Graph Sketch Based Heavy Change Detection for Temporal Network Traffic Analysis

Monitoring and analyzing network traffic usage patterns is vital in modern data center networks. An important network measurement task is to detect heavy change which can help large network operators make better network management decisions on load balancing, traffic engineering, attack detection, and performance diagnosis. Heavy change refers to flows whose sizes in two adjacent time windows increase or decrease beyond a predefined threshold. However, it’s unrealistic to keep per-flow state since it is constrained by the need for rapid line-rate packet processing and the limited SRAM memory in switching hardware. The high speed and unbalanced distribution of network traffic pose great challenges to existing algorithms. To solve this problem, we propose a network measurement framework for heavy-change detection. We incorporate TCM, a novel graph stream sketch to summarize traffic data, and one temporal link prediction algorithm called AM-NMF. Depending on the difference between forecast sketch and true sketch, we can accurately identify the flows with significant change. Besides, we evaluate the effectiveness of our graph sketch based change detection framework by using real network datasets and show that it achieves high accuracy for a wide range of microbenchmarks.