1. SCREAM: Sketch Resource Allocation for Software-defined Measurement Masoud Moshref, Minlan Yu, Ramesh Govindan, Amin Vahdat (CoNEXT’15)

2. Measurement is Crucial for Network Management 2 Accounting Anomaly Detection Traffic Engineering Heavy Hitter detection Heavy hitter detection (HH) Change detection Super source detection (SSD) DDoS detection Anomaly Detection Traffic Engineering Network Management on multiple tenants: Measurement tasks: Heavy Hitter detection Hierarchical heavy hitter detection (HHH) Need fine-grained visibility of network traffic

3. Controller DREAM [SIGCOMM’14] / SCREAM [CoNEXT’15] Software Defined Measurement 3 Switch A Task 1 counters Task 2 counters Switch B Task 1 counters Task 2 counters Collect Configure Task 2Task 1

4. Our Focus: Sketch-based Measurement 4 Summaries of streaming data to approximately answer specific queries E.g., Bitmap for counting unique items OpenFlowCounters DREAM[SIGCOMM’14] Sketches MemoryExpensive, power-hungry TCAM Cheaper SRAM CountersVolume countersVolume and Connection counters FlowsSelected prefixesAll traffic all-the-time SCREAM [CoNEXT’15] Sketches use a cheaper memory and are more expressive

5. Sketch Example: Count-Min Sketch 5 (IP, 1 Kbytes) h1(IP) h2(IP) h3(IP) What is the traffic size of IP? = row with min collision = Min(3,5,2) = 2 d At packet arrival: Provable error bound given traffic properties (e.g., skew) Resource accuracy trade-off: At query: 2+1=3 4+1=5 1+1=2

6. Challenges: Limited Counters for Many Tasks 6 Many task instances: 3 types (Heavy hitter, Hierarchical heavy hitter, Super source) Different flow aggregates (Rack, App, Src/Dst/Port) 1000s of tenants Limited shared resources: SRAM capacity (e.g., 128 MB) Shared with other functions (e.g., routing) Too many resources to guarantee accuracy: 1 MB-32 MB per task Less than 4-128 tasks in SRAM

7. Goal: Many Accurate Sketch-based Measurements 7 Users dynamically instantiate a variety of measurement tasks SCREAM supports the largest number of measurement tasks while maintaining measurement accuracy

8. Approach: Dynamic Resource Allocation 8 Resource accuracy trade-off depends on traffic Dynamic allocation for current traffic Worst-case uses >10x counters than average Count Min: Provable error bound given traffic properties Ex: Skew of traffic from each IP Skew Required memory

9. Opportunity: Temporal Multiplexing 9 Task 1 Task 2 Required Memory Time Multiplex memory among tasks over time Memory requirement varies over time

10. Opportunity: Spatial Multiplexing 10 Required Memory Switch ASwitch B Memory requirement varies across switches Multiplex memory among tasks across switches Task 1 Task 2

11. Key Insight 11 Leverage spatial and temporal multiplexing and dynamically allocate switch memory per task to achieve sufficient accuracy for many tasks DREAM has the same insight SCREAM applies it for sketches

12. SCREAM Contributions 12 Heavy hitter (HH) tasks Super Source (SSD) tasks Dynamic resource allocator Hierarchical heavy hitter (HHH) tasks Allocation 1- Supports 3 sketch-based task types 2- Allocate memory among sketch-based task instances across switches while maintaining sufficient accuracy SCREAM Anomaly detection Traffic engineering DDoS detection

13. SCREAM Iterative Workflow 13 Estimate accuracy Allocate resources Collect & report Counters from many switches Accuracy Memory size

14. SCREAM Iterative Workflow 14 Task1 accuracy <80% Give more memory to task1 Estimate accuracy Allocate resources Collect & report Accuracy

15. SCREAM Iterative Workflow 15 Estimate accuracy Allocate resources Collect & report Skew of traffic for task2 changes Task2 accuracy <80% Give more memory to task2 Accuracy Merge counters from switches

16. SCREAM Challenges Estimate accuracy Allocate resources Collect & report Network-wide task implementation using sketches Accuracy estimation without the ground-truth Fast & Stable allocation in DREAM [SIGCOMM’14]

17. Switch BSwitch A Challenge: Merge Sketches of Different Sizes 17 Network-wide Task Heavy hitter (HH) d d w1 w2 Source IPs sending > 10Mbps 10 15 25

18. ≥ SCREAM Solution to Merge Sketches for HH Detection 18 10 30 70 40 50 20 1040 30 507020 50 10 4030507020 30 + Previous work: Min of sumsSCREAM: Sum of mins Min 1020 Min 508090 + + + Switch BSwitch A 10 15 25 Both over-approximate  smaller is more accurate

19. SCREAM Solutions Estimate accuracy Allocate resources Collect & report Accuracy estimation without the ground-truth Merge sketches of different sizes for HH, HHH, SSD SSD algorithm with higher and more stable accuracy Network-wide task implementation using sketches Fast & Stable allocation in DREAM [SIGCOMM’14]

20. Precision Estimation for Heavy Hitter Detection 20 Threshold True HHFalse HH Estimated Real Error Estimate-Threshold = Sum(P[Detected HH is true]) = 1 - P[Error ≥ Estimate-Threshold] True detected HH Detected HHs Precision = Insight: Relate probability to Error on counters of detected HHs P[Detected HH is true]

21. Precision Estimation Step 1: Find a Bound on The Error 21 Idea 1: Use average Error in Markov’s inequality to bound it Idea 1 = 1 - P[Error ≥ Estimate-Threshold] Insight: Relate probability to Error on counters of detected HHs P[Detected HH is true]

22. A row in Count-Min: Precision Estimation Step 2: Improve The Bound 22 Insight: Average Error = heavy items collision + small items collision Counter indices of detected HHs show heavy collisions Idea 2: Markov’s inequality only for small items Idea 1 Idea 2

23. SCREAM Solutions Estimate accuracy Allocate resources Collect & report Accuracy estimation without the ground-truth Merge sketches of different sizes for HH, HHH, SSD SSD algorithm with higher and more stable accuracy Network-wide task implementation using sketches Precision estimators for HH, HHH and SSD tasks Fast & Stable allocation in DREAM [SIGCOMM’14]

24. SCREAM Solutions Estimate accuracy Allocate resources Collect & report Accuracy estimation without the ground-truth Merge sketches of different sizes for HH, HHH, SSD SSD algorithm with higher and more stable accuracy Network-wide task implementation using sketches Precision estimators for HH, HHH and SSD tasks Fast & Stable allocation in DREAM [SIGCOMM’14]

25. Evaluation 25 Metrics: Satisfaction of a task: Fraction of task’s lifetime with sufficient accuracy % of rejected tasks Alternatives: OpenSketch: Allocate for bounded error for worst-case traffic at task instantiation (test with different bounds) Oracle: Knows required resource for a task in each switch in advance

26. Evaluation Setting 26 Simulation for 8 switches: 256 task instances (HH, HHH, SSD, combination) Accuracy bound = 80% 5 min tasks arriving in 20 minutes 2 hours CAIDA trace

27. SCREAM Provides High Accuracy for More Tasks 27 SCREAM: High satisfaction and low reject OpenSketch: Loose bound  Under provision  low satisfaction Tight bound  Over provision  high reject

28. SCREAM’s Performance Is Close to An Oracle 28 SCREAM performance is close to an oracle, its satisfaction is a bit lower because: Iterative allocation takes time Accuracy estimation has error

29. Other Evaluations 29 SCREAM accuracy estimation has 5% error in average Accuracy estimation error Changing traffic skew SCREAM supports more accurate tasks than OpenSketch Other accuracy metrics Tasks in SCREAM have high recall (low false negative)

30. Conclusion 30 Practical sketch-based SDM by dynamic memory allocation Implementing network-wide tasks using sketches Estimating accuracy for 3 types of tasks SCREAM is available at github.com/USC-NSL/SCREAM Measurement is crucial for SDN management in a resource-constrained environment

31. Thanks! Questions? 31