Identifying heavy hitters in high-speed network monitoring

来源 :Science China(Information Sciences) | 被引量 : 0次 | 上传用户:bbschengpengfei
下载到本地 , 更方便阅读
声明 : 本文档内容版权归属内容提供方 , 如果您对本文有版权争议 , 可与客服联系进行内容授权或下架
论文部分内容阅读
Identifying heavy hitters in a network traffic stream is important for a variety of network applications ranging from traffic engineering to anomaly detection such as detection of denial-of-service attacks. Existing methods generally examine newly arriving items in the stream, perform a small number of operations using a small amount of memory, and still provide guarantees on the identifying accuracy. In high-speed network monitoring, the update speed per item is extremely critical. However, so far as we know, there are no identifying algorithms which can provide constant update time (O(1)) in a weighted data stream. In this paper, we present an algorithm named Weighted Lossy Counting (WLC) which is able to identify heavy hitters in a high-speed weighted data stream with constant update time. WLC employs a novel efficient partially ordered data structure which is able to provide a fast per-item update speed while keeping the memory cost relatively low. We compare WLC with state-of-the-art algorithms for finding heavy hitters in real traffic traces. The experimental results show that WLC performs well in accuracy (recall, precision and average relative error) as other algorithms; moreover it has a much higher update speed at the cost of relatively larger memory space used. A theoretical worst-case memory bound of WLC is also derived in this paper; however, experiments with long real traffic traces show that WLC requires much less space than the theoretical bound in practice. Identifying heavy hitters in a network traffic stream is important for a variety of network applications ranging from traffic engineering to anomaly detection such as detection of denial-of-service attacks. operations using a small amount of memory, and still provide offers on the identifying accuracy. In high-speed network monitoring, the update speed per item is extremely critical. However, so far as as we know, there are no identifying algorithms which can provide constant In this paper, we present an algorithm named Weighted Lossy Counting (WLC) which is capable of identifying heavy hitters in a high-speed weighted data stream with constant update time. WLC employs a novel efficient partially ordered data structure which is able to provide a fast per-item update speed while keeping the memory cost relatively low. We compare WLC with state-of-the- The experimental results show that WLC performs well in accuracy (recall, precision and average relative error) as other algorithms; moreover it has a much higher update speed at the cost of relatively more memory space used. A theoretical worst-case memory bound of WLC is also derived in this paper; however, experiments with long real traffic traces show that WLC requires much less space than the theoretical bound in practice.
其他文献
贵州省是世界上最典型的岩溶地貌地区之一,国土面积为17.6×10km,岩溶出露面积占全省面积的62%。近年来,在"西部大开发"及"西电东送"的形势下,全省大小河流上设计并兴建了诸多
简要介绍五强溪电厂计算机监控系统改造方案设计原则与设计内容,在设计中重点考虑的问题以及与原系统改进的方面,在应用中出现的问题及解决方法等。可为其他电厂监控改造设计
通过对500hPa位势高度场大气环流特征与黄河上游龙羊峡、刘家峡两库入库径流的相关分析指出:丰、枯水年1月、2月及前一年12月北半球500hPa位势高度场具有明显的差异;丰水年冬
由于受地形、环流的影响以及下垫面的不同,黄河上游流域水沙异源,进入20世纪90年代以来,黄河上游水沙发生了较大变化,水沙量不断减少,进而造成各粒径级沙量的减少,依据长期实
会议
应用长江流域水土流失遥感调查资料和干支主要泥沙控制站的实测泥沙资料,分析了长江流域的产沙区分布、产沙的影响因素,含沙量和输沙量的时空变化、沿程泥沙粒径变化、输移比
会议
首先介绍了温排水物理模型试验的边界控制、试验设备工艺和试验条件的选取等技术要求。在此基础上,详细论述了在温排水物理模型上进行火电厂取排水布置的研究方法和内容,并就
通过荆江河段洲滩床沙取样、固定断面水下床沙取样,对河段内床沙组成级配沿流程、沿时程、横断面变化进行分析。尤其2003年6月,三峡水库蓄水用运后,河段内来沙量大幅减少,床
营养液栽培简称水培,以其管理简便、适应性强等特点,逐渐受到人们的青睐。本研究以曼地亚红豆杉(Taxus media)为材料,以精氧(Na2H2O2)、氯化钙(CaCl2)、γ-氨基丁酸(C4H9NO2)、水杨酸
黄河源头扎陵湖、鄂陵湖为吞吐湖泊,是黄河源头两大主要湖泊。扎陵湖、鄂陵湖等众多湖泊的滞洪拦沙作用,使大量泥沙淤积其中。源头控制站——黄河沿站实测输沙量、含沙量及输
会议
通过对张家口市上游清水河东沟的水土保持建设项目、流域降雨量、流域径流量、流域产沙量的分析,并与相邻流域东沟流域比较,得出流域生态建设对流域产沙量具有明显作用,并定