Tree sketch: An accurate and memory-efficient sketch for network-wide measurement

Traffic measurement provides essential information for bandwidth management and Quality of Service (QoS), which is an enabler of network status discovery. However, with the explosive growth of network traffic, traditional network measurement methods face challenges in terms of memory, computation, accuracy, especially in the high-speed networks. Network devices have no enough CPU or memory resources for collecting, counting and analyzing data streams, which makes measurement results inaccurate and unreliable. To address the problem, we design an accurate and memory-efficient Tree sketch. It consists of three different structures for heavy flow detection, Distributed Denial-of-Service (DDoS) attack detection, super-spreaders detection, respectively. The proposed heavy cuckoo algorithm stores the flows in categories according to their flow sizes reducing hash collisions in the sketch. Besides, Tree sketch employs the Single Instruction Multiple Data (SIMD) instructions to speed up packet processing. Experimental results show that F1 score of Tree sketch is 0.997 with 30 KB memory usage in heavy hitter detection, which is 0.019–0.137 higher than the state-of-the-art sketch algorithms. It is an efficient tool of traffic measurement in the backbone network and provides a good trade-off among accuracy, speed and memory usage.