For Internet of Things (IoT) networks and devices, the network traffic measurement owns security significance. It usually focuses on the frequency estimation and top-k flows detection, two basic measurement tasks where the sketch has been widely used as the outline data structure. Existing measurement schemes make tradeoffs between efficiency, accuracy and speed. Some of them, such as the recently proposed Augmented Sketch, improve the accuracy of measurement tasks by separating elephant flows from mouse flows. Yet, the performance can be severely degraded due to the exchange of traffics between the filter and the sketch section. In this paper, the Probabilistic Cuckoo Sketch (Prob-CS), a new data structure consisting of several buckets with two hash functions, is proposed to obtain the high accuracy as well as the good memory utilization for the measurement tasks. Specifically, a probabilistic replacement strategy is utilized to reduce the impact of mouse flows on elephant flows, which helps the proposed Prob-CS to accurately record the elephant flow. Meanwhile, the Cuckoo hashing is introduced to relocate the replaced flows, thus fully improving the memory utilization. Numerous experimental results show that our Prob-CS achieves the best frequency estimation accuracy, and owns the competitive performance in terms of the top-k precision and the throughput compared to well-established programs.

中文翻译：

---

Prob-CS：用于精确网络流量测量的概率布谷鸟草图


对于物联网（IoT）网络和设备来说，网络流量测量具有安全意义。它通常侧重于频率估计和 top-k 流检测，这两个基本测量任务的草图已被广泛用作轮廓数据结构。现有的测量方案在效率、精度和速度之间进行权衡。其中一些，例如最近提出的增强草图，通过将大象流与老鼠流分开来提高测量任务的准确性。然而，由于过滤器和草图部分之间的流量交换，性能可能会严重下降。本文提出了概率布谷鸟草图（Probabilistic Cuckoo Sketch，Prob-CS），这是一种由多个具有两个哈希函数的桶组成的新数据结构，旨在为测量任务获得高精度和良好的内存利用率。具体来说，利用概率替换策略来减少老鼠流对大象流的影响，这有助于所提出的Prob-CS准确记录大象流。同时引入布谷鸟哈希对替换的流进行重新定位，充分提高内存利用率。大量实验结果表明，我们的Prob-CS实现了最好的频率估计精度，并且与成熟的程序相比，在top-k精度和吞吐量方面具有竞争性能。