MVPipe: Enabling Lightweight Updates and Fast Convergence in Hierarchical Heavy Hitter Detection

TL;DR

MVPipe is a novel invertible sketch that enables lightweight, fast, and resource-efficient hierarchical heavy hitter detection in network traffic, suitable for programmable switches.

Contribution

It introduces MVPipe, a new invertible sketch leveraging IP traffic skewness for rapid, resource-efficient hierarchical heavy hitter detection with theoretical accuracy analysis.

Findings

Achieves high accuracy and throughput in real-world tests.

Converges faster than existing schemes.

Uses low resources in Tofino switch deployment.

Abstract

Finding hierarchical heavy hitters (HHHs) (i.e., hierarchical aggregates with exceptionally huge amounts of traffic) is critical to network management, yet it is often challenged by the requirements of fast packet processing, real-time and accurate detection, as well as resource efficiency. Existing HHH detection schemes either incur expensive packet updates for multiple aggregation levels in the IP address hierarchy, or need to process sufficient packets to converge to the required detection accuracy. We present MVPipe, an invertible sketch that achieves both lightweight updates and fast convergence in HHH detection. MVPipe builds on the skewness property of IP traffic to process packets via a pipeline of majority voting executions, such that most packets can be updated for only one or few aggregation levels in the IP address hierarchy. We show how MVPipe can be feasibly deployed in P4-based programmable switches subject to limited switch resources. We also theoretically analyze the accuracy and coverage properties of MVPipe. Evaluation with real-world Internet traces shows that MVPipe achieves high accuracy, high throughput, and fast convergence compared to six state-of-the-art HHH detection schemes. It also incurs low resource overhead in the Tofino switch deployment.