Predicting Elephant Flows in Internet Exchange Point Programmable Networks

Internet Exchange Points (IXPs) are high-performance networks that allow multiple autonomous systems to exchange traffic, with benefits ranging from cost reductions to performance improvements. As in any network, IXP operators face daily management challenges to promote better usage of the services provided by the network. An essential problem in IXP management concerns the identification of elephant flows, which are characterized by having traffic size and duration significantly higher than other flows. The current approaches to the identification of elephant flow in IXP networks depend that the analyzed flows exceed predefined thresholds to classify them as elephants. However, although it is not perceptible initially, elephant flows are elephant ones since their first packet. Hence, in this paper, we present a mechanism to predict flows behavior using historical observations and, by recognizing temporal patterns, identify elephant flows even before they exceed such thresholds. Our approach consists in predicting new flows size and duration through a Locally Weighted Regression (LWR) model, using the previous flows behavior and its temporal correlation with the new flow. The experimental results show that our mechanism is able to predict the volume and duration of new flows, and react to elephant flows rapidly, approximately 50.3 ms with up to 32 historical samples in the prediction model. These numbers are much smaller than the time each flow would take to exceed the thresholds to classify it as an elephant. In addition, the mechanism accurately predicts up to 80% of elephant flows in our evaluation scenarios and approximately 5% of false positives.