Finding hierarchical heavy hitters (HHHs) (i.e., hierarchical aggregates with exceptionally huge amounts of traffic) is critical to network management, yet it is often challenged by the requirements of fast packet processing, real-time and accurate detection, as well as resource efficiency. Existing HHH detection schemes either incur expensive packet updates for multiple aggregation levels in the IP address hierarchy, or need to process sufficient packets to converge to the required detection accuracy. We present MVPipe, an invertible sketch that achieves both lightweight updates and fast convergence in HHH detection. MVPipe builds on the skewness property of IP traffic to process packets via a pipeline of majority voting executions, such that most packets can be updated for only one or few aggregation levels in the IP address hierarchy. We show how MVPipe can be feasibly deployed in P4-based programmable switches subject to limited switch resources. We also theoretically analyze the accuracy and coverage properties of MVPipe. Evaluation with real-world Internet traces shows that MVPipe achieves high accuracy, high throughput, and fast convergence compared to six state-of-the-art HHH detection schemes. It also incurs low resource overhead in the Tofino switch deployment.

翻译：分层重击者（HHHs，即具有异常巨大流量的层次聚合体）的检测对于网络管理至关重要，但常受限于快速数据包处理、实时精准检测及资源高效性的要求。现有HHH检测方案要么需要针对IP地址层次中多个聚合级别进行昂贵的包更新，要么需处理足够多的数据包才能收敛至所需检测精度。我们提出MVPipe——一种可逆草图，能够在HHH检测中同时实现轻量级更新与快速收敛。MVPipe利用IP流量的偏斜特性，通过多数投票执行的流水线处理数据包，使得大多数包仅需针对IP地址层次中一个或少数聚合级别进行更新。我们展示了如何在受限于交换机资源的P4可编程交换机上可行地部署MVPipe，并从理论上分析了其准确性与覆盖范围特性。基于真实互联网流量的评估表明，与六种最先进的HHH检测方案相比，MVPipe实现了高精度、高吞吐量与快速收敛，且在Tofino交换机部署中仅产生较低的资源开销。