Abstract:Traffic measurement in high-speed networks has many important functions in improving network performance, assisting resource allocation, and detecting anomalies. In this paper, we study a generalized problem called k-persistent spread estimation, which measures the volume of persist traffic elements in each flow that appear during at least k out of t measurement periods, where k and t are two positive integers that can be arbitrarily set in user queries, with k ≤ t. Solutions to this problem have interesting applications in network attack detection, popular content identification, user access profiling, etc. There is very limited prior art for this problem, only addressing the special case of k = t under a flawed assumption. Removing this assumption, we propose an efficient and accurate estimator for generalized k-persistent traffic measurement, with k ≤ t. Our method relies on bitwise SUM, instead of bitwise AND in the prior art, to combine the information collected from different periods. This change has fundamental impact on the probabilistic analysis that derives the estimator, particular over space-saving virtual bitmaps. Based on real network traces, we demonstrate experimentally the effectiveness of our new method in estimating the k-persistent spreads of all network flows. Our estimator performs much better than the prior art on its case of k = t. We also incorporate a sampling module to the estimator for improved flexibility, and give a use study on how to detect and find DDoS attackers using the proposed estimator.

A Probability-Guaranteed Adaptive Timeout Algorithm For High-Speed Network Flow Detection

An Adaptive Strategy for High-Speed Network Flow Compression

Mice flow transmission mechanism: Delay-sensitive Fast-Pacing TCP

An Algorithm for Reducing Loss Rate of High-Speed TCP

Detection and Response of Low-Rate TCP-targeted Denial of Service Attacks

AFTM: an Adaptive Flow Table Management Scheme for OpenFlow Switches.

An Efficient TCP Flow State Management Algorithm in High-Speed Network

An Identification Method Combining Data Streaming Counting with Probabilistic Fading for Heavy-Hitter Flows

Research on Detection and Mitigation Methods of Adaptive Flow Table Overflow Attacks in Software-Defined Networks

A Dynamic Flow Table Management Method Based on Real-time Traffic Monitoring

Time Stratified Adaptive Packet Sampling Based on Traffic Load

An Efficient K-Persistent Spread Estimator for Traffic Measurement in High-Speed Networks

Probabilistic Fading Counting: an Efficient Identification Method for Finding Heavy Hitters

An adaptive method for identifying heavy hitters combining sampling and data streaming counting

A Heuristic Scheduling Algorithm for Time-Trigger Flows in Time-Sensitive Networking

A novel spread estimation based abnormal flow detection in high-speed networks

Abnormal Behavior Detection and Control in High Speed Networks Based on Bidirectional Flow

Adaptive Packet Dropping: an Algorithm for Fair Bandwidth Sharing

Accurate and Efficient Traffic Monitoring Using Adaptive Non-Linear Sampling Method

An Efficient Adaptive Denoising Sketch for Per-flow Traffic Measurement

Flow Scheduling Algorithm for Traffic Generation in High-Speed Network Performance Testing