Accurately Identify Time-decaying Heavy Hitters by Decay-aware Cuckoo Filter along Kicking Path

Abstract

In high-speed networks, flow-level traffic measurement is an essential tool to understand how network bandwidth is being utilized. It can be used to detect anomalous traffic behaviors due to operational or security issues. Perhaps the most important measurement task is to track the heavy hitters (HHs), i.e., the flows occupying the greatest shares of bandwidth. But most existing solutions have no concept of time window: Whenever a measurement period ends, the data sketch, which is deployed in the data plane for monitoring HHs, must be transferred to the control plane and then reset to zeros. It is better to capture network conditions of the continuous recent past by designing a HHs measurement solution that can support time-decaying window. As a result, recently several related works are devoted to tracking the time-decaying heavy hitters, including time-decaying CountMin and time-decaying Space-Saving. However, their memory-accuracy tradeoff is still suboptimal. In this paper, we attain higher performance by proposing a new algorithm named DecayAware Cuckoo Filter along Kicking Path (DAKP-CF). It can be regarded as a variant of cuckoo filter (an improved version of hash table with better memory efficiency), which transforms each bucket into a bucket-level min-heap. Its key advantage is that, when we update the table as a packet arrive, it can discover and replace the most time-decayed flow along the kicking path of a cuckoo filter. We deliberately avoid scanning the entire table to keep the high time efficiency. The experiment results show that our DAKP-CF can reach the same identification accuracy as existing methods with roughly 25% memory cost. In addition, we build a prototype of our DAKP-CF by P4-programmable BMv2 software switch.