Towards threshold‐agnostic heavy‐hitter classification

A heavy‐hitter (HH) network traffic flow consumes considerably more network resources than other flows combined. The classification of HHs is critical to provide, among others, the required level of Quality of Service and reliability in both conventional and data center networks. HH classification is typically threshold‐based. However, there is no consistent and accepted threshold or set of thresholds that would reliably classify flows. Furthermore, existing threshold‐driven approaches use counters (e.g., duration, packets, and bytes); thus, their accuracy depends on how complete the flow information is. This paper paves the way to threshold‐agnostic HH identification by proposing an approach that performs HH classification based on per‐flow packet size distribution (PSD) and template matching (TM). PSD allows capturing the behavior and dynamism of network traffic flows (even from their first few packets). TM enables to classify HHs by measuring the similarity between the PSD of observed flows and a set of master templates representing the flow size behavior of HH classes. We evaluated the PSD‐ and TM‐based approach using flows extracted from real traffic traces. Results show that our approach classifies HHs accurately and timely, corroborating that the threshold‐less perspective is feasible for HH identification.