Heavy-Hitter Flow Identification in Data Centre Networks Using Packet Size Distribution and Template Matching

Data Centre Networks (DCNs) handle large volumes of data transmission that can consume a lot of bandwidth in short bursts or over prolonged periods of time. One class of traffic that constantly poses a challenge is Heavy-Hitter (HH) flows large-volume flows that consume considerably more network resources than other flows combined. The identification of such flows is critical to prevent network congestion and overall network performance degradation. Most of the existing methods to identify HHs are based on thresholds, i.e., if the flow exceeds a predefined threshold, it will be marked as a HH; otherwise, it will be classified as a non-HH. However, these approaches present two significant issues. First, there is no consistent and accepted threshold that would reliably classify flows. Second, the existing threshold approaches use counters (duration, packets, and bytes); thus their accuracy depends on how complete the flow information is. In this paper, we address those issues using per-flow packet size distribution which can capture the behaviour and dynamics of network traffic flow more accurately than the counters in the early stage of the flow. We then propose the use of the template matching technique to identify HHs and achieved a classification accuracy of 96% using only the first 14 packets of a flow.