Approximate Discovery of Service Nodes by Duplicate Detection in Flows

TL;DR

This paper introduces an efficient approximate algorithm using Round-robin Buddy Bloom Filters for detecting service nodes in large networks based on NetFlow data, achieving high efficiency with low false positives.

Contribution

It proposes a novel RBBF-based method for service node discovery that improves time and space efficiency over traditional approaches.

Findings

The RBBF algorithm effectively detects service nodes with low false positive rates.

The method demonstrates superior efficiency in real-world network case studies.

Abstract

Knowledge about which nodes provide services is of critical importance for network administrators. Discovery of service nodes can be done by making full use of duplicate element detection in flows. Because the amount of traffic across network is massive, especially in large ISPs or campus networks, we propose an approximate algorithm with Round-robin Buddy Bloom Filters(RBBF) for service detection using NetFlow data solely. The properties and analysis of RBBF data structure are also given. Our method has better time/space efficiency than conventional algorithm with a small false positive rate.%portion of false positive. We also demonstrate the contributions through a prototype system by real world case studies.