Accurately detecting super host that establishes connections to a large number of distinct peers is significant for mitigating web attacks and ensuring high quality of web service. Existing sketch-based approaches estimate the number of distinct connections called flow cardinality according to full IP addresses, while ignoring the fact that a malicious or victim super host often communicates with hosts within the same subnet, resulting in high false positive rates and low accuracy. Though hierarchical-structure based approaches could capture flow cardinality in subnet, they inherently suffer from high memory usage. To address these limitations, we propose SegSketch, a segmented cardinality estimation approach that employs a lightweight halved-segment hashing strategy to infer common prefix lengths of IP addresses, and estimates cardinality within subnet to enhance detection accuracy under constrained memory size. Experiments driven by real-world traces demonstrate that, SegSketch improves F1-Score by up to 8.04× compared to state-of-the-art solutions, particularly under small memory budgets.

Sketch-based measurement approaches have recently become a promising solution for detecting periodic flows. However, current sketch approaches struggle to achieve accurate detection of periodic flows due to their short-sighted record of the flow arrival information. Recording the long-term information of flow arrivals could mitigate this issue, while the large memory consumption will hurt the detection accuracy. Consequently, achieving a satisfactory trade-off between memory efficiency and detection accuracy remains a tough challenge. To address this issue, we propose Aion for periodic flow detection. Specifically, Aion uses the Sidon sequence to compress historical flow arrival information in multiple time windows into very small size. Based on the periodicity information from successive time windows, Aion updates the estimated frequencies of periodic flows and promptly evicts non-periodic ones to enable accurate detection of frequent periodic flows. We implement Aion on a P4-based testbed and demonstrate that it achieves superior resource efficiency compared to state-of-the-art approaches. Trace-driven evaluations show that Aion improves F1-Score by up to 9.88×, particularly under small memory conditions.