{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,8,23]],"date-time":"2025-08-23T20:40:03Z","timestamp":1755981603542,"version":"3.44.0"},"reference-count":32,"publisher":"Association for Computing Machinery (ACM)","issue":"CoNEXT3","license":[{"start":{"date-parts":[[2024,8,18]],"date-time":"2024-08-18T00:00:00Z","timestamp":1723939200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/501100006374","name":"Israel Science Foundation","doi-asserted-by":"publisher","award":["980\/21"],"award-info":[{"award-number":["980\/21"]}],"id":[{"id":"10.13039\/501100006374","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["Proc. ACM Netw."],"published-print":{"date-parts":[[2024,8,18]]},"abstract":"<jats:p>\n            Recent advances in programmable networks enable network operators to perform fine-grained analysis on all of the traffic as it traverses the network. One of the most common tasks, that has been widely studied, is to find the heavy hitter flows or the top-k flows. Several solutions have been presented that find such flows using a constant amount of memory and working within the confined resources and capabilities of the data plane. However, in order to pinpoint critical issues in the network, it is necessary to detect the flows that have been heavy in the recent past. Yet, existing approaches perform the task of heavy flow detection continuously, such that they can find the heavy flows over a boundless time period. In order to find heavy flows for shorter time intervals, sliding windows are often used. This requires multiple instances of the structure to clean out old data while still recording new data. Thus this requires a large amount of resources, and also requires predetermining the fixed length of the windows. We provide a formal definition of the recent top-K flows on a given stream, and present RecenTo a new deterministic counter-based algorithm for finding such flows in the data plane. The innovative technique used in RecenTo enables it to 'self-clean', thus making it easier for newer flows to enter the structure. RecenTo also makes use of a novel structure for maintaining the key and counter of the flows that provides support for the\n            <jats:italic toggle=\"yes\">mutual dependence<\/jats:italic>\n            between them (i.e., sometimes the count is changed based on key and sometimes vice-versa). We evaluate RecenTo over continuous chunks of traffic and show that it consistently achieves a recall rate of ~ 0.9 for finding the top-k flows in each chunk.\n          <\/jats:p>","DOI":"10.1145\/3676871","type":"journal-article","created":{"date-parts":[[2024,8,21]],"date-time":"2024-08-21T22:09:06Z","timestamp":1724278146000},"page":"1-20","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":1,"title":["RecenTo: Finding Top-K Flows of the Recent Past"],"prefix":"10.1145","volume":"2","author":[{"ORCID":"https:\/\/orcid.org\/0009-0002-3213-5762","authenticated-orcid":false,"given":"Aviya","family":"Ozery","sequence":"first","affiliation":[{"name":"The Open University of Israel, Raanana, Israel"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-4198-7986","authenticated-orcid":false,"given":"Jonathan","family":"Diamant","sequence":"additional","affiliation":[{"name":"The Open University of Israel, Raanana, Israel"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3998-8645","authenticated-orcid":false,"given":"Shir","family":"Landau Feibish","sequence":"additional","affiliation":[{"name":"The Open University of Israel, Raanana, Israel"}]}],"member":"320","published-online":{"date-parts":[[2024,8,21]]},"reference":[{"volume-title":"CAIDA datase. https:\/\/publicdata.caida.org\/datasets\/security\/. [Online","year":"2023","key":"e_1_2_1_1_1","unstructured":"2018. CAIDA datase. https:\/\/publicdata.caida.org\/datasets\/security\/. [Online; accessed December 2023]."},{"volume-title":"scipy.stats.skew. https:\/\/docs.scipy.org\/doc\/scipy\/reference\/generated\/scipy.stats.skew.html. [Online","year":"2023","key":"e_1_2_1_2_1","unstructured":"2023. scipy.stats.skew. https:\/\/docs.scipy.org\/doc\/scipy\/reference\/generated\/scipy.stats.skew.html. [Online; accessed December 2023]."},{"key":"e_1_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1016\/J.COMNET.2018.02.018"},{"key":"e_1_2_1_4_1","first-page":"4","volume-title":"RecenTo","author":"Aviya Ozery","year":"2024","unstructured":"Ozery Aviya. 2024. RecenTo p4 code. https:\/\/github.com\/aviacoh\/RecenTo_p4_code. [Online; accessed Jul 2024]."},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2019.2918929"},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2020.2982739"},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.14778\/3297753.3297762"},{"key":"e_1_2_1_8_1","volume-title":"Bounds for Frequency Estimation of Packet Streams. 17","author":"Bose Prosenjit","year":"2003","unstructured":"Prosenjit Bose, Evangelos Kranakis, Pat Morin, and Yihui Tang. 2003. Bounds for Frequency Estimation of Packet Streams. 17 (2003), 33--42."},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1007\/3--540--45465--9_59"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1016\/S0304--3975(03)00400--6"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2016.2621159"},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1145\/3229584.3229586"},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/3359989.3365408"},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1007\/978--1--4939--2864--4_572"},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1016\/J.JALGOR.2003.12.001"},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/510726.510749"},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/633025.633056"},{"key":"e_1_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/859716.859719"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.2311.02636"},{"key":"e_1_2_1_20_1","volume-title":"HeavyKeeper: An Accurate Algorithm for Finding Top-k Elephant Flows. In 2018 USENIX Annual Technical Conference, USENIX ATC 2018","author":"Gong Junzhi","year":"2018","unstructured":"Junzhi Gong, Tong Yang, Haowei Zhang, Hao Li, Steve Uhlig, Shigang Chen, Lorna Uden, and Xiaoming Li. 2018. HeavyKeeper: An Accurate Algorithm for Finding Top-k Elephant Flows. In 2018 USENIX Annual Technical Conference, USENIX ATC 2018, Boston, MA, USA, July 11--13, 2018, Haryadi S. Gunawi and Benjamin C. Reed (Eds.). USENIX Association, 909--921. https:\/\/www.usenix.org\/conference\/atc18\/presentation\/gong"},{"key":"e_1_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/3393691.3394193"},{"key":"e_1_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1109\/NETSOFT51509.2021.9492531"},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOM.2011.5934979"},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/3341302.3342076"},{"key":"e_1_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/2934872.2934906"},{"key":"e_1_2_1_26_1","volume-title":"Jaqen: A High-Performance Switch-Native Approach for Detecting and Mitigating Volumetric DDoS Attacks with Programmable Switches. In 30th USENIX Security Symposium, USENIX Security 2021","author":"Liu Zaoxing","year":"2021","unstructured":"Zaoxing Liu, Hun Namkung, Georgios Nikolaidis, Jeongkeun Lee, Changhoon Kim, Xin Jin, Vladimir Braverman, Minlan Yu, and Vyas Sekar. 2021. Jaqen: A High-Performance Switch-Native Approach for Detecting and Mitigating Volumetric DDoS Attacks with Programmable Switches. In 30th USENIX Security Symposium, USENIX Security 2021, August 11--13, 2021, Michael D. Bailey and Rachel Greenstadt (Eds.). USENIX Association, 3829--3846. https:\/\/www.usenix.org\/conference\/usenixsecurity21\/presentation\/liu-zaoxing"},{"key":"e_1_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.14778\/2367502.2367508"},{"key":"e_1_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1007\/978--3--540--30570--5_27"},{"key":"e_1_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1016\/0167--6423(82)90012-0"},{"key":"e_1_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/3050220.3063772"},{"key":"e_1_2_1_31_1","volume-title":"Kuipers","author":"Turkovic Belma","year":"2019","unstructured":"Belma Turkovic, Jorik Oostenbrink, and Fernando A. Kuipers. 2019. Detecting Heavy Hitters in the Data-plane. CoRR abs\/1902.06993 (2019). arXiv:1902.06993 http:\/\/arxiv.org\/abs\/1902.06993"},{"key":"e_1_2_1_32_1","volume-title":"Poseidon: Mitigating Volumetric DDoS Attacks with Programmable Switches. In 27th Annual Network and Distributed System Security Symposium, NDSS 2020","author":"Zhang Menghao","year":"2020","unstructured":"Menghao Zhang, Guanyu Li, Shicheng Wang, Chang Liu, Ang Chen, Hongxin Hu, Guofei Gu, Qi Li, Mingwei Xu, and Jianping Wu. 2020. Poseidon: Mitigating Volumetric DDoS Attacks with Programmable Switches. In 27th Annual Network and Distributed System Security Symposium, NDSS 2020, San Diego, California, USA, February 23--26, 2020. The Internet Society. https:\/\/www.ndss-symposium.org\/ndss-paper\/poseidon-mitigating-volumetric-ddos-attacks-withprogrammable-switches\/"}],"container-title":["Proceedings of the ACM on Networking"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3676871","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3676871","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,23]],"date-time":"2025-08-23T20:12:43Z","timestamp":1755979963000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3676871"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,8,18]]},"references-count":32,"journal-issue":{"issue":"CoNEXT3","published-print":{"date-parts":[[2024,8,18]]}},"alternative-id":["10.1145\/3676871"],"URL":"https:\/\/doi.org\/10.1145\/3676871","relation":{},"ISSN":["2834-5509"],"issn-type":[{"type":"electronic","value":"2834-5509"}],"subject":[],"published":{"date-parts":[[2024,8,18]]},"assertion":[{"value":"2024-08-21","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}