Carpe Elephants: Seize the Global Heavy Hitters

Rob Harrison, Shir Landau Feibish, Arpit Gupta, Ross Teixeira, S. Muthukrishnan, Jennifer Rexford

Research output: Chapter in Book/Report/Conference proceedingConference contribution

13 Scopus citations

Abstract

Detecting "heavy hitter"flows is the core of many network security applications. While past work shows how to measure heavy hitters on a single switch, network operators often need to identify network-wide heavy hitters on a small timescale to react quickly to distributed attacks. Detecting network-wide heavy hitters efficiently requires striking a careful balance between the memory and processing resources required on each switch and the network-wide coordination protocol. We present Carpe, a distributed system for detecting network-wide heavy hitters with high accuracy under communication and state constraints. Our solution combines probabilistic counting techniques on the switches with probabilistic reporting to a central coordinator. Based on these reports, the coordinator adapts the reporting threshold and probability at each switch to the spatial locality of the flows. Simulations using traffic traces show that our prototype can detect network-wide heavy hitters with 97% accuracy, while reducing the communication overhead by 17% and switch state by 38%, compared to existing approaches.

Original languageEnglish (US)
Title of host publicationProceedings of the 2020 ACM SIGCOMM Workshop on Secure Programmable Network Infrastructure, SPIN 2020
PublisherAssociation for Computing Machinery
Pages15-21
Number of pages7
ISBN (Electronic)9781450380416
DOIs
StatePublished - Aug 10 2020
Event1st ACM SIGCOMM Workshop on Secure Programmable Network Infrastructure, SPIN 2020 - Virtual, Online, United States
Duration: Aug 14 2020 → …

Publication series

NameProceedings of the 2020 ACM SIGCOMM Workshop on Secure Programmable Network Infrastructure, SPIN 2020

Conference

Conference1st ACM SIGCOMM Workshop on Secure Programmable Network Infrastructure, SPIN 2020
Country/TerritoryUnited States
CityVirtual, Online
Period8/14/20 → …

All Science Journal Classification (ASJC) codes

  • Software
  • Hardware and Architecture

Keywords

  • Heavy hitters
  • Network-wide monitoring

Fingerprint

Dive into the research topics of 'Carpe Elephants: Seize the Global Heavy Hitters'. Together they form a unique fingerprint.

Cite this