Towards in-network time-decaying aggregates for heavy-hitter detection

Keeping track of heavy hitters (HH) entirely in the data plane is an all-important aspect of many real-time monitoring tasks (e.g., load-balancing, attack detection). Existing interval-reset-based sketch and hash table approaches are incapable of delivering consistent and high accuracy when operating in heterogeneous scenarios where various applications with different purposes require the flows to be tracked at different time scales, not to mention their dependence on the control plane for data structure management. We propose HashAge and SkAge, novel in-network time-decaying algorithms for hash table- and sketch-based HH detection. We show that our proposed algorithms offer consistent and higher detection accuracy while operating in heterogeneous demands whilst not requiring any data structure management from the control plane at all.