Tracing Network-Wide Heavy Hitters in Network Data Streams

Abstract

Tracing network-wide heavy hitters in massive network traffic is important for applications such as traffic engineering, load balancing and anomaly detection. It is challenging to process packets at high speed and use the limited resource. Moreover, heavy hitters are distributed by nature due to packets spanning across the entire network. To this end, we propose a tracing algorithm of network-wide heavy hitters in network data streams, which mainly consists of preprocessing packet, updating data structure, constructing candidates of heavy hitters, estimating the size of heavy hitters. Our method constructs candidates of heavy hitters and estimates their size by only its summary data structure, such that it incurs small computation and memory access overhead, while achieving high identification accuracy. We present theoretical analysis on the space complexity, time complexity and accuracy. The experiments are conducted on the real network traffic and the results show that our method outperforms the related ones in terms of identification accuracy and estimation accuracy.