READ: a three-communicating-stage distributed super points detections algorithm

TL;DR

READ is a distributed super point detection algorithm that efficiently reduces communication overhead while maintaining high accuracy in high-speed networks by using a three-stage communication process and lightweight estimators.

Contribution

The paper introduces READ, a novel three-stage communication distributed super point detection algorithm utilizing lightweight estimators for improved accuracy and reduced communication in network environments.

Findings

READ achieves higher accuracy than existing algorithms.

READ reduces communication overhead to less than 5%.

Experimental validation on real-world traffic demonstrates effectiveness.

Abstract

A super point is a host that interacts with a far larger number of counterparts in the network over a period of time. Super point detection plays an important role in network research and application. With the increase of network scale, distributed super point detection has become a hot research topic. Compared with single-node super point detection algorithm, the difficulty of super point detection in multi-node distributed environment is how to reduce communication overhead. Therefore, this paper proposes a three-stage communication distributed super point detection algorithm: Rough Estimator based Asynchronous Distributed super point detection algorithm (READ). READ uses a lightweight estimator, the Rough Estimator (RE), which is fast in computation and takes less memory to generate candidate super point. At the same time, the Linear Estimator (LE) is used to accurately estimate the cardinality of each candidate super point, so as to detect the super point correctly. In READ, each node scans IP address pairs asynchronously. When reaching the time window boundary, READ starts three-stage communication to detect the super point. In this paper, we proof that the accuracy of READ in distributed environment is no less than that in the single node environment. Four groups of 10 Gb/s and 40 Gb/s real-world high-speed network traffic are used to test READ. The experimental results show that READ not only has higher accuracy in distributed environment, but also has less than 5% of communication burden compared with existing algorithms.