CPSketch: A ‘couple’ sketch-based heavy flow detection method

Abstract

One of the core challenges in network measurement for large-scale networks is the accurate and efficient identification of heavy flows. This task has grown increasingly complex due to limited memory resources and the dynamic nature of network traffic patterns. Most current heavy flow detection methods fail to fully consider the mutual collisions between large flows and their sparse distribution, which are caused by the combined effects of hash collisions and the heavy-tailed distribution of network traffic, resulting in an inefficient use of limited memory resources. Additionally, existing approaches uniformly treat all flows. As a result, when the network contains many small flows, heavy flows are frequently and erroneously replaced. To address these issues, we propose CPSketch, a novel method that combines sketch with ‘couple’ buckets to enhance heavy flow detection accuracy. CPSketch optimizes memory utilization by leveraging cold buckets to store more heavy flows. Specifically, it accurately estimates flow sizes by monitoring the number of matched packets for candidate flows in real-time. For small flows, CPSketch rapidly identifies and evicts them based on flow ratios. For other flows, CPSketch calculates replacement probabilities using multidimensional statistical information. To protect heavy flows that have been incorrectly evicted, CPSketch employs a global hash function to provide additional storage opportunities and dynamically constructs couple buckets for these heavy flows. Moreover, CPSketch extends the selection range for minimum flows by leveraging couple buckets in the flow replacement policy, effectively mitigating the impact of hash limitations and improving memory efficiency. Experimental results from trace-driven simulations and Open vSwitch (OVS) tests demonstrate that CPSketch outperforms existing methods in accuracy, even under constrained memory and high traffic loads. It achieves improvements of up to 14.74 % in F1-score while reducing the Average Relative Error (ARE) by 41.72 % and the Average Absolute Error (AAE) by 42.18 %.