2021/02/02 by Simon C. Scherrer, Scherrer, Simon, Che‐Yu Wu +17 · 1 citation
Computer Science · #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Internet Traffic Analysis and Secure E-voting #Network Security and Intrusion Detection #Networking and Internet Architecture (cs.NI) #Software-Defined Networks and 5G
paper · pdf · doi:10.48550/arxiv.2102.01397
openalex publication_date 2021/02/02 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
Current probabilistic flow-size monitoring can only detect heavy hitters\n(e.g., flows utilizing 10 times their permitted bandwidth), but cannot detect\nsmaller overuse (e.g., flows utilizing 50-100% more than their permitted\nbandwidth). Thus, these systems lack accuracy in the challenging environment of\nhigh-throughput packet processing, where fast-memory resources are scarce.\nNevertheless, many applications rely on accurate flow-size estimation, e.g. for\nnetwork monitoring, anomaly detection and Quality of Service.\n We design, analyze, implement, and evaluate LOFT, a new approach for\nefficiently detecting overuse flows that achieves dramatically better\nproperties than prior work. LOFT can detect 1.5x overuse flows in one second,\nwhereas prior approaches fail to detect 2x overuse flows within a timeout of\n300 seconds. We demonstrate LOFT's suitability for high-speed packet processing\nwith implementations in the DPDK framework and on an FPGA.\n