Parallel Sketch Based Super Node Detection with Traceability

Traffic measurement and monitoring is crucial for network applications, such as network security, network management and so on. One central problem is to detect super nodes, which have significant change of connection degree between consecutive measurement periods. Due to weakness in massive network traffic processing for the centralized algorithm and low detection accuracy, space efficiency for super node detection algorithm based on flow sampling, we propose Parallel sketch based super node detection with traceability (PSD). It constructs parallel sketch and estimates connection degree of nodes by probabilistic counting approach, so that super nodes are identified using connection degree change between consecutive measurement periods. Moreover, IP addresses of super nodes are reconstructed by simple computing to trace attacker or victims. The experimental results illustrate that the proposed method outperforms the Compact spread estimator (CSE) and Data streaming and sampling (DSS) in terms of detection accuracy and storage utilization.