{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,12]],"date-time":"2026-01-12T21:04:33Z","timestamp":1768251873929,"version":"3.49.0"},"reference-count":25,"publisher":"Association for Computing Machinery (ACM)","issue":"1","license":[{"start":{"date-parts":[[2017,6,13]],"date-time":"2017-06-13T00:00:00Z","timestamp":1497312000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"Florida Center for Cybersecurity"},{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["STC-1562485"],"award-info":[{"award-number":["STC-1562485"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["Proc. ACM Meas. Anal. Comput. Syst."],"published-print":{"date-parts":[[2017,6,13]]},"abstract":"<jats:p>Persistent spread measurement is to count the number of distinct elements that persist in each network flow for predefined time periods. It has many practical applications, including detecting long-term stealthy network activities in the background of normal-user activities, such as stealthy DDoS attack, stealthy network scan, or faked network trend, which cannot be detected by traditional flow cardinality measurement. With big network data, one challenge is to measure the persistent spreads of a massive number of flows without incurring too much memory overhead as such measurement may be performed at the line speed by network processors with fast but small on-chip memory. We propose a highly compact Virtual Intersection HyperLogLog (VI-HLL) architecture for this purpose. It achieves far better memory efficiency than the best prior work of V-Bitmap, and in the meantime drastically extends the measurement range. Theoretical analysis and extensive experiments demonstrate that VI-HLL provides good measurement accuracy even in very tight memory space of less than 1 bit per flow.<\/jats:p>","DOI":"10.1145\/3084452","type":"journal-article","created":{"date-parts":[[2018,3,23]],"date-time":"2018-03-23T18:28:08Z","timestamp":1521829688000},"page":"1-29","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":21,"title":["Persistent Spread Measurement for Big Network Data Based on Register Intersection"],"prefix":"10.1145","volume":"1","author":[{"given":"You","family":"Zhou","sequence":"first","affiliation":[{"name":"University of Florida, Gainesville, FL, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yian","family":"Zhou","sequence":"additional","affiliation":[{"name":"Google Inc. &amp; University of Florida, Mountain View, CA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Min","family":"Chen","sequence":"additional","affiliation":[{"name":"Google Inc. &amp; University of Florida, Mountain View, CA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Shigang","family":"Chen","sequence":"additional","affiliation":[{"name":"University of Florida, Gainesville, FL, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2017,6,13]]},"reference":[{"key":"e_1_2_1_1_1","unstructured":"C. Smith \"By the Numbers: 100 Amazing Google Statistics and Facts \" February 2016. {Online}. Available: http:\/\/expandedramblings.com\/index.php\/by-the-numbers-a-gigantic-list-of-google-stats-and-facts\/10\/  C. Smith \"By the Numbers: 100 Amazing Google Statistics and Facts \" February 2016. {Online}. Available: http:\/\/expandedramblings.com\/index.php\/by-the-numbers-a-gigantic-list-of-google-stats-and-facts\/10\/"},{"key":"e_1_2_1_2_1","unstructured":"\"Twitter Usage Statistics.\" {Online}. Available: http:\/\/www.internetlivestats.com\/twitter-statistics\/  \"Twitter Usage Statistics.\" {Online}. Available: http:\/\/www.internetlivestats.com\/twitter-statistics\/"},{"key":"e_1_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/633025.633056"},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/1071690.1064258"},{"key":"e_1_2_1_5_1","first-page":"171","article-title":"Bitmap Algorithms for Counting Active Flows on High-Speed Links","author":"Chen A.","year":"2007","journal-title":"Proc. of VLDB"},{"key":"e_1_2_1_6_1","volume-title":"Proc. of IEEE INFOCOM","author":"Yoon M.","year":"2009"},{"key":"e_1_2_1_7_1","first-page":"1","article-title":"High-Speed Per-Flow Traffic Measurement with Probabilistic Multiplicity Counting","author":"Lieven P.","year":"2010","journal-title":"Proc. of ACM SIGMETRICS"},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2009.12.003"},{"key":"e_1_2_1_9_1","doi-asserted-by":"crossref","unstructured":"M. Chen and S. Chen \"Counter Tree: A Scalable Counter Architecture for Per-Flow Traffic Measurement \" Proc. of IEEE ICNP November 2015.  M. Chen and S. Chen \"Counter Tree: A Scalable Counter Architecture for Per-Flow Traffic Measurement \" Proc. of IEEE ICNP November 2015.","DOI":"10.1109\/ICNP.2015.15"},{"key":"e_1_2_1_10_1","first-page":"51","article-title":"Point-to-Point Traffic Volume Measurement through Variable-Length Bit Array Masking in Vehicular Cyber-Physical Systems","author":"Zhou Y.","year":"2015","journal-title":"Proc. of IEEE ICDCS"},{"key":"e_1_2_1_11_1","first-page":"29","article-title":"Software defined traffic measurement with opensketch","author":"Yu M.","year":"2013","journal-title":"Proc. of NSDI"},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/TVT.2015.2487985"},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/2716281.2836099"},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/TVT.2015.2436395"},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2006.882836"},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1016\/0022-0000(85)90041-8"},{"key":"e_1_2_1_17_1","first-page":"605","article-title":"Loglog counting of large cardinalities","author":"Durand M.","year":"2003","journal-title":"European Symposia on Algorithms"},{"key":"e_1_2_1_18_1","first-page":"127","article-title":"Hyperloglog: The analysis of a near-optimal cardinality estimation algorithm","author":"Flajolet P.","year":"2007","journal-title":"Proc. of AOFA"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/2452376.2452456"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/2745844.2745870"},{"key":"e_1_2_1_21_1","first-page":"145","volume-title":"Proc. of IEEE IWQoS","author":"Gao Y.","year":"2007"},{"key":"e_1_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICNP.2014.33"},{"key":"e_1_2_1_23_1","unstructured":"\"CAIDA \" 2015. {Online}. Available: http:\/\/www.caida.org\/home\/  \"CAIDA \" 2015. {Online}. Available: http:\/\/www.caida.org\/home\/"},{"key":"e_1_2_1_24_1","unstructured":"\"Google trends.\" {Online}. Available: https:\/\/www.google.com\/trends\/  \"Google trends.\" {Online}. Available: https:\/\/www.google.com\/trends\/"},{"key":"e_1_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4615-8071-3"}],"container-title":["Proceedings of the ACM on Measurement and Analysis of Computing Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3084452","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3084452","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3084452","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T03:30:22Z","timestamp":1750217422000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3084452"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2017,6,13]]},"references-count":25,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2017,6,13]]}},"alternative-id":["10.1145\/3084452"],"URL":"https:\/\/doi.org\/10.1145\/3084452","relation":{},"ISSN":["2476-1249"],"issn-type":[{"value":"2476-1249","type":"electronic"}],"subject":[],"published":{"date-parts":[[2017,6,13]]},"assertion":[{"value":"2017-06-13","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}