1. Optimal Elephant Flow Detection Presented by: Gil Einziger,
Joint work with: Ran Ben Basat, Roy Friedman and Yaron Kassner
03/09/2017
[***] -- director notes/comments
(***) -- extra read-outs…
This is a joint work…
We are currently working on a new research project, we call “Remote Continuous Deployment” (RCD).
In this talk I’ll give a background survey – and we call this talk “Continuous Development Processes”…

2. Background: Network Measurements
Useful for network optimization:
Load Balancing, Traffic Engineering, Quality of Service and Intrusion/Anomaly detection.
What is the current throughput of a specific flow?
What is the current packet count of a specific flow? 2 7 8 3 5 1 4 6 3 2
What is the current throughput of a specific link? 7 2 8 7 3 4 1 7 8 8 7 3 5 1 7 2 8 7 3 4 1 7 3 4 1 7 8 8 7 3 5 1 7 2 8 7 3 4 1 7 2 8 7 3 4 1 7 3 4 1 7 8 8 7 3 5 1 7 2 8 7 3 3 7

3. Background: Measurement Challenges
Measurement is difficult to implement in practice.
Update at line speed  up to million of packets per second in old 10GBit links. (and there are much faster links).
Large volume of data

4. Background: Measurement Problems
Hardware: No suitable memory technologies:
SRAM memories are fast but too small.
DRAM memories are large but slow.
Small SRAMSpeedup

5. Background: Measurement Problems
Software: Memory is less constraint but the key limitation is speed.
Different methods of acceleration:
Algorithmic complexity.
Sampling.
Trading memory for speed make sense!

6. Problem Statement: Estimate flows’ volume (in bytes)
Given a flow’s identifier we provide (approximate) answers such as:
What is the byte volume of flow 7?

7. Our Contributions
We present the first (asymptotically) optimal algorithm for weighted frequency estimation.
Algorithm
Space
Query Time
Update Time
Deterministic
Space Saving
𝑂 𝜀 −1
𝑂 1
𝑂 log 𝜀 −1
Yes
Count Min Sketch
𝑂 𝜀 −1 log 𝛿 −1
𝑂 log 𝛿 −1 No
IM-SUM
amortized
DIM-SUM
worst case

8. Gist of existing works…
Existing works maintain a flow cache of limited size.
When the cache fills the smallest flow is evicted.
This requires logarithmic time.
What can we do differently?…

9. Iterative Median SUMing
In IM-SUM:
Instead of removing the minimum every time we:
Double the memory.
Periodically find median. (At linear time)
Periodically remove all flows whose volume is less than the median.
(amortized) constant time updates.

10. Iterative Median SUMing: Example
Arriving packets are admitted to the flow table, with the volume of the Last Median.
Flow Table
Last Median ID
Volume =2 2

11. Iterative Median SUMing: Example
Arriving packets are admitted to the flow table.
Flow Table
Last Median ID
Volume =5 4 5

12. Iterative Median SUMing: Example
If the flow has an entry, update its volume
Flow Table
Last Median ID
Volume =4 2

13. Iterative Median SUMing: Example
Arriving packets are admitted to the flow table.
Flow Table
Last Median ID
Volume =8 3 8

14. Iterative Median SUMing: Example
Arriving packets are admitted to the flow table.
Flow Table
Last Median ID
Volume 2 6 =6

15. Iterative Median SUMing: Example
If the flow has an entry, update its volume.
Flow Table
Last Median ID
Volume
=13 3 5

16. Iterative Median SUMing: Example
If the table is full:
Find median
Flow Table
Last Median ID
Volume
5.5 5 2

17. Iterative Median SUMing: Example
If the table is full:
Find median
Remove Entries below median
Flow Table
Last Median ID
Volume
5.5 5 2

18. Iterative Median SUMing: Example
If the table is full:
Find median
Remove Entries below median
Admit new entry
(median + weight)
Flow Table
Last Median ID
Volume
5.5
=7.5 5 2

19. Iterative Median SUMing: Example
Query for monitored items flow table:
Query(5) = 8
Query for unmonitored items Last Median:
Query(4)=5.5
Flow Table
Last Median ID
Volume
5.5

20. 𝑓 𝑥 ≤𝑄𝑢𝑒𝑟𝑦 𝑥 ≤ 𝑓 𝑥 + 𝑇𝑜𝑡𝑎𝑙 𝑆𝑢𝑚 𝑀
IM-SUM: Guarantees
When IM-SUM is configured with 2M counters it guarantees that:
𝑓 𝑥 ≤𝑄𝑢𝑒𝑟𝑦 𝑥 ≤ 𝑓 𝑥 + 𝑇𝑜𝑡𝑎𝑙 𝑆𝑢𝑚 𝑀
Thus to for an error 𝜀 𝑇𝑜𝑡𝑎𝑙𝑆𝑢𝑚 we require 2 𝜀 counters, which is (asymptotically) optimal.

21. Summary Space Saving Count Min Sketch Algorithm Space Query Time
Update Time
Deterministic
Space Saving
𝑂 𝜀 −1
𝑂 1
𝑂 log 𝜀 −1
Yes
Count Min Sketch
𝑂 𝜀 −1 log 𝛿 −1
𝑂 log 𝛿 −1 No
We saw:
IM-SUM
amortized
In the paper:
DIM-SUM
worst case

22. UCLA Packet trace. IM-SUM (Captured in UCLA campus) DIM-SUM
Empirical Evalutaion
UCLA Packet trace.
(Captured in UCLA campus)
IM-SUM
DIM-SUM
Space Saving
Count Min Sketch

23. San Jose Internet Trace Empirical Evalutaion IM-SUM DIM-SUM
(Backbone link
in San Jose)
IM-SUM
DIM-SUM
Space Saving
Count Min Sketch

24. Theoretical: Practical: Contributions:
First Memory optimal and constant time heavy hitters algorithm for weighted inputs.
Practical:
Speedup on real Internet packet traces.

25. Thank You! IM-SUM and DIM-SUM are open sourced: