• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.37B no.9
• /
• pp.849-858
• /
• 2012

We proposed a scheme to accurately detect elephant flows. Along the ever increasing traffic trend, certain flows occupy the network heavily in terms of time and network bandwidth. These flows are called elephant flows. Elephant flows raises complicated issues to manage for Internet traffics and services. One of the methods to identify elephant flows is the Landmark LRU cache scheme, which improved the previous method of Least Recently Used scheme. We proposed a cache update algorithm, to further improve the existing Landmark LRU. The proposed scheme improves the accuracy to detect elephant flow while maintaining efficiency of Landmark LRU. We verified our algorithm by simulating on Sangmyung University's wireless real network traces and evaluated the improvement.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.42 no.3
• /
• pp.612-622
• /
• 2017

Long-lived flowed termed as elephant flows in data center networks have a tendency to consume a lot of bandwidth, leaving delay-sensitive short-lived flows referred to as mice flows choked behind them. This results in non-trivial delays for mice flows, eventually degrading application performance running on the network. Therefore, a datacenter network should be able to classify, detect, and visualize elephant flows as well as provide QoS guarantees in real-time. In this paper we aim to focus on: 1) a proposed framework for real-time detection and visualization of elephant flows in SDN using sFlow. This allows to examine elephant flows traversing a switch by double-clicking the switch node in the topology visualization UI; 2) an approach to guarantee QoS that is defined and administered by a SDN controller and specifications offered by OpenFlow. In the scope of this paper, we will focus on the use of rate-limiting (traffic-shaping) classification technique within an SDN network.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.16 no.8
• /
• pp.2801-2815
• /
• 2022

With the advent and realization of Software Defined Network (SDN) architecture, many organizations are now shifting towards this paradigm. SDN brings more control, higher scalability, and serene elasticity. The SDN spontaneously changes the network configuration according to the dynamic network requirements inside the constrained environments. Therefore, a monitoring system that can monitor the physical and virtual entities is needed to operate this type of network technology with high efficiency and proficiency. In this manuscript, we propose a real-time monitoring system for data collection and visualization that includes the Prometheus, node exporter, and Grafana. A node exporter is configured on the physical devices to collect the physical and virtual entities resources utilization logs. A real-time Prometheus database is configured to collect and store the data from all the exporters. Furthermore, the Grafana is affixed with Prometheus to visualize the current network status and device provisioning. A monitoring system is deployed on the physical infrastructure of the KOREN topology. Data collected by the monitoring system is further pre-processed and restructured into a dataset. A monitoring system is further enhanced by including machine learning techniques applied on the formatted datasets to identify the elephant flows. Additionally, a Random Forest is trained on our generated labeled datasets, and the classification models' performance are verified using accuracy metrics.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.8 no.4
• /
• pp.1307-1323
• /
• 2014

With the exhaustion of global IPv4 addresses, IPv6 technologies have attracted increasing attentions, and have been deployed widely. Meanwhile, new applications running over IPv6 networks will change the traditional traffic characteristics obtained from IPv4 networks. Traditional models obtained from IPv4 cannot be used for IPv6 network monitoring directly and there is a need to investigate those changes. In this paper, we explore the flow features of IPv6 traffic and compare its difference with that of IPv4 traffic from flow level. Firstly, we analyze the differences of the general flow statistical characteristics and users' behavior between IPv4 and IPv6 networks. We find that there are more elephant flows in IPv6, which is critical for traffic engineering. Secondly, we find that there exist many one-way flows both in the IPv4 and IPv6 traffic, which are important information sources for abnormal behavior detection. Finally, in light of the challenges of analyzing massive data of large-scale network monitoring, we propose a group flow model which can greatly reduce the number of flows while capturing the primary traffic features, and perform a comparative measurement analysis of group users' behavior dynamic characteristics. We find there are less sharp changes caused by abnormity compared with IPv4, which shows there are less large-scale malicious activities in IPv6 currently. All the evaluation experiments are carried out based on the traffic traces collected from the Northwest Regional Center of CERNET (China Education and Research Network), and the results reveal the detailed flow characteristics of IPv6, which are useful for traffic management and anomaly detection in IPv6.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.41 no.6
• /
• pp.663-671
• /
• 2016

According to rapidly increasing of network traffics, necessity of high-speed router also increased. For various purposes, like traffic statistic and security, traffic measurement function should performed by router. However, because of the nature of high-speed router, memory resource of router was limited. RCC proposed a way to measure traffics with high speed and accuracy. Additional quadratic probing hashing table used for accumulating elephant flows in RCC. However, in our experiment, quadratic probing performed many overheads when allocated small memory space or load factor was high. Especially, quadratic requested many calculations in update and lookup. To face this kind of problem, we use a cuckoo hashing which performed a good performance in update and loop for enhancing the RCC. As results, RCC with cuckoo hashing performed high accuracy and speed even when load factor of memory was high.