ActiveGuardian: An accurate and efficient algorithm for identifying active elephant flows in network traffic

Abstract

Active elephant flows, which indicate the real-time data transmission status, are of primary interest in network management and various applications. However, existing network measurement efforts mainly focus on finding elephant flows, and limited works on identifying active elephant flows suffer from low accuracy and heavy overheads. To address this issue, this paper proposes ActiveGuardian to identify active elephant flows with high accuracy, low memory, and high throughput. The key idea is to intelligently separate potential elephant flows from mice flows, and guard and report the information of active elephant flows in every time window. To obtain high accuracy, we devise a filtering module that adaptively filters unnecessary flows with low arrival rates, by applying an Adaptive Counter Update strategy. To achieve high memory utilization, we design a Leapfrog Hashing algorithm for the guarding module to effectively solve hash collisions. Lastly, we perform theoretical derivation on the false positive and the error bound of ActiveGuardian, and experimental evaluations on its performance with real network traffic traces. The experimental results show that ActiveGuardian achieves higher accuracy (99.65%) with identical memory sizes, and higher throughput (26.53Mps) than the state-of-the-art solutions.