Fast and accurate flow counting algorithm for the management of IP networks

For the management of IP (Internet Protocol) networks, flow counting is significant because of various applications such as denial-of-service (DoS) attack detection, etc. Although several flow counting algorithms have been proposed in literature, they have disadvantages in computational time and accuracy. This paper proposes a flow counting algorithm that eliminates these disadvantages. The proposed method improves the computational time through two techniques: packet sampling and a new data structure based on multiple counters. For the accuracy, the existing flow counting methods is often degraded by regarding the terminated flows as existing and thus overestimating the number of flows. The paper examines a method that avoids such overestimation by utilizing TCP FIN messages. The effectiveness of the proposed method was evaluated and compared with an existing method experimentally.