Comparison of Five Packet-Sampling-Based Methods for Detecting Elephant Flows

摘要

Detecting the abnormal behavior of the network through the network measurement is very important for network security. In high-speed networks, it is difficult and unrealistic to perform per-packet analysis with limited computing resources. Packet sampling can greatly reduce the consumption of computing resources. In this paper, we compare five measurement methods based on sampling from theory and experiment, which are mean method based on independent sampling (mean-IS), median method based on independent sampling (median-IS), mean method based on dependent sampling (mean-DS), median method based on dependent sampling (median-DS), and random sampling method (RP), respectively. We simulate the sampling process by Monte Carlo method to analyze the expectation and variance of the above-mentioned methods. Also, we use the five methods to detect elephant flows in real network traces. The experimental results show that mean-DS and RP are more effective than the other three methods. Finally, we propose an improved scheme that the independent sampling method is improved by incrementing sampling probability, so that the estimated results of mean-IS, mean-DS, and RP are nearly equal.