Fast algorithms for heavy distinct hitters using associative memories

Nagender Bandi, Divyakant Agrawal, Amr El Abbadi

Research output: Chapter in Book/Report/Conference proceedingConference contribution

15 Citations (Scopus)

Abstract

Real-time detection of worm attacks, port scans and Distributed Denial of Service (DDoS) attacks, as network packets belonging to these security attacks flow through a network router, is of paramount importance. In a typical worm attack, a worm infected host tries to spread the worm by scanning a number of other hosts thus resulting in significant number of network connections at an intermediate router. Detecting such attacks amounts to finding all hosts that are associated with unusually high number of other hosts, which is equivalent to solving the classic heavy distinct hitter problem over data streams. While several heavy distinct hitter solutions have been proposed and evaluated in a standard CPU setting, most of the above applications typically execute on special networking architectures called Network Processing Units (NPUs). These NPUs interface with special associative memories known as the Ternary Content Addressable Memories (TCAMs) to provide gigabit rate forwarding at network routers. In this paper, we describe how the integrated architecture of NPU and TCAMs can be exploited to develop high-speed solutions for heavy distinct hitters.

Original languageEnglish
Title of host publication27th International Conference on Distributed Computing Systems, ICDCS'07
DOIs
Publication statusPublished - 8 Oct 2007
Event27th International Conference on Distributed Computing Systems, ICDCS'07 - Toronto, ON, Canada
Duration: 25 Jun 200727 Jun 2007

Publication series

NameProceedings - International Conference on Distributed Computing Systems

Other

Other27th International Conference on Distributed Computing Systems, ICDCS'07
CountryCanada
CityToronto, ON
Period25/6/0727/6/07

    Fingerprint

ASJC Scopus subject areas

  • Software
  • Hardware and Architecture
  • Computer Networks and Communications

Cite this

Bandi, N., Agrawal, D., & El Abbadi, A. (2007). Fast algorithms for heavy distinct hitters using associative memories. In 27th International Conference on Distributed Computing Systems, ICDCS'07 [4268163] (Proceedings - International Conference on Distributed Computing Systems). https://doi.org/10.1109/ICDCS.2007.110