Elastic sketch

TLDR

Network congestion, scan, and DDoS attacks cause traffic characteristics to vary, degrading measurement performance. The authors propose the Elastic sketch to adapt measurement techniques to changing traffic conditions. Elastic sketch is implemented on P4, FPGA, GPU, CPU, multi‑core CPU, and OVS to support six typical measurement tasks. Experiments and theory show Elastic sketch adapts to traffic, achieving 44.6–45.2× faster speed and 2.0–273.7× lower error than state‑of‑the‑art methods.

Abstract

When network is undergoing problems such as congestion, scan attack, DDoS attack, etc., measurements are much more important than usual. In this case, traffic characteristics including available bandwidth, packet rate, and flow size distribution vary drastically, significantly degrading the performance of measurements. To address this issue, we propose the Elastic sketch. It is adaptive to currently traffic characteristics. Besides, it is generic to measurement tasks and platforms. We implement the Elastic sketch on six platforms: P4, FPGA, GPU, CPU, multi-core CPU, and OVS, to process six typical measurement tasks. Experimental results and theoretical analysis show that the Elastic sketch can adapt well to traffic characteristics. Compared to the state-of-the-art, the Elastic sketch achieves 44.6 ∼ 45.2 times faster speed and 2.0 ∼ 273.7 smaller error rate.