Carpe Elephants: Seize the Global Heavy Hitters

Rob Harrison; Shir  Landau Feibish; Arpit Gupta; Ross Teixeira; S. Muthukrishnan; Jennifer Rexford

doi:10.1145/3405669.3405820

Carpe Elephants: Seize the Global Heavy Hitters

Rob Harrison, Shir Landau Feibish, Arpit Gupta, Ross Teixeira, S. Muthukrishnan, Jennifer Rexford

Computer Science discipline

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

Abstract

Detecting "heavy hitter"flows is the core of many network security applications. While past work shows how to measure heavy hitters on a single switch, network operators often need to identify network-wide heavy hitters on a small timescale to react quickly to distributed attacks. Detecting network-wide heavy hitters efficiently requires striking a careful balance between the memory and processing resources required on each switch and the network-wide coordination protocol. We present Carpe, a distributed system for detecting network-wide heavy hitters with high accuracy under communication and state constraints. Our solution combines probabilistic counting techniques on the switches with probabilistic reporting to a central coordinator. Based on these reports, the coordinator adapts the reporting threshold and probability at each switch to the spatial locality of the flows. Simulations using traffic traces show that our prototype can detect network-wide heavy hitters with 97% accuracy, while reducing the communication overhead by 17% and switch state by 38%, compared to existing approaches.

Original language	English
Title of host publication	Proceedings of the 2020 ACM SIGCOMM Workshop on Secure Programmable Network Infrastructure, SPIN 2020
Publisher	Association for Computing Machinery
Pages	15-21
Number of pages	7
ISBN (Electronic)	9781450380416
DOIs	https://doi.org/10.1145/3405669.3405820
State	Published - 10 Aug 2020
Event	1st ACM SIGCOMM Workshop on Secure Programmable Network Infrastructure, SPIN 2020 - Virtual, Online, United States Duration: 14 Aug 2020 → …

Publication series

Name	Proceedings of the 2020 ACM SIGCOMM Workshop on Secure Programmable Network Infrastructure, SPIN 2020

Conference

Conference	1st ACM SIGCOMM Workshop on Secure Programmable Network Infrastructure, SPIN 2020
Country/Territory	United States
City	Virtual, Online
Period	14/08/20 → …

Bibliographical note

Funding Information:
The views expressed in this article are those of the authors and do not reflect the official policy or position of the Department of the Army, Department of Defense or the U.S. Government. This research was also supported by NSF Grant CCF-1535948.

Publisher Copyright:
© 2020 ACM.

Keywords

Heavy hitters
Network-wide monitoring

Access to Document

10.1145/3405669.3405820

Cite this

Harrison, R., Landau Feibish, S., Gupta, A., Teixeira, R., Muthukrishnan, S., & Rexford, J. (2020). Carpe Elephants: Seize the Global Heavy Hitters. In Proceedings of the 2020 ACM SIGCOMM Workshop on Secure Programmable Network Infrastructure, SPIN 2020 (pp. 15-21). (Proceedings of the 2020 ACM SIGCOMM Workshop on Secure Programmable Network Infrastructure, SPIN 2020). Association for Computing Machinery. https://doi.org/10.1145/3405669.3405820

Harrison, Rob ; Landau Feibish, Shir ; Gupta, Arpit et al. / Carpe Elephants : Seize the Global Heavy Hitters. Proceedings of the 2020 ACM SIGCOMM Workshop on Secure Programmable Network Infrastructure, SPIN 2020. Association for Computing Machinery, 2020. pp. 15-21 (Proceedings of the 2020 ACM SIGCOMM Workshop on Secure Programmable Network Infrastructure, SPIN 2020).

@inproceedings{c741d1bf175443bb8dafee7de40cc041,

title = "Carpe Elephants: Seize the Global Heavy Hitters",

abstract = "Detecting {"}heavy hitter{"}flows is the core of many network security applications. While past work shows how to measure heavy hitters on a single switch, network operators often need to identify network-wide heavy hitters on a small timescale to react quickly to distributed attacks. Detecting network-wide heavy hitters efficiently requires striking a careful balance between the memory and processing resources required on each switch and the network-wide coordination protocol. We present Carpe, a distributed system for detecting network-wide heavy hitters with high accuracy under communication and state constraints. Our solution combines probabilistic counting techniques on the switches with probabilistic reporting to a central coordinator. Based on these reports, the coordinator adapts the reporting threshold and probability at each switch to the spatial locality of the flows. Simulations using traffic traces show that our prototype can detect network-wide heavy hitters with 97% accuracy, while reducing the communication overhead by 17% and switch state by 38%, compared to existing approaches.",

keywords = "Heavy hitters, Network-wide monitoring",

author = "Rob Harrison and {Landau Feibish}, Shir and Arpit Gupta and Ross Teixeira and S. Muthukrishnan and Jennifer Rexford",

note = "Publisher Copyright: {\textcopyright} 2020 ACM.; 1st ACM SIGCOMM Workshop on Secure Programmable Network Infrastructure, SPIN 2020 ; Conference date: 14-08-2020",

year = "2020",

month = aug,

day = "10",

doi = "10.1145/3405669.3405820",

language = "אנגלית",

series = "Proceedings of the 2020 ACM SIGCOMM Workshop on Secure Programmable Network Infrastructure, SPIN 2020",

publisher = "Association for Computing Machinery",

pages = "15--21",

booktitle = "Proceedings of the 2020 ACM SIGCOMM Workshop on Secure Programmable Network Infrastructure, SPIN 2020",

}

Harrison, R, Landau Feibish, S, Gupta, A, Teixeira, R, Muthukrishnan, S & Rexford, J 2020, Carpe Elephants: Seize the Global Heavy Hitters. in Proceedings of the 2020 ACM SIGCOMM Workshop on Secure Programmable Network Infrastructure, SPIN 2020. Proceedings of the 2020 ACM SIGCOMM Workshop on Secure Programmable Network Infrastructure, SPIN 2020, Association for Computing Machinery, pp. 15-21, 1st ACM SIGCOMM Workshop on Secure Programmable Network Infrastructure, SPIN 2020, Virtual, Online, United States, 14/08/20. https://doi.org/10.1145/3405669.3405820

Carpe Elephants: Seize the Global Heavy Hitters. / Harrison, Rob; Landau Feibish, Shir ; Gupta, Arpit et al.
Proceedings of the 2020 ACM SIGCOMM Workshop on Secure Programmable Network Infrastructure, SPIN 2020. Association for Computing Machinery, 2020. p. 15-21 (Proceedings of the 2020 ACM SIGCOMM Workshop on Secure Programmable Network Infrastructure, SPIN 2020).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Carpe Elephants

T2 - 1st ACM SIGCOMM Workshop on Secure Programmable Network Infrastructure, SPIN 2020

AU - Harrison, Rob

AU - Landau Feibish, Shir

AU - Gupta, Arpit

AU - Teixeira, Ross

AU - Muthukrishnan, S.

AU - Rexford, Jennifer

PY - 2020/8/10

Y1 - 2020/8/10

N2 - Detecting "heavy hitter"flows is the core of many network security applications. While past work shows how to measure heavy hitters on a single switch, network operators often need to identify network-wide heavy hitters on a small timescale to react quickly to distributed attacks. Detecting network-wide heavy hitters efficiently requires striking a careful balance between the memory and processing resources required on each switch and the network-wide coordination protocol. We present Carpe, a distributed system for detecting network-wide heavy hitters with high accuracy under communication and state constraints. Our solution combines probabilistic counting techniques on the switches with probabilistic reporting to a central coordinator. Based on these reports, the coordinator adapts the reporting threshold and probability at each switch to the spatial locality of the flows. Simulations using traffic traces show that our prototype can detect network-wide heavy hitters with 97% accuracy, while reducing the communication overhead by 17% and switch state by 38%, compared to existing approaches.

AB - Detecting "heavy hitter"flows is the core of many network security applications. While past work shows how to measure heavy hitters on a single switch, network operators often need to identify network-wide heavy hitters on a small timescale to react quickly to distributed attacks. Detecting network-wide heavy hitters efficiently requires striking a careful balance between the memory and processing resources required on each switch and the network-wide coordination protocol. We present Carpe, a distributed system for detecting network-wide heavy hitters with high accuracy under communication and state constraints. Our solution combines probabilistic counting techniques on the switches with probabilistic reporting to a central coordinator. Based on these reports, the coordinator adapts the reporting threshold and probability at each switch to the spatial locality of the flows. Simulations using traffic traces show that our prototype can detect network-wide heavy hitters with 97% accuracy, while reducing the communication overhead by 17% and switch state by 38%, compared to existing approaches.

KW - Heavy hitters

KW - Network-wide monitoring

UR - http://www.scopus.com/inward/record.url?scp=85094972312&partnerID=8YFLogxK

U2 - 10.1145/3405669.3405820

DO - 10.1145/3405669.3405820

M3 - ???researchoutput.researchoutputtypes.contributiontobookanthology.conference???

AN - SCOPUS:85094972312

T3 - Proceedings of the 2020 ACM SIGCOMM Workshop on Secure Programmable Network Infrastructure, SPIN 2020

SP - 15

EP - 21

BT - Proceedings of the 2020 ACM SIGCOMM Workshop on Secure Programmable Network Infrastructure, SPIN 2020

PB - Association for Computing Machinery

Y2 - 14 August 2020

ER -

Harrison R, Landau Feibish S, Gupta A, Teixeira R, Muthukrishnan S, Rexford J. Carpe Elephants: Seize the Global Heavy Hitters. In Proceedings of the 2020 ACM SIGCOMM Workshop on Secure Programmable Network Infrastructure, SPIN 2020. Association for Computing Machinery. 2020. p. 15-21. (Proceedings of the 2020 ACM SIGCOMM Workshop on Secure Programmable Network Infrastructure, SPIN 2020). doi: 10.1145/3405669.3405820

Carpe Elephants: Seize the Global Heavy Hitters

Abstract

Publication series

Conference

Bibliographical note

Keywords

Access to Document

Other files and links

Fingerprint

Cite this