ExtendedSketch: Fusing Network Traffic for Super Host Identification with a Memory Efficient Sketch

dc.contributorAalto-yliopistofi
dc.contributorAalto Universityen
dc.contributor.authorJing, Xuyangen_US
dc.contributor.authorYan, Zhengen_US
dc.contributor.authorHan, Huien_US
dc.contributor.authorPedrycz, Witolden_US
dc.contributor.departmentDepartment of Communications and Networkingen
dc.contributor.groupauthorNetwork Security and Trusten
dc.contributor.organizationXidian Universityen_US
dc.contributor.organizationUniversity of Albertaen_US
dc.date.accessioned2022-12-14T10:19:26Z
dc.date.available2022-12-14T10:19:26Z
dc.date.issued2021-09-09en_US
dc.descriptionPublisher Copyright: Author
dc.description.abstractSketches have been widely applied to identify super hosts in an efficient and accurate way. However, most sketches cannot flexibly balance memory usage and accuracy in host cardinality estimation. In order to solve this issue, we propose a novel extensible and reversible sketch, named ExtendedSketch, to achieve accurate super host identification with high memory efficiency. The core idea of ExtendedSketch is to monitor low-cardinality hosts with small-sized counters while dynamically extend the size of counters when monitoring high-cardinality hosts by applying an adaptive extension strategy. Such the strategy can adaptively increase counter size according to network traffic status at runtime, which not only ensures the accuracy of high-cardinality host estimation but also avoids unnecessary memory consumption. We perform theoretical analysis and conduct a series of experimental evaluations on ExtendedSketch based on real world network traffic. Experimental results show that under same memory usage, compared to the state-of-the-art, ExtendedSketch achieves 1.47.5 times smaller error rate in measuring host cardinality with 1.926.7 times better accuracy on super host identification and 95215 times faster speed on abnormal address reconstruction. Its advance in accuracy and efficiency demonstrates the practical significance of ExtendedSketch for super host identification.en
dc.description.versionPeer revieweden
dc.format.extent12
dc.format.mimetypeapplication/pdfen_US
dc.identifier.citationJing, X, Yan, Z, Han, H & Pedrycz, W 2021, ' ExtendedSketch : Fusing Network Traffic for Super Host Identification with a Memory Efficient Sketch ', IEEE Transactions on Dependable and Secure Computing . https://doi.org/10.1109/TDSC.2021.3111328en
dc.identifier.doi10.1109/TDSC.2021.3111328en_US
dc.identifier.issn1545-5971
dc.identifier.issn1941-0018
dc.identifier.otherPURE UUID: d96f134a-2754-475c-963e-1b7fff726999en_US
dc.identifier.otherPURE ITEMURL: https://research.aalto.fi/en/publications/d96f134a-2754-475c-963e-1b7fff726999en_US
dc.identifier.otherPURE LINK: http://www.scopus.com/inward/record.url?scp=85114727913&partnerID=8YFLogxKen_US
dc.identifier.otherPURE FILEURL: https://research.aalto.fi/files/94734661/ExtendedSketch_Fusing_Network_Traffic_for_Super_Host_Identification_With_a_Memory_Efficient_Sketch.pdfen_US
dc.identifier.urihttps://aaltodoc.aalto.fi/handle/123456789/118206
dc.identifier.urnURN:NBN:fi:aalto-202212146946
dc.language.isoenen
dc.publisherIEEE
dc.relation.ispartofseriesIEEE Transactions on Dependable and Secure Computingen
dc.rightsopenAccessen
dc.subject.keywordEstimationen_US
dc.subject.keywordHash functionsen_US
dc.subject.keywordHost cardinality estimationen_US
dc.subject.keywordInformation filtersen_US
dc.subject.keywordLicensesen_US
dc.subject.keywordMemory efficiencyen_US
dc.subject.keywordMemory managementen_US
dc.subject.keywordMonitoringen_US
dc.subject.keywordNetwork traffic measurementen_US
dc.subject.keywordSize measurementen_US
dc.subject.keywordSketchen_US
dc.subject.keywordSuper host identificationen_US
dc.titleExtendedSketch: Fusing Network Traffic for Super Host Identification with a Memory Efficient Sketchen
dc.typeA1 Alkuperäisartikkeli tieteellisessä aikakauslehdessäfi
dc.type.versionpublishedVersion
Files