Carpe Elephants: Seize the Global Heavy Hitters

Rob Harrison, Shir Landau Feibish, Arpit Gupta, Ross Teixeira, S. Muthukrishnan, Jennifer Rexford

    Research output: Chapter in Book/Report/Conference proceedingConference contribution

    Abstract

    Detecting "heavy hitter"flows is the core of many network security applications. While past work shows how to measure heavy hitters on a single switch, network operators often need to identify network-wide heavy hitters on a small timescale to react quickly to distributed attacks. Detecting network-wide heavy hitters efficiently requires striking a careful balance between the memory and processing resources required on each switch and the network-wide coordination protocol. We present Carpe, a distributed system for detecting network-wide heavy hitters with high accuracy under communication and state constraints. Our solution combines probabilistic counting techniques on the switches with probabilistic reporting to a central coordinator. Based on these reports, the coordinator adapts the reporting threshold and probability at each switch to the spatial locality of the flows. Simulations using traffic traces show that our prototype can detect network-wide heavy hitters with 97% accuracy, while reducing the communication overhead by 17% and switch state by 38%, compared to existing approaches.

    Original languageEnglish (US)
    Title of host publicationProceedings of the 2020 ACM SIGCOMM Workshop on Secure Programmable Network Infrastructure, SPIN 2020
    PublisherAssociation for Computing Machinery
    Pages15-21
    Number of pages7
    ISBN (Electronic)9781450380416
    DOIs
    StatePublished - Aug 10 2020
    Event1st ACM SIGCOMM Workshop on Secure Programmable Network Infrastructure, SPIN 2020 - Virtual, Online, United States
    Duration: Aug 14 2020 → …

    Publication series

    NameProceedings of the 2020 ACM SIGCOMM Workshop on Secure Programmable Network Infrastructure, SPIN 2020

    Conference

    Conference1st ACM SIGCOMM Workshop on Secure Programmable Network Infrastructure, SPIN 2020
    CountryUnited States
    CityVirtual, Online
    Period8/14/20 → …

    Keywords

    • Heavy hitters
    • Network-wide monitoring

    ASJC Scopus subject areas

    • Software
    • Hardware and Architecture

    Fingerprint Dive into the research topics of 'Carpe Elephants: Seize the Global Heavy Hitters'. Together they form a unique fingerprint.

    Cite this