Identification of heavyweight address prefix pairs in IP traffic

We develop in this paper a new algorithm for identifying those pairs of source and destination prefixes giving rise to a significant amount of global traffic, referred to as multidimensional hierarchical heavy hitters (mHHH). We represent the source and destination address pairs by weighted circuits in a graph so that the prefix pairs are considered as groups of circuits in the graph. Identifying mHHH pairs then consists in finding clusters of circuits that have a cumulative weight greater than an user specified threshold. Starting from this model, we propose an off-line algorithm to exhaustively find mHHH pairs. On the basis of this exhaustive algorithm, we introduce an efficient online algorithm that identifies mHHH pairs in real time with provable accuracy and memory guarantees. Experimental results with real traffic data from France Telecom networks illustrate the efficiency of the algorithm.