Switch based high cardinality node detection Articles uri icon

authors

  • ULLAH, ANEES
  • REVIRIEGO VASALLO, PEDRO
  • AKRAM, ADEEL
  • SIRAJ, MALIK NAJMUS

publication date

  • December 2021

start page

  • 190

end page

  • 193

issue

  • 4

volume

  • 13

International Standard Serial Number (ISSN)

  • 1943-0663

Electronic International Standard Serial Number (EISSN)

  • 1943-0671

abstract

  • The detection of supernodes with high cardinality is of interest for network monitoring and security. Existing schemes for supernode detection rely on data structures that are independent of the switching functions. This means that for each packet that traverses the switch, both the switching table and the supernode detection structure have to be checked which requires significant memory bandwidth. This can create a bottleneck and reduce the speed of the switch, especially for software implementations. In this letter, a scheme that performs supernode detection as part of Ethernet switching and does not require additional memory accesses nor separated data structures is presented. The scheme has been implemented and compared with the existing methods. The results show that the proposed scheme can reliably identify supernodes while providing a speed up of more than 15% when compared with the existing solutions.

subjects

  • Telecommunications

keywords

  • anomaly detection; cardinality estimation; network monitoring; supernodes