Low-Rate Overuse Flow Tracer (LOFT): An Efficient and Scalable Algorithm for Detecting Overuse Flows

Current probabilistic flow-size monitoring can only detect heavy hitters (e.g., flows utilizing 10 times their permitted bandwidth), but cannot detect smaller overuse (e.g., flows utilizing 50-100 % more than their permitted bandwidth). Thus, these systems lack accuracy in the challenging environmen...

Full description

Saved in:
Bibliographic Details
Main Authors: Scherrer, Simon, Wu, Che-Yu, Chiang, Yu-Hsi, Rothenberger, Benjamin, Asoni, Daniele E., Sateesan, Arish, Vliegen, Jo, Mentens, Nele, Hsiao, Hsu-Chun, Perrig, Adrian
Format: Conference Proceeding
Language:English
Subjects:
Bandwidth
Estimation
flow monitoring
Measurement errors
Memory management
network monitoring
Probabilistic logic
Quality of Service
Scalability
sketching
Online Access:Request full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:Current probabilistic flow-size monitoring can only detect heavy hitters (e.g., flows utilizing 10 times their permitted bandwidth), but cannot detect smaller overuse (e.g., flows utilizing 50-100 % more than their permitted bandwidth). Thus, these systems lack accuracy in the challenging environment of high-throughput packet processing, where fast-memory resources are scarce. Nevertheless, many applications rely on accurate flow-size estimation, e.g., for network monitoring, anomaly detection and Quality of Service. We design, analyze, implement, and evaluate LOFT, a new approach for efficiently detecting overuse flows that achieves dramatically better properties than prior work. LOFT can detect 1.50x overuse flows in one second, whereas prior approaches can only reliably detect flows that overuse their allocation by at least 3x. We demonstrate LOFT's suitability for high-speed packet processing with implementations in the DPDK framework and on an FPGA.
ISSN:2575-8462
DOI:10.1109/SRDS53918.2021.00034