Multiscale Sketch: Finding Heavy Spread Changes in High-Speed Networks Over Sliding Windows

Dan Wang, Yang Du, He Huang, Yu-E Sun, Guoju Gao

Abstract: In high-speed networks, finding heavy spread changes (i.e., flows whose spread--the number of distinct elements--changes significantly over time) is crucial for applications such as anomaly detection and congestion control. Existing approaches typically rely on fixed windows, which respond only at the end of each window and can miss changes that occur across window boundaries. By contrast, the sliding window model enables more responsive and comprehensive measurements by capturing evolving changes in real time. However, it must continuously maintain each flow’s distinct element set as the window slides, posing a major challenge given modern networks’ high line rates and limited high-speed memory. To address this challenge, we propose Multiscale Sketch, an innovative method that separates the identification of distinct elements from the tracking of flows over sliding windows, enabling efficient data processing while minimizing memory overhead. Specifically, our method first divides the sliding window into several smaller sub-windows and designs a Sub-window Duplicate Filter to remove duplicate elements within each sub-window, enhancing processing efficiency. Then, Multi-scale Sliding Window Tracking adaptively monitors flows with different spread ranges, optimizing memory resource utilization. Our experimental results based on two real-world datasets show that Multiscale Sketch achieves precision and recall rates about 2.61× and 1.47× higher, respectively, than those of competing solutions.

External IDs:dblp:conf/icic/WangDHSG25