Algorithm For Detecting Elephant Flow Base On HTrap Structure

Elephant flows detection is important for congestion control,anomaly detection,and traffic engineering.Packets stream in networks have a strong heavy-tailed distribution.Therefore,Elephant flows detection can not only make contribution to a better understanding of network behavior but also be of immense significance for the operation and management in the networks.According to the characteristics of packets stream in the network.This paper designs a elephant flow storage structure HTrap,combines the Sample and Hold strategy with HTrap,a new elephant flow detection algorithm SH-HTrap is proposed.SH-HTrap consists of two modules,sample-and-hold module and memory-counting module.The sample-and-hold module consists of a VI-CBF and a random sampling function.The VI-CBF is used to filter the packets,and the random sampling function is used to sample the packets.This module uses the improved Sample and Hold strategy to implement sampling of the packets stream.When a packet of a stream is drawn,the packets belonging to the stream will no longer be sampled and directly arrive at the memory-counting module.This module reduces the online processing time of the algorithm and effectively reduces the False Positive Rate of the algorithm.The memory-counting module is composed of HTrap.HTrap is composed of multiple Traps and a hash function.Trap is used to store stream information,and a hash function is used to select the location where stream information is stored.The memory-counting module implements the storage of stream information.When a collision occurs,the small stream is removed from the storage structure,and the VI-CBF in the sample-and-hold module is updated in time.The memory-counting module reduces the load on the VI-CBF filter and effectively reduces the space consumption of the algorithm.In order to evaluate the performance of the SH-Trap algorithm in elephant flow detection,this paper uses the real network Trace collected in different regions to conduct experiments and compare it with other elephant flows detection algorithms.The experimental results show that the SH-Trap algorithm has smaller False Positive Rate and the proposed algorithm has advantages in memory consumption and consumption.