Estimating Local Cardinalities in a Multidimensional Multiset

摘要

In connection with port scan and worm propagation in the Internet, we address in this paper the problem of estimating the ber of destinations communicating with a given source. We propose a computational and memory-efficient technique of finding the top-talker sources. The proposed algorithm is tested against actual data (NetFlow records from the interconnection IP backbone network of France Telecom).