Knowledge Discovery: Can It Shed New Light on Threshold Definition for Heavy-Hitter Detection?

Heavy-Hitter (HH) flows are well-known in the field of networking, mainly due to their resource consumption, which is considerably higher than the majority of flows. Their reliable detection and management are critical to optimising network performance. Nevertheless, to date, there is no generally accepted and widely used methodology for HH threshold selection. Indeed, different works use distinct thresholds without the support of a detailed or systematic study. In this paper, we provide useful insights and suggestions on how to determine more justified and valid thresholds. Based on the obtained results, we conclude that no threshold can be used universally to separate flows into HHs and non-HHs. A threshold that performs efficiently in one network may underperform in another. Threshold and HH definitions are often application-dependent, and therefore, threshold selection should include a detailed analysis of the network and its traffic. We also highlight that TCP and UDP flows should be classified with different thresholds because HHs exhibit different characteristics in such protocols. Lastly, we point out that the use of more than one threshold leads to accuracy and efficacy improvements in HHs classification.

Automated summary

In the field of networking, there is no universally accepted methodology for selecting thresholds for Heavy-Hitter (HH) flows, leading to varying effectiveness across different networks. Justified and valid thresholds require a detailed analysis of the network and its traffic, as well as the recognition that thresholds are application-dependent. It is also important to classify TCP and UDP flows with different thresholds due to the distinct characteristics exhibited by HHs in these protocols.