Classic Network s meets Software Defined Networking Ran Ben Basat, Technion, Israel Joint work with Gil Einziger and Erez Waisbard (Nokia Bell Labs) Roy Friedman (Technion) and Marcello Luzieli (UFGRS) 1
Network s 220.6.67.9 181.7.20.6 188.13.7.2 181.7.20.6 220.6.67.9 188.13.7.2 181.7.20.6 2
Network s Elephant Flows Detection Averaging over Sliding Load Balancing Windows Traffic Engineering Link Utilization Caching Trend Detection Counting Distinct Elements DDoS Identification Worm Propagation Link-based SEO Estimating the fraction of rare flows Customer Satisfaction DDoS Detection Computing Quantiles Data Log Analysis Network Health Monitoring 3
Frequency Estimation How many packets has sent? Classic Setting: Can t allocate a counter for each flow! In software: Memory is cheap (to an extent) Speed is the new bottleneck 4
Agenda Classical Frequency Estimation Algorithms. Accelerating space-oriented algorithms. Hierarchical Heavy Hitters. 5
Count Min Sketch (Cormode and Muthukrishnan) 2 ε counters 0 0 0 0 0 0 0 0 0 0 0 0 21 0 1 0 0 0 0 0 21 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 01 32 0 0 0 0 0 0 0 1 0 0 0 0 0 21 0 0 0 0 21 0 0 0 0 0 1 0 0 0 0 0 0 log δ 1 Rows E Noise Nε/2 Pr Noise > Nε 1/2 Query( )= 2 Overall Pr Noise > Nε δ 6
Space Saving (Metwally et al.) For a N-sized stream, when allocated with m counters, Space Saving guarantees: Query( ) returns 3 Query ( ) returns 2 f x Query x f x + N m For achieving an Nε approximation, 1/ε counters are needed. ID Value 32 01 20 1 7
Agenda Classical Frequency Estimation Algorithms. Accelerating space-oriented algorithms. Hierarchical Heavy Hitters. 8
Accelerating s Algorithms Add x, w V V + w With probability τ(w/v) Otherwise Add x with weight w τ 1 (w/v) Ignore packet algorithm Start with a N sized stream and a (ε, δ) measurement algorithm. We can iteratively accelerate ourselves! Accelerated Algorithm Get an O(logN ε 2 logδ) sized stream and a (2ε, 3δ) measurement algorithm. 9
Empirical Evaluation 10
Empirical Evaluation 11
Distributed SDN Implementation 12
Agenda Classical Frequency Estimation Algorithms. Accelerating space-oriented algorithms. Hierarchical Heavy Hitters. 13
Hierarchical Heavy Hitters 181.7.20.1 181.7.20.2 181.7.21.1 181.7.21.2 Can we block only the attacking devices? 14
Multi-Dimensional Hierarchies 181.7.. 181.7.20. 181.7.20.13 220.7.16. 220.7.16.9 15
Hierarchical Heavy Hitters using Space Saving (Mitzenmacher et al.) Level0 Level1 Compute all prefixes *.*.*.* 181.*.*.* 181.7.*.* 181.7.20.6 181.7.20.* Level2 Level3 Level4 16
Constant Time Hierarchical Heavy Hitters (SIGCOMM2017) Level0 Level1 Compute a random prefix 181.7.20.* Level2 Level3 Level4 17
Constant Time Hierarchical Heavy Hitters (SIGCOMM2017) Level0 Level1 181.7.20.3 181.7.20.6 188.3.12.3 188.67.7.1 92.67.7.81 181.7.20.2 With probability 9/10 Compute a random prefix 181.7.20.* Level2 Level3 Ignore packet Level4 18
Constant Time Hierarchical Heavy Hitters (SIGCOMM2017) How to detect the minimal prefix networks? How long it takes to converge? 19
Constant Time Hierarchical Heavy Hitters (SIGCOMM2017) 20
Constant Time Hierarchical Heavy Hitters (SIGCOMM2017) 21
Constant Time Hierarchical Heavy Hitters (SIGCOMM2017) 22
Any Questions 23