorithms have been introduced to accurately estimate various flow metrics such as heavy hitters [12,13,14,15,16,17,18], hierarchical heavy hitters [19,20,21], flow size distribution [12,22,23], and change detection [17,18]. These algorithms allow for memory-efficient measurement systems while maintaining guaranteed fidelity.…”
Section: Introductionmentioning
confidence: 99%
“…CM [17], 4 CU [20], Count [21], and Elastic. For CM, CU, and Count, we use 3 hash functions as recommended in [62].…”
Section: A Experimental Setupmentioning
confidence: 99%
“…Finally, we apply (6) to conclude that once x arrives with a cumulative volume of t · M · , it will never be evicted (Line 7) and from that moment on its volume will be measured exactly.…”
Section: Proof Of Lemmamentioning
confidence: 99%