RecenTo: Finding Top-K Flows of the Recent Past

Abstract

Recent advances in programmable networks enable network operators to perform fine-grained analysis on all of the traffic as it traverses the network. One of the most common tasks, that has been widely studied, is to find the heavy hitter flows or the top-k flows. Several solutions have been presented that find such flows using a constant amount of memory and working within the confined resources and capabilities of the data plane. However, in order to pinpoint critical issues in the network, it is necessary to detect the flows that have been heavy in the recent past. Yet, existing approaches perform the task of heavy flow detection continuously, such that they can find the heavy flows over a boundless time period. In order to find heavy flows for shorter time intervals, sliding windows are often used. This requires multiple instances of the structure to clean out old data while still recording new data. Thus this requires a large amount of resources, and also requires predetermining the fixed length of the windows. We provide a formal definition of the recent top-K flows on a given stream, and present RecenTo a new deterministic counter-based algorithm for finding such flows in the data plane. The innovative technique used in RecenTo enables it to 'self-clean', thus making it easier for newer flows to enter the structure. RecenTo also makes use of a novel structure for maintaining the key and counter of the flows that provides support for the mutual dependence between them (i.e., sometimes the count is changed based on key and sometimes vice-versa). We evaluate RecenTo over continuous chunks of traffic and show that it consistently achieves a recall rate of ~ 0.9 for finding the top-k flows in each chunk.