A Detecting Superpoint Algorithm on Multiple Sampling Technology

Abstract

Super points are sources or destinations that connect to a larger number of distinct destinations or sources during a measurement time interval. High-speed monitoring of super points is a challenging problem with application to real-time attack detection using a limited memory space. In this paper, we propose a method for detecting super points, and prove guarantees on their accuracy and memory requirements. Our method is based on sampling and data streaming, and sampling technique can probabilistically assure to sample only large-flow sources or destinations. Data streaming technique sets an IP bitmap and flow bitmap to judge an existed IP. Our method are both theoretically and experimentally more efficient than previous approaches.