Knowledge Discovery: Can It Shed New Light on Threshold Definition for Heavy-Hitter Detection?

Pekár, Adrián; Duque-Torres, Alejandra; Seah, Winston K.G.; Rendón, Óscar Mauricio Caicedo

doi:10.1007/s10922-021-09593-w

Cited by 8 publications

(18 citation statements)

References 52 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…As Zhang et al [2] and our analysis of correlations, Lan et al find strong correlation between TCP size and rate. Beside their characterization, Heavy Hitters are object of study regarding their identification and detection [12][13][14]. Burstiness of CAIDA traces is studied by Lazarou et al [15].…”

Section: Related Workmentioning

confidence: 99%

On the evolution of internet flow characteristics

Bauer

Jaeger

Helfert

et al. 2021

Proceedings of the Applied Networking Research Workshop

View full text Add to dashboard Cite

The ongoing evolution of technologies and network services on the Internet indicates ongoing changes in traffic and flow characteristics. Since the analysis of flow characteristics, like duration, size, and rate, has been a frequently studied topic before, results on the evolution of flow characteristics are rare. This paper surveys how flow characteristics have changed over time and whether there are significant trends in such characteristics.We present a long-term study of TCP flow characteristics based on traffic captures taken between 2008 and 2019.We apply different methods to analyze the distribution of characteristics, the relevance of heavy hitters, and correlations between characteristics. Our analysis shows significant trends in the 99th percentiles of flow characteristics, persistent dominance by heavy hitters regarding transmitted data, and increasing relevance of so-called big-fast flows.

show abstract

Section: Related Workmentioning

confidence: 99%

On the evolution of internet flow characteristics

Bauer

Jaeger

Helfert

et al. 2021

Proceedings of the Applied Networking Research Workshop

View full text Add to dashboard Cite

show abstract

“…Our rigorous analysis of four fairly known and frequently used publicly available traffic traces (i.e., UNIV1, 91 UNIV2, 91 CAIDA2016, 92 and CAIDA2018 93 ) revealed that the flows exhibit a distinct characteristic when inspected based on their per-flow packet size distribution. 94 This feature makes them classifiable into several classes, as shown in Figure 1. Two classes represent the minimums and maximums, i.e., non-HHs and HHs.…”

Section: Per-flow Packet Size Distributionmentioning

confidence: 99%

“…Nonetheless, determining the ground truth thresholds (see Section 4) that can classify the flows into the classes remains critical and should base on a detailed analysis of the network and its traffic. 94…”

Section: Per-flow Packet Size Distributionmentioning

confidence: 99%

“…Additionally, our research in the area of HH identification revealed that a threshold that performs efficiently in one network will likely under-perform in another. 94 This is the result of variable application flow type counts that strongly relate to the heavy tailed nature of the network traffic. 12 Consequently, threshold selection (even though only for ground-truth development) should include a detailed analysis of the network and its traffic.…”

Section: Ground Truth Developmentmentioning

confidence: 99%

“…K-means was selected mainly because of its simplicity, speed, accuracy, and efficacy in analyzing networking traffic data. 94,105,106 Silhouette analysis was an obvious choice since it has shown to be an effective method to determine the clusters in networking data sets. 107 Additionally, it has provided better results when compared to the Elbow method.…”

Section: K-means Clusteringmentioning

confidence: 99%

See 2 more Smart Citations

Towards threshold‐agnostic heavy‐hitter classification

et al. 2021

Self Cite

View full text Add to dashboard Cite

A heavy-hitter (HH) network traffic flow consumes considerably more network resources than other flows combined. The classification of HHs is critical to provide, among others, the required level of Quality of Service and reliability in both conventional and data center networks. HH classification is typically threshold-based. However, there is no consistent and accepted threshold or set of thresholds that would reliably classify flows. Furthermore, existing threshold-driven approaches use counters (e.g., duration, packets, and bytes); thus, their accuracy depends on how complete the flow information is. This paper paves the way to threshold-agnostic HH identification by proposing an approach that performs HH classification based on per-flow packet size distribution (PSD) and template matching (TM). PSD allows capturing the behavior and dynamism of network traffic flows (even from their first few packets). TM enables to classify HHs by measuring the similarity between the PSD of observed flows and a set of master templates representing the flow size behavior of HH classes. We evaluated the PSD-and TM-based approach using flows extracted from real traffic traces. Results show that our approach classifies HHs accurately and timely, corroborating that the threshold-less perspective is feasible for HH identification.

show abstract

FMap: A fuzzy map for scheduling elephant flows through jumping traveling salesman problem variant toward software‐defined networking‐based data center networks

Abdollahi

Asadi

Montazerolghaem

et al. 2023

Concurrency and Computation

View full text Add to dashboard Cite

SummaryNowadays data center networks (DCNs) should handle the ever‐growing load generated by diverse applications. It particularly occurs under concurrent flow requests and so‐called mice flows (MFs): elephant flows (EFs) ratio. Concentrating on a binary vision over flow size classification (EF or MF) results in subsequent unpredicted load imbalance due to neglecting EF's distinctions including a wide range of sizes. As a result, some EFs might utilize a path owing qualities beyond the given EF's demands, while another EF with higher requirements is attending to use an over‐utilized path. This article proposes FMap, a fuzzy map for scheduling EFs through our proposed variant of traveling salesperson problem (TSP) toward DCNs. FMap represents a novel EF scheduling scheme that integrates flow prioritization and routing decisions under the event pf parallel incoming flows besides the cooperation of the controller and OpenFlow switches in software‐defined networking (SDN) paradigm. FMap adopts fuzzy inference process to overcome the vagueness over EF's resource allocation. Mainly, FMap proposes a new variant of TSP (optimized by genetic algorithm) which enables EF's group forwarding with a minimum cost. FMap reduces the total hop count of EFs through considering a single optimal path for delivering groups of EFs that contain a same tag (priority). The outstanding results represent a major improvement as compared with equal cost multiple path, Hedera, Sonoum, and Size‐KP‐PSO. Particularly, the results illustrate an outperforming by 3.76×, 0.21×, 0.15×, 0.03×, and 0.03× in terms of total hop count, EFs FCT, packet loss, goodput, and received packets as compared with Size‐KP‐PSO, respectively.

show abstract

Knowledge Discovery: Can It Shed New Light on Threshold Definition for Heavy-Hitter Detection?

Cited by 8 publications

References 52 publications

On the evolution of internet flow characteristics

On the evolution of internet flow characteristics

Towards threshold‐agnostic heavy‐hitter classification

FMap: A fuzzy map for scheduling elephant flows through jumping traveling salesman problem variant toward software‐defined networking‐based data center networks

Contact Info

Product

Resources

About