A Novel Space-Efficient Method for Detecting Network-Wide Heavy Hitters in Software-Defined Networking Using P4-Switch

Software-Defined Networking (SDN) is a dynamic, programmable approach that enables centralized control and has become essential in modern networking environments such as data centers, Internet Service Providers (ISPs), and emerging 5G applications. A critical challenge within SDN environments is detecting and managing “heavy hitters” high-traffic flows often associated with malicious activities like Distributed Denial of Service (DDoS) attacks or real-time data-intensive applications. Identifying these flows across multiple network switches is complex due to constraints like memory limitations and processing accuracy. This paper proposes a novel, network-wide solution for detecting Heavy Hitters (HH), moving beyond the single-switch approaches found in previous research. In contrast, the new strategy introduces two algorithms to enhance detection. The first algorithm leverages the P4 programming language to identify the local Top-k heavy flows at individual P4-enabled switches. The second algorithm employs dynamic thresholding to efficiently combine the Top-k lists from multiple switches, creating a centralized, coordinated network-wide detection system. The proposed system was rigorously tested in an SDN environment utilizing P4 switches. The results show that it achieves a high detection accuracy (95%-100%) while using only 10KB of memory per programmable switch. Furthermore, the approach outperforms existing state-of-the-art methods, providing higher accuracy and lower error rates with minimal memory usage