CLEF: Limiting the Damage Caused by Large Flows in the Internet Core (Technical Report)

2018/07/16 by Wu, Hao, Hsiao, Hsu-Chun, Asoni, Daniele E. +3
#FOS: Computer and information sciences #Networking and Internet Architecture (cs.NI)

paper · doi:10.48550/arxiv.1807.05652

Abstract

The detection of network flows that send excessive amounts of traffic is of increasing importance to enforce QoS and to counter DDoS attacks. Large-flow detection has been previously explored, but the proposed approaches can be used on high-capacity core routers only at the cost of significantly reduced accuracy, due to their otherwise too high memory and processing overhead. We propose CLEF, a new large-flow detection scheme with low memory requirements, which maintains high accuracy under the strict conditions of high-capacity core routers. We compare our scheme with previous proposals through extensive theoretical analysis, and with an evaluation based on worst-case-scenario attack traffic. We show that CLEF outperforms previously proposed systems in settings with limited memory.

Related

• Scaling Up Anomaly Detection Using In-DRAM Working Set of Active Flows Table
• A Flow is a Stream of Packets: A Stream-Structured Data Approach for DDoS Detection
• Adaptive algorithms for identifying large flows in IP traffic
• DoLLM: How Large Language Models Understanding Network Flow Data to Detect Carpet Bombing DDoS
• DDoS Never Dies? An IXP Perspective on DDoS Amplification Attacks