Accurate Detection of Superspreaders on Multi-Pipeline Switches

In various network monitoring tasks, the detection of superspreaders has become increasingly crucial. However, latest superspreader detection algorithms and data structures assume the target switch with a single pipeline, while state-of-the-art programmable switches actually comprise multiple independent pipelines. In current method for deploying super-spreader detection applications on multi-pipeline switches, a separate measurement data structure instance is employed for each pipeline. However, under multi-path routing, this simplistic approach leads to lower detection accuracy due to hash collisions. To address this issue, in this paper, we present PipelineAlloc, a HyperLogLog-based superspreader detection system designed for multi-pipeline switches. In order to reduce hash collisions in measurement data structures, PipelineAlloc assigns an egress pipeline as the monitor pipeline for each source IP address. PipelineAlloc introduces novel measurement data structures in the ingress pipelines for temporarily storing statistics of the source and destination IP addresses of packets, and uses packets to carry these measurement data to egress pipelines, which serve as the monitor pipelines. The HyperLogLog-based measurement data structures in egress pipelines are updated using data carried by packets. Experiments driven by real-world traffic traces show that PipelineAlloc outperforms existing solutions in terms of detection accuracy.