Optimal Elephant Flow Detection Presented by: Gil Einziger, Joint work with: Ran Ben Basat, Roy Friedman and Yaron Kassner 03/09/2017 [***] -- director notes/comments (***) -- extra read-outs… This is a joint work… We are currently working on a new research project, we call “Remote Continuous Deployment” (RCD). In this talk I’ll give a background survey – and we call this talk “Continuous Development Processes”…

Background: Network Measurements Useful for network optimization: Load Balancing, Traffic Engineering, Quality of Service and Intrusion/Anomaly detection. What is the current throughput of a specific flow? What is the current packet count of a specific flow? 2 7 8 3 5 1 4 6 3 2 What is the current throughput of a specific link? 7 2 8 7 3 4 1 7 8 8 7 3 5 1 7 2 8 7 3 4 1 7 3 4 1 7 8 8 7 3 5 1 7 2 8 7 3 4 1 7 2 8 7 3 4 1 7 3 4 1 7 8 8 7 3 5 1 7 2 8 7 3 3 7

Background: Measurement Challenges Measurement is difficult to implement in practice. Update at line speed  up to 14.88 million of packets per second in old 10GBit links. (and there are much faster links). Large volume of data

Background: Measurement Problems Hardware: No suitable memory technologies: SRAM memories are fast but too small. DRAM memories are large but slow. Small SRAMSpeedup

Background: Measurement Problems Software: Memory is less constraint but the key limitation is speed. Different methods of acceleration: Algorithmic complexity. Sampling. Trading memory for speed make sense!

Problem Statement: Estimate flows’ volume (in bytes) Given a flow’s identifier we provide (approximate) answers such as: What is the byte volume of flow 7?

Our Contributions We present the first (asymptotically) optimal algorithm for weighted frequency estimation. Algorithm Space Query Time Update Time Deterministic Space Saving 𝑂 𝜀 −1 𝑂 1 𝑂 log 𝜀 −1 Yes Count Min Sketch 𝑂 𝜀 −1 log 𝛿 −1 𝑂 log 𝛿 −1 No IM-SUM amortized DIM-SUM worst case

Gist of existing works… Existing works maintain a flow cache of limited size. When the cache fills the smallest flow is evicted. This requires logarithmic time. What can we do differently?…

Iterative Median SUMing In IM-SUM: Instead of removing the minimum every time we: Double the memory. Periodically find median. (At linear time) Periodically remove all flows whose volume is less than the median. (amortized) constant time updates.

Iterative Median SUMing: Example Arriving packets are admitted to the flow table, with the volume of the Last Median. Flow Table Last Median ID Volume 0 2+0=2 2

Iterative Median SUMing: Example Arriving packets are admitted to the flow table. Flow Table Last Median ID Volume 0 2 4 5+0=5 4 5

Iterative Median SUMing: Example If the flow has an entry, update its volume Flow Table Last Median ID Volume 0 2+2=4 0 2 4 5 2

Iterative Median SUMing: Example Arriving packets are admitted to the flow table. Flow Table Last Median ID Volume 0 4 4 5 3 8+0=8 3 8

Iterative Median SUMing: Example Arriving packets are admitted to the flow table. Flow Table Last Median ID Volume 0 4 4 5 3 8 2 6 2 6+0=6

Iterative Median SUMing: Example If the flow has an entry, update its volume. Flow Table Last Median ID Volume 0 4 4 5 3 8 3 8+5=13 3 5 2 6

Iterative Median SUMing: Example If the table is full: Find median Flow Table Last Median ID Volume 5.5 0 4 4 5 3 13 5 2 2 6

Iterative Median SUMing: Example If the table is full: Find median Remove Entries below median Flow Table Last Median ID Volume 5.5 0 4 4 5 3 13 5 2 2 6

Iterative Median SUMing: Example If the table is full: Find median Remove Entries below median Admit new entry (median + weight) Flow Table Last Median ID Volume 5.5 5 2+5.5=7.5 4 5 3 13 5 2 2 6

Iterative Median SUMing: Example Query for monitored items flow table: Query(5) = 8 Query for unmonitored items Last Median: Query(4)=5.5 Flow Table Last Median ID Volume 5.5 5 8 4 5 3 13 2 6

𝑓 𝑥 ≤𝑄𝑢𝑒𝑟𝑦 𝑥 ≤ 𝑓 𝑥 + 𝑇𝑜𝑡𝑎𝑙 𝑆𝑢𝑚 𝑀 IM-SUM: Guarantees When IM-SUM is configured with 2M counters it guarantees that: 𝑓 𝑥 ≤𝑄𝑢𝑒𝑟𝑦 𝑥 ≤ 𝑓 𝑥 + 𝑇𝑜𝑡𝑎𝑙 𝑆𝑢𝑚 𝑀 Thus to for an error 𝜀 𝑇𝑜𝑡𝑎𝑙𝑆𝑢𝑚 we require 2 𝜀 counters, which is (asymptotically) optimal.

Summary Space Saving Count Min Sketch Algorithm Space Query Time Update Time Deterministic Space Saving 𝑂 𝜀 −1 𝑂 1 𝑂 log 𝜀 −1 Yes Count Min Sketch 𝑂 𝜀 −1 log 𝛿 −1 𝑂 log 𝛿 −1 No We saw: IM-SUM amortized In the paper: DIM-SUM worst case

UCLA Packet trace. IM-SUM (Captured in UCLA campus) DIM-SUM Empirical Evalutaion UCLA Packet trace. (Captured in UCLA campus) IM-SUM DIM-SUM Space Saving Count Min Sketch

San Jose Internet Trace Empirical Evalutaion IM-SUM DIM-SUM (Backbone link in San Jose) IM-SUM DIM-SUM Space Saving Count Min Sketch

Theoretical: Practical: Contributions: First Memory optimal and constant time heavy hitters algorithm for weighted inputs. Practical: Speedup on real Internet packet traces.

Thank You! IM-SUM and DIM-SUM are open sourced: https://github.com/kassnery/dimsum