Ark Filter: A General and Space-Efficient Sketch for Network Flow Analysis

Sketches are widely deployed to represent network flows to support complex flow analysis. Typical sketches usually employ hash functions to map elements into a hash table or bit array. Such sketches still suffer from potential weaknesses upon throughput, flexibility, and functionality. To this end, we propose Ark filter, a novel sketch that stores the element information with either of two candidate buckets indexed by the quotient or remainder between the fingerprint and filter length. In this way, no further hash calculations are required for future queries or reallocations. We further extend the Ark filter to enable capacity elasticity and more functionalities (such as frequency estimation and top -k query). Comprehensive experiments demonstrate that, compared with Cuckoo filter, Ark filter has 2.08x, 1.34x, and 1.68x throughput of deletion, insertion, and hybrid query, respectively; compared with Quotient filter, Ark filter has 4.55x, 1.74x, and 22.12x throughput of deletion, insertion, and hybrid query, respectively; compared with Bloom filter, Ark filter has 2.55x and 2.11x throughput of insertion and hybrid query, respectively.