Detecting "heavy hitter"flows is the core of many network security applications. While past work shows how to measure heavy hitters on a single switch, network operators often need to identify network-wide heavy hitters on a small timescale to react quickly to distributed attacks. Detecting network-wide heavy hitters efficiently requires striking a careful balance between the memory and processing resources required on each switch and the network-wide coordination protocol. We present Carpe, a distributed system for detecting network-wide heavy hitters with high accuracy under communication and state constraints. Our solution combines probabilistic counting techniques on the switches with probabilistic reporting to a central coordinator. Based on these reports, the coordinator adapts the reporting threshold and probability at each switch to the spatial locality of the flows. Simulations using traffic traces show that our prototype can detect network-wide heavy hitters with 97% accuracy, while reducing the communication overhead by 17% and switch state by 38%, compared to existing approaches.
|Title of host publication||Proceedings of the 2020 ACM SIGCOMM Workshop on Secure Programmable Network Infrastructure, SPIN 2020|
|Publisher||Association for Computing Machinery|
|Number of pages||7|
|State||Published - 10 Aug 2020|
|Event||1st ACM SIGCOMM Workshop on Secure Programmable Network Infrastructure, SPIN 2020 - Virtual, Online, United States|
Duration: 14 Aug 2020 → …
|Name||Proceedings of the 2020 ACM SIGCOMM Workshop on Secure Programmable Network Infrastructure, SPIN 2020|
|Conference||1st ACM SIGCOMM Workshop on Secure Programmable Network Infrastructure, SPIN 2020|
|Period||14/08/20 → …|
Bibliographical noteFunding Information:
The views expressed in this article are those of the authors and do not reflect the official policy or position of the Department of the Army, Department of Defense or the U.S. Government. This research was also supported by NSF Grant CCF-1535948.
© 2020 ACM.
- Heavy hitters
- Network-wide monitoring