Hashing Pursuit for Online Identification of Heavy-Hitters in High-Speed Network Streams
Michael Kallitsis, Stilian Stoev, George Michailidis

TL;DR
This paper introduces a hashing-based framework and algorithms for rapid identification of heavy-hitters in high-speed network streams, crucial for detecting DDoS attacks and malicious activities efficiently.
Contribution
It develops space/time efficient hashing algorithms and data structures tailored for high-dimensional network data streams, enabling quick detection of malicious traffic.
Findings
Effective in real-world network data
Low memory and computational overhead
Suitable for hardware implementation
Abstract
Distributed Denial of Service (DDoS) attacks have become more prominent recently, both in frequency of occurrence, as well as magnitude. Such attacks render key Internet resources unavailable and disrupt its normal operation. It is therefore of paramount importance to quickly identify malicious Internet activity. The DDoS threat model includes characteristics such as: (i) heavy-hitters that transmit large volumes of traffic towards "victims", (ii) persistent-hitters that send traffic, not necessarily large, to specific destinations to be used as attack facilitators, (iii) host and port scanning for compiling lists of un-secure servers to be used as attack amplifiers, etc. This conglomeration of problems motivates the development of space/time efficient summaries of data traffic streams that can be used to identify heavy-hitters associated with the above attack vectors. This paper…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsNetwork Security and Intrusion Detection · Internet Traffic Analysis and Secure E-voting · Spam and Phishing Detection
