Online identification of multi-attribute high-volume traffic aggregates through sampling

We propose and implement a set of efficient on-line algorithms for a router to sample the passing packets and identify multi-attribute high-volume traffic aggregates. Besides the obvious applications in traffic engineering and measurement, we describe its application in defending against certain classes of DoS attacks. Our contributions include three novel algorithms. The reservoir sampling algorithm employs a biased sampling strategy that favors packets from high-volume aggregates. Based on the samples, two efficient algorithms are proposed to identify single-attribute aggregates and multi-attribute aggregates, respectively. We implement the algorithms on a Linux router and demonstrate that the router can effectively filter out malicious packets unstateful DoS attacks.