Abstract Super Points from Core Network by Unique Candidate List

When a device on network communicates with copious other devices during a time window, this device is called a super point. Super points play important roles in network because they are usually servers, hosts running P2P applications, worms, DDos victims. Super points may change with the time. How to locating these super points from core network efficiently is a hard task. This paper proposed an algorithm to detect super points for high speed network by a novel condensed bits array which occupied as small as 64 KB memory. During a time window, this algorithm scanned each coming IP packets and updated the data structure by setting a few bits to 1. Taking advantage of Bloom filter, this algorithm maintained a small unique candidate list which store hosts that may become super points later. At the end of a time window, super hosts would be abstracted from the unique candidate list by the information contained in bits array. Experiments on a real world high speed traffic proved the high processing speed and accuracy of the super points abstract algorithm proposed in this paper.