A Survey of Sketches in Traffic Measurement: Design, Optimization
Total Page:16
File Type:pdf, Size:1020Kb
A survey of sketches in traffic measurement: Design, Optimization, Application and Implementation Shangsen Li, Lailong Luo, Deke Guo, Qianzhen Zhang, Pengtao Fu Science and Technology on Information System Engineering Laboratory, National University of Defense Technology, Changsha Hunan 410073, P.R. China. Abstract—Network measurement probes the underlying net- cardinality), the number of packets for a flow (flow size), the work to support upper-level decisions such as network manage- traffic volume contributed by a specific flow (flow volume) ment, network update, network maintenance, network defense and the time information. These statistics together profile and beyond. Due to the massive, speedy, unpredictable features of network flows, sketches are widely implemented in measurement the network and provide essential information for network nodes to approximately record the frequency or estimate the management and protection/defense. cardinality of flows. At their cores, sketches usually maintain one or multiple counter array(s), and rely on hash functions to select TABLE I: Comparison with existing surveys the counter(s) for each flow. Then the space-efficient sketches from the distributed measurement nodes are aggregated to First author # Variants #Measurement tasks Year provide statistics of the undergoing flows. Currently, tremendous Cormode [9] ≤ 15 3 2010 redesigns and optimizations have been proposed to improve the Cormode [10] ≤ 20 3 2011 sketches for better network measurement performance. However, Zhou [11] ≤ 10 4 2014 existing reviews or surveys mainly focus on one particular Yassine [12] — — 2015 aspect of measurement tasks. Researchers and engineers in the Gibbons [13] ≤ 10 1 2016 network measurement community desire an all-in-one survey that Yan [14] — 1 2016 This survey ≥ 90 13 2021 covers the entire processing pipeline of sketch-based network measurement. To this end, we present the first comprehensive survey of this area. We first introduce the preparation of flows The term sketch refers to a kind of synopsis data structure for measurement, then detail the most recent investigations of to record the frequency or estimate the cardinality of items design, aggregation, decoding, application and implementation in a multiset or stream approximately. Basically, sketches of sketches for network measurement. To summarize the existing efforts, we carry out an in-depth study of the existing literature, hash each packet according to the interested flow key into a covering more than 90 sketch designs and optimization strategies. union of cells or counters. Sketches offer an efficient method Furthermore, we conduct a comprehensive analysis and qual- to record the existence of the active flow and its statistical itative/quantitative comparison of the sketch designs. Finally, information for later passive traffic measurement tasks. As a we highlight the open issues for future sketch-based network compact summary, sketches are typically much smaller than measurement research. Index Terms—Sketch; Counter; Network Measurement; Traf- the size of input and adaptive to solve network measurement fic Measurement tasks. Moreover, sketches guarantee constant time overhead of element insertion and information query operations with I. INTRODUCTION guaranteed accuracy. Measurement-based performance evaluation of network traf- The primary motivation of conducting this survey is two- arXiv:2012.07214v2 [cs.DS] 20 Jul 2021 fic is a fundamental prerequisite for network management, fold. Firstly, a lot of sketch designs and optimizations have such as load balance [1], routing, fairness [2], instruction been proposed to perform measurement tasks in recent years. detection [3], caching [4], traffic engineering [5], performance Existing surveys, however, are somehow out-of-date and do diagnostics [6] and policy enforcement [7]. With the explo- not cover these new proposals. The latest survey [13] was ration of network users and network scale, the underlying published four years ago and only covers a small partition of network traffic becomes massive and unpredictable, which work. Secondly, the existing surveys [12] [14] solely focus on challenges and complicates all the network functions. Network a particular or several aspects of measurement tasks and lack of measurement probes the underlying flows and provides the a comprehensive view on sketch design and optimization. The metadata to support network-related decisions and threat di- earlier work [9] [10] only covered less than 20 sketch variants agnosis. Efficient network measurement requires various levels and were published nearly ten years ago. These existing of traffic statistics, both as an aggregate and on a per-flow basis surveys did not provide comprehensive reviews on sketch- [8]. These statistics include the number of distinct flows (flow based network measurement. As shown in Table. I, compared with the existing surveys, our survey covers more sketch variants and considers more measurement tasks. In particular, Sketch Packets ... Update Query Preparation Optimization in sketch structure Measurement tasks (application) Hashing strategy Time dimension Persistence detection Conventional hash mapping Preparation for traffic measurement Flow latency Learning-based mapping Optimization in post-processing stage Volume dimension Collaborative traffic measurement Counter level optimization Optimization for sketch collection Per-flow measurement Monitor placement Small counter for larger range Cardinality estimation Traffic rerouting Sketch compression Virtual register design Sketch merging Super spreader/DDos Flow distribution Hierarchical counter-sharing Heavy Hitters Variable-width counters Hierarchical Heavy Hitters (HHH) Optimization for speed and space Information extraction Novel counter update strategy Top-k detection Less memory access Flow key reversible Entropy estimation Sampling Slot enforcement Probability theory based Randomization Machine learning Time-Volume dimension Batching Sketch level optimization Persistent Sketch Multi-layer Change detection Multi-sketch Burst Detection Sliding window Item batch detection Fig. 1: Framework of this survey our survey concentrates on the design and optimization for the II. SKETCH BASED NETWORK MEASUREMENT sketch from a perspective of dataflow in sketch algorithm. Network measurement is indispensable for understanding In this survey, we first classify the sketch design and the performance of a network infrastructure and managing optimization from the perspective of data process pipeline networks efficiently. There are two ways to measure network of the sketch algorithm. Specifically, from the data recording performance: active or passive techniques. stage to the information extraction stage, the core components In active measurement, network flows are continuously mea- for a sketch data structure are update strategy, design of data sured by sending a series of probe packets over the network structure, query strategy, and the enabled functionality. Thus, paths. With the help of such probes, network operators are able we survey the existing works from three-dimension, i.e., prepa- to measure one-way delay, round-trip-time (RTT), the average ration for sketch-based network measurement, optimization in packet loss, connection bandwidth and adjust the forwarding sketch data structure, and optimization in the post-processing policies in case of load changes. It estimates the network stage. Besides, we further provide a comprehensive survey performance by tracking how the probe packets are treated in the network [15]. The accuracy is closely associated with of sketch-based measurement tasks and implementation.Sketch The comprehensivePackets framework is illustrated in Fig. 1. For each the probe frequency in general. Active measurement offers ... Update Query measurement task, wePreparation compare the corresponding sketch de- different granularity of end-to-end QoS measurement and is sign quantitatively and qualitatively. Optimization in sketch structure flexible since you can measure whatMeasurement you want. tasks (application) However, send- ing probes frequently may impose significant measurement Following the above directions, the remainderHashing of this strategy paper overhead that may disturb critical traffic.Time dimension Persistence detection is organized as follows. Section II gives a basicConventional description hash mapping By contrast, passive measurement provides an efficient tool Preparation for traffic measurement Flow latency of sketch-based network measurement. SectionLearning III details-based mapping the for charging,Optimization in engineering,post-processing stage managing and securing the commu- Volume dimension related work aboutCollaborative preparation traffic measurement for traffic measurement, includ- nication tools [16]. Without probing packets, passive measure- Counter level optimization Optimization for ing collaborative traffic measurement and packet preprocess- ment monitors the traffic traversingPer the-flow measurement measurement points Monitor placement Small counter for larger range Cardinality estimation Traffic rerouting Sketch compression ing. Section IV focuses on the design and optimizationVirtual register design in the to collect statisticalSketch merging information. In particular,Super spreader/D aDos passive mea- Flow distribution Hierarchical counter-sharing Heavy Hitters sketch data structure, including hashing strategy,Variable counter-width counters level surement system is able to summarizeHierarchical flow-levelHeavy Hitters