Finding Heavy-Hitter by Periodically Deleting Small Flows

Finding the largest traffic flows in a network is very significant to many network management applications. The problem of finding these flows is known as the heavy-hitter problem. In this paper we present an algorithm that can find those flows exceeding a user-specified threshold over data streams and give the estimate of their sizes. In addition, the deviation of estimate is guaranteed not to exceed a certain value. Compared with the Lossy Counting (LC), the improvement of our algorithm Periodically Deleting (PD) is that the interval between two deletions is fixed. The interval can be controlled by clock timing, and it is set fully considering the network traffic so that PD can adjust to the change in network traffic better. Our algorithm may be deployed for the streams of singleton items like IP packets and consumes less memory. The experimental results show that our algorithm finds heavy-hitters accurately and efficiently.