An Elephant Flow Detection Method Based on Machine Learning

Lou, Kaihao; Yang, Yintang; Wang, Chuncai

doi:10.1007/978-3-030-34139-8_21

Cited by 6 publications

(8 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The HB states that, by consideration of n independent observations of a random variable with sample meanr and δ pre-defined tolerable estimation error, with probability 1=δ, the true mean of the variable is at leastr − , where = R 2 ln(1/δ) 2n (6) The VFDT uses the HB to select the attribute to split as a decision node. Let x a and x b be the attributes with the highest and second-highest G(.)…”

Section: Controller-side Ef Detectionmentioning

confidence: 99%

“…less than a few milliseconds and are less than 10 KB in size (i.e., mice flows, MFs), and that the majority of the traffic volume is accounted for by the top 10% of large flows (i.e., EFs). Any traffic that exceeds a certain threshold per unit time (e.g., 1 MBps) is often considered also an EF [6]. Given the high rate of EFs in network traffic, their effective control and rerouting can potentially improve the SDN network throughput [7].…”

Section: Introductionmentioning

confidence: 99%

“…Several EF detection techniques [6], [7], [11]- [20] have been previously proposed. However, these techniques are preconfigured with fixed flow size thresholds in the switch, which can result in high rates of false positive and false negatives.…”

Section: Introductionmentioning

confidence: 99%

“…However, these techniques are preconfigured with fixed flow size thresholds in the switch, which can result in high rates of false positive and false negatives. Moreover, some methods require periodic extraction of the flow statistics (e.g., [6], [7], [16], [17]) or sampling packets (e.g., [11]- [15]) from SDN switches, result in a long flow detection latency and heavy controller-switch signalling overhead. Some other techniques require either important modifications in the switch hardware (e.g., [18]) or applying end-host inference (e.g., [19], [20]), which make adoption in existing SDN difficult to achieve.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Flow-Aware Elephant Flow Detection for Software-Defined Networks

et al. 2020

View full text Add to dashboard Cite

Software-defined networking (SDN) separates the network control plane from the packet forwarding plane, which provides comprehensive network-state visibility for better network management and resilience. Traffic classification, particularly for elephant flow detection, can lead to improved flow control and resource provisioning in SDN networks. Existing elephant flow detection techniques use pre-set thresholds that cannot scale with the changes in the traffic concept and distribution. This paper proposes a flow-aware elephant flow detection applied to SDN. The proposed technique employs two classifiers, each respectively on SDN switches and controller, to achieve accurate elephant flow detection efficiently. Moreover, this technique allows sharing the elephant flow classification tasks between the controller and switches. Hence, most mice flows can be filtered in the switches, thus avoiding the need to send large numbers of classification requests and signaling messages to the controller. Experimental findings reveal that the proposed technique outperforms contemporary methods in terms of the running time, accuracy, F-measure, and recall. INDEX TERMS Software-defined networking, flow classification, elephant flow detection.

show abstract

Section: Controller-side Ef Detectionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Flow-Aware Elephant Flow Detection for Software-Defined Networks

et al. 2020

View full text Add to dashboard Cite

show abstract

“…In traditional wired networks, elephant flow detection is mainly realized by counting [11] [12], sampling [13] [14] or LRU (Least Recently Used) [15] [16] queue management. The main idea is to compare the volume of passed data with the corresponding detection threshold or try to filter small flows and keep up elephant flows by entries update-exit mechanism in the queue.…”

Section: Introductionmentioning

confidence: 99%