Public access to the Internet
The space complexity of approximating the frequency moments
STOC '96 Proceedings of the twenty-eighth annual ACM symposium on Theory of computing
New sampling-based summary statistics for improving approximate query answers
SIGMOD '98 Proceedings of the 1998 ACM SIGMOD international conference on Management of data
Random sampling for histogram construction: how much is enough?
SIGMOD '98 Proceedings of the 1998 ACM SIGMOD international conference on Management of data
High-speed policy-based packet forwarding using efficient multi-dimensional range matching
Proceedings of the ACM SIGCOMM '98 conference on Applications, technologies, architectures, and protocols for computer communication
Packet classification on multiple fields
Proceedings of the conference on Applications, technologies, architectures, and protocols for computer communication
Deriving traffic demands for operational IP networks: methodology and experience
Proceedings of the conference on Applications, Technologies, Architectures, and Protocols for Computer Communication
Trajectory sampling for direct traffic observation
Proceedings of the conference on Applications, Technologies, Architectures, and Protocols for Computer Communication
Space/time trade-offs in hash coding with allowable errors
Communications of the ACM
Computing Iceberg Queries Efficiently
VLDB '98 Proceedings of the 24rd International Conference on Very Large Data Bases
Wide-area Internet traffic patterns and characteristics
IEEE Network: The Magazine of Global Internetworking
Properties and prediction of flow statistics from sampled packet streams
Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment
Frequency Estimation of Internet Packet Streams with Limited Space
ESA '02 Proceedings of the 10th Annual European Symposium on Algorithms
A simple algorithm for finding frequent elements in streams and bags
ACM Transactions on Database Systems (TODS)
ACM SIGCOMM Computer Communication Review
Issues in data stream management
ACM SIGMOD Record
FDNA '03 Proceedings of the ACM SIGCOMM workshop on Future directions in network architecture
Identifying frequent items in sliding windows over on-line packet streams
Proceedings of the 3rd ACM SIGCOMM conference on Internet measurement
Taming the underlying challenges of reliable multihop routing in sensor networks
Proceedings of the 1st international conference on Embedded networked sensor systems
DCAP: detecting misbehaving flows via collaborative aggregate policing
ACM SIGCOMM Computer Communication Review
Distributed Management Architecture for Cooperative Detection and Reaction to DDoS Attacks
Journal of Network and Systems Management
Flow classification by histograms: or how to go on safari in the internet
Proceedings of the joint international conference on Measurement and modeling of computer systems
Flow sampling under hard resource constraints
Proceedings of the joint international conference on Measurement and modeling of computer systems
ACCEL-RATE: a faster mechanism for memory efficient per-flow traffic estimation
Proceedings of the joint international conference on Measurement and modeling of computer systems
Identifying elephant flows through periodically sampled packets
Proceedings of the 4th ACM SIGCOMM conference on Internet measurement
Space complexity of hierarchical heavy hitters in multi-dimensional data streams
Proceedings of the twenty-fourth ACM SIGMOD-SIGACT-SIGART symposium on Principles of database systems
A probability-guaranteed adaptive timeout algorithm for high-speed network flow detection
Computer Networks and ISDN Systems
Detecting malicious network traffic using inverse distributions of packet contents
Proceedings of the 2005 ACM SIGCOMM workshop on Mining network data
A measurement study of correlations of internet flow characteristics
Computer Networks: The International Journal of Computer and Telecommunications Networking
Fast statistical spam filter by approximate classifications
SIGMETRICS '06/Performance '06 Proceedings of the joint international conference on Measurement and modeling of computer systems
Cluster analysis of traffic flows on a campus network
AIA'06 Proceedings of the 24th IASTED international conference on Artificial intelligence and applications
Proceedings of the 6th ACM SIGCOMM conference on Internet measurement
Impact of packet sampling on anomaly detection metrics
Proceedings of the 6th ACM SIGCOMM conference on Internet measurement
On sampling self-similar internet traffic
Computer Networks: The International Journal of Computer and Telecommunications Networking
A factor analytic approach to inferring congestion sharing based on flow level measurements
IEEE/ACM Transactions on Networking (TON)
Reconciling performance and programmability in networking systems
Proceedings of the 2007 conference on Applications, technologies, architectures, and protocols for computer communications
Approximate frequency counts over data streams
VLDB '02 Proceedings of the 28th international conference on Very Large Data Bases
Fast, memory efficient flow rate estimation using runs
IEEE/ACM Transactions on Networking (TON)
Counter braids: a novel counter architecture for per-flow measurement
SIGMETRICS '08 Proceedings of the 2008 ACM SIGMETRICS international conference on Measurement and modeling of computer systems
A Distributed Architecture for IP Traffic Analysis
AIMS '07 Proceedings of the 1st international conference on Autonomous Infrastructure, Management and Security: Inter-Domain Management
Separator: Sifting Hierarchical Heavy Hitters Accurately from Data Streams
ADMA '07 Proceedings of the 3rd international conference on Advanced Data Mining and Applications
Space-optimal heavy hitters with strong error bounds
Proceedings of the twenty-eighth ACM SIGMOD-SIGACT-SIGART symposium on Principles of database systems
Marking algorithms for service differentiation of TCP traffic
Computer Communications
A measurement study of correlations of Internet flow characteristics
Computer Networks: The International Journal of Computer and Telecommunications Networking
A probability-guaranteed adaptive timeout algorithm for high-speed network flow detection
Computer Networks: The International Journal of Computer and Telecommunications Networking
Effective high speed traffic replay based on IP space
ICACT'09 Proceedings of the 11th international conference on Advanced Communication Technology - Volume 1
Small subset queries and bloom filters using ternary associative memories, with applications
Proceedings of the ACM SIGMETRICS international conference on Measurement and modeling of computer systems
APNOMS'09 Proceedings of the 12th Asia-Pacific network operations and management conference on Management enabling the future internet for changing business and new computing services
Tracking long duration flows in network traffic
INFOCOM'10 Proceedings of the 29th conference on Information communications
Space-optimal heavy hitters with strong error bounds
ACM Transactions on Database Systems (TODS)
Online internet traffic prediction models based on MMSE
ICCNMC'05 Proceedings of the Third international conference on Networking and Mobile Computing
Time-Driven vs packet-driven: a deep study on traffic sampling
ICOIN'06 Proceedings of the 2006 international conference on Information Networking: advances in Data Communications and Wireless Networks
DDoS defense mechanisms: a new taxonomy
DPM'09/SETOP'09 Proceedings of the 4th international workshop, and Second international conference on Data Privacy Management and Autonomous Spontaneous Security
md5bloom: Forensic filesystem hashing revisited
Digital Investigation: The International Journal of Digital Forensics & Incident Response
Hi-index | 0.00 |
Accurate network traffic measurement is required for accounting, bandwidth provisioning, and detecting DOS attacks. However, keeping a counter to measure the traffic sent by each of a million concurrent flows is too expensive (using SRAM) or slow (using DRAM). The current state-of-the-art (e.g., Cisco NetFlow) methods which count periodically sampled packets are slow, inaccurate, and memory-intensive. Our paper introduces a paradigm shift by concentrating on the problem of measuring only "heavy" flows --- i.e., flows whose traffic is above some threshold such as 1% of the link. After showing that a number of simple solutions based on cached counters and classical sampling do not work, we describe two novel and scalable schemes for this purpose which take a constant number of memory references per packet and use a small amount of memory. Further, unlike NetFlow estimates, we have provable bounds on the accuracy of measured rates and the probability of false negatives. We also propose a new form of accounting called threshold accounting in which only flows above threshold are charge by usage while the rest are charged a fixed fee. Threshold accounting generalizes the familiar notions of usage-based and duration based pricing.