Feedback and Resources Guided Mechanism for Adaptive Packet Sampling

Due to the capacity restriction of traffic measurement system, an accurate and efficient sampling method is highly demanded. Uniform packet sampling is the simplest technique for reducing the amount of packets that the network monitoring system has to process, but it can\´t estimate smaller traffic flows which contribute almost more than 80% of the whole traffic flows and are important prompts for network anomaly detection. In this paper, we develop a new packet sampling methodology based on SGS (sketch guided sampling) method called "feedback and resources guided sampling" (FRGS). Our FRGS scheme takes the measurement system capacity as an important parameter to adjust sampling probability, and a feedback of the flow sizes estimation instead of data streaming algorithm is used to save resources. Force sampling is also adopted to increase the accuracy of estimation of smaller flows. Experiments results show that FRGS method is more accurate than the SGS method under limited resources for estimating flow sizes. The accuracy of our scheme has improved nearly 10 times than SGS.