Finding top-k flows in data streams is a fundamental task in network management. As the line rates continue to increase in a network, it becomes increasingly challenging to find the top-k flows precisely and quickly in real time. Existing algorithms that can achieve high precision suffer from a slow speed. In this paper, we propose a novel sketch, LUSketch, which is much faster than existing algorithms. LUSketch adopts a new strategy called limited-and-imperative-update to significantly improve the insertion speed. The key idea is to significantly reduce the number of update operations by establishing a connection between the sketch and heap part when tracking the top-k flows. Our experiment results show that, while maintaining a high precision, LUSketch achieves an insertion speed approximately 2 to 5 times higher than that of the state-of-the-art.

The cover image is based on the Research Article Filter-Sketch: A two-layer sketch for entropy estimation in the data plane by Jie Lu et al., https://doi.org/10.1049/cmu2.12494.

Abstract Entropy‐based approaches have been shown to aid various network measurement applications such as load balancing, anomaly detection, and traffic classification. Existing methods that assume out‐of‐band detection and/or use switches merely as accelerators require frequency communication between data and control plane, which increase the burden on the network and are no longer sufficient. To track these challenges, the authors design and implement a switch‐native approach for entropy estimation that can run detection function entirely inline on data plane. The authors first present Filter‐Sketch, a two‐layer sketch that supports frequency estimation with small and static memory allocation by separating elephant flow and mice flow. Then, the authors propose a mechanism based on memory‐optimized longest‐prefix match (LPM) to attain entropy at a line rate that completely executes in the programmable data plane. The trace‐driven evaluation shows that Filter‐Sketch achieves higher accuracy than the existing data plane algorithm in entropy estimation, where the relative error decreases by 0.65 on average.

In this paper, we propose a resilient control plane based on endogenous security for Software-Defined Networking (SDN) named SDN-ESRC to prevent vulnerability backdoor attacks. SDN-ESRC uses a set of heterogeneous controllers (e.g., RYU, OpenDayLight, ONOS) to compose the control plane and dynamically and adaptively selects several heterogeneous controller instances from the controller set to detect and correct the malicious control messages. The design of SDN-ESRC faces two challenges: (1) increasing network update delay due to multi-controller comparison and (2) maintaining high controllable security. To address the first challenge, SDN-ESRC adopts the master modification mode to reduce the network update delay and identify malicious control messages. To address the second challenge, SDN-ESRC introduces the comparison modification mode to ensure high availability in real time. We propose an evaluation model for SDN-ESRC and theoretically analyze the SDN-ESRC’s endogenous security performance under three typical backdoor attack scenarios. We implement SDN-ESRC in a prototype system and conduct simulations and experiments. The results show that SDN-ESRC can improve the backdoor damage attack security up to 98.3%, the backdoor random attack security up to 99.99%, and the backdoor coordinated attack security up to 82% at the cost of increasing network update delay less than 8.3%.