One Sketch to Rule Them All

TLDR

Network management requires accurate estimates of metrics for traffic engineering, anomaly detection, and security, yet existing methods are either low‑fidelity general‑purpose or high‑fidelity specialized, making accurate estimation under router constraints difficult. The study aims to create a general framework that delivers accuracy comparable to custom algorithms. UnivMon achieves this by employing an application‑agnostic data‑plane primitive, with control‑plane algorithms computing application‑level metrics, and is implemented in P4 with a one‑big‑switch abstraction for network‑wide monitoring. Trace‑driven evaluations demonstrate that UnivMon attains comparable or superior accuracy relative to specialized sketching solutions.

Abstract

Network management requires accurate estimates of metrics for traffic engineering (e.g., heavy hitters), anomaly detection (e.g., entropy of source addresses), and security (e.g., DDoS detection). Obtaining accurate estimates given router CPU and memory constraints is a challenging problem. Existing approaches fall in one of two undesirable extremes: (1) low fidelity general-purpose approaches such as sampling, or (2) high fidelity but complex algorithms customized to specific application-level metrics. Ideally, a solution should be both general (i.e., supports many applications) and provide accuracy comparable to custom algorithms. This paper presents UnivMon, a framework for flow monitoring which leverages recent theoretical advances and demonstrates that it is possible to achieve both generality and high accuracy. UnivMon uses an application-agnostic data plane monitoring primitive; different (and possibly unforeseen) estimation algorithms run in the control plane, and use the statistics from the data plane to compute application-level metrics. We present a proof-of-concept implementation of UnivMon using P4 and develop simple coordination techniques to provide a ``one-big-switch'' abstraction for network-wide monitoring. We evaluate the effectiveness of UnivMon using a range of trace-driven evaluations and show that it offers comparable (and sometimes better) accuracy relative to custom sketching solutions.