A Data Streaming Algorithm for Detection of Superpoints With Small Memory Consumption

A superpoint is a host that communicates with a large number of distinct destinations (sources) within a measurement period. Identifying superpoints is an important and meaningful task for network security and monitoring. To keep up with the line speed in a high-speed network, fast memory is indispensable for detecting superpoints. Moreover, the memory is also expensive and size-limited. In this letter, we propose a new data streaming algorithm for detecting superpoints, called Snare, which can work in tight memory space and yield good performance. Its accuracy and efficiency come from a new data structure snare and the compensation mechanism for the number of lost flows. Theoretical analysis and experimental results show that Snare can detect superpoints accurately and efficiently.