Real-time detection, isolation and monitoring of elephant flows using commodity SDN system

Madanapalli, Sharat Chandra; Lyu, Minzhao; Kumar, Himal; Gharakheili, Hassan Habibi; Sivaraman, Vijay

doi:10.1109/noms.2018.8406200

Cited by 18 publications

(12 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Recently developed methods suggest implementing auxiliary devices that can offload the burden caused by metering tens of thousands of active flows per second. 48,49 In switch-based approaches, 10,23,[50][51][52][53][54][55][56][57][58] the task of HHs identification is moved from the controller to the switches. 54,59 Research works aimed at the viability evaluation of switch-based HH classification has, however, shown that practical deployment of such techniques is minimal, mainly due to the high costs of hardware modifications the implementations require.…”

Section: Related Workmentioning

confidence: 99%

“…A general observation in the HH classification literature is that there is no consensus on what feature or set of features (e.g., size, duration, and rate) should be selected. In consequence, some techniques rely on size 7,8,63,[83][84][85] while other approaches use rate 50,69,86 or duration 50,51 as a threshold. Other features such as the number of packets transmitted in the flow 52 and specific data structures 87 are also used as a threshold.…”

Section: Challenges Of Threshold-based Classificationmentioning

confidence: 99%

“…Most HH classification approaches are based on a static threshold such as in previous studies. 8,9,11,51,52,85,88 Overall, while static-threshold-based techniques have shown promising results, they fall short in considering the network traffic dynamics. Network traffic has a dynamic rather than a static character.…”

Section: Challenges Of Threshold-based Classificationmentioning

confidence: 99%

See 2 more Smart Citations

Towards threshold‐agnostic heavy‐hitter classification

et al. 2021

View full text Add to dashboard Cite

A heavy-hitter (HH) network traffic flow consumes considerably more network resources than other flows combined. The classification of HHs is critical to provide, among others, the required level of Quality of Service and reliability in both conventional and data center networks. HH classification is typically threshold-based. However, there is no consistent and accepted threshold or set of thresholds that would reliably classify flows. Furthermore, existing threshold-driven approaches use counters (e.g., duration, packets, and bytes); thus, their accuracy depends on how complete the flow information is. This paper paves the way to threshold-agnostic HH identification by proposing an approach that performs HH classification based on per-flow packet size distribution (PSD) and template matching (TM). PSD allows capturing the behavior and dynamism of network traffic flows (even from their first few packets). TM enables to classify HHs by measuring the similarity between the PSD of observed flows and a set of master templates representing the flow size behavior of HH classes. We evaluated the PSD-and TM-based approach using flows extracted from real traffic traces. Results show that our approach classifies HHs accurately and timely, corroborating that the threshold-less perspective is feasible for HH identification.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Challenges Of Threshold-based Classificationmentioning

confidence: 99%

Section: Challenges Of Threshold-based Classificationmentioning

confidence: 99%

See 1 more Smart Citation

Towards threshold‐agnostic heavy‐hitter classification

et al. 2021

View full text Add to dashboard Cite

show abstract

“…This puts a requirement on the rule space of the switch. We know that a typical SDN switch in an enterprise network can hold about 55000 rules at a given time [7] and encounter up to 18000 new flows arriving per second at busy hours [8]. The switch cannot add new rules when its rule space is full.…”

Section: Background and Motivation A Packet Injection Attacksmentioning

confidence: 99%

Protecting Software-Defined Enterprise Networks from Packet Injection Attacks

Huque

Hartog

2021

2021 IEEE 46th Conference on Local Computer Networks (LCN)

View full text Add to dashboard Cite

Packet injection attacks are a primary threat to software-defined enterprise networks, for which continuous connectivity and real-time network functioning are two essential requirements. They are a form of denial-of-service attacks, and their main effect is network performance degradation up to total breakdown. In this paper, we show how such an attack can effectively be detected and mitigated at the entrance gateway switch of the software-defined enterprise network without sacrificing the basic functionality and performance of the networks control mechanisms. We describe an effective protection of the network's core controller as well as a significant reduction of rule-space overhead compared to a state-of-the-art technique.

show abstract

“…Further, with TLS 1.3 and eSNI [30], this trend might soon be adopted by various content providers. In this work, for QUIC flows, we have used DNS information to tag a video server, and an empirical threshold of 4MB to identify elephant flows [31], presumably carrying video content from that server. However, with the adoption of DoH and DNSSEC, even this information might not be available for a network operator, thus making it very challenging to identify video flows.…”

Section: E Challenges and Limitationsmentioning

confidence: 99%

Modeling Live Video Streaming: Real-Time Classification, QoE Inference, and Field Evaluation

Madanapalli¹,

Mathai²,

Gharakheili³

et al. 2021

Preprint

Self Cite

View full text Add to dashboard Cite

Social media, professional sports, and video games are driving rapid growth in live video streaming, on platforms such as Twitch and YouTube Live. Live streaming experience is very susceptible to short-time-scale network congestion since client playback buffers are often no more than a few seconds. Unfortunately, identifying such streams and measuring their QoE for network management is challenging, since content providers largely use the same delivery infrastructure for live and videoon-demand (VoD) streaming, and packet inspection techniques (including SNI/DNS query monitoring) cannot always distinguish between the two.In this paper, we design, build, and deploy ReCLive: a machine learning method for live video detection and QoE measurement based on network-level behavioral characteristics. Our contributions are four-fold: (1) We analyze about 23,000 video streams from Twitch and YouTube, and identify key features in their traffic profile that differentiate live and on-demand streaming. We release our traffic traces as open data to the public; (2) We develop an LSTM-based binary classifier model that distinguishes live from on-demand streams in real-time with over 95% accuracy across providers; (3) We develop a method that estimates QoE metrics of live streaming flows in terms of resolution and buffer stall events with overall accuracies of 93% and 90%, respectively; and (4) Finally, we prototype our solution, train it in the lab, and deploy it in a live ISP network serving more than 7,000 subscribers. Measurements from the field show that 99.8% of Twitch videos are streamed live, while this measure is only 2.3% for YouTube. Further, during peak hours as many as 15% of live video streams are played at low-definition resolution and about 7% of them experience a buffer stall. Our method provides ISPs with fine-grained visibility into live video streams, enabling them to measure and improve user experience.

show abstract

Real-time detection, isolation and monitoring of elephant flows using commodity SDN system

Cited by 18 publications

References 7 publications

Towards threshold‐agnostic heavy‐hitter classification

Towards threshold‐agnostic heavy‐hitter classification

Protecting Software-Defined Enterprise Networks from Packet Injection Attacks

Modeling Live Video Streaming: Real-Time Classification, QoE Inference, and Field Evaluation

Contact Info

Product

Resources

About