LocalSketch: An Accurate and Efficient Sketch for Range Spread Estimation

Sketch demonstrates good properties in spread estimation over network measurements, providing fast processing and accurate estimation under limited memory usage. However, most current methods remain limited to single-flow spread estimation, resulting in suboptimal performance when applied to range spread estimation that requires measuring the spread of a range of flows. In this paper, we propose LocalSketch, a novel sketch that achieves both high estimation accuracy and memory efficiency for range spread estimation with provable theoretical guarantees. LocalSketch has two key innovations: (1) local key aggregation within predefined ranges that eliminates duplicate spread information through locality correlation, and (2) adaptive counter sizing that dynamically allocates memory resources for large-spread ranges while maintaining compact representations for low-spread ranges. LocalSketch also features an efficient abnormal bucket detection mechanism by comparing identification sign, avoiding exhaustive bucket traversal during super range detection. Moreover, the main idea of LocalSketch can be adapted to existing plug-in spread counters, which has been experimentally proved. We provide a theoretical analysis of estimation accuracy and conduct comprehensive evaluations using real-world network traffic datasets. Experimental results demonstrate that LocalSketch outperforms state-of-the-art methods by achieving 76× higher estimation accuracy for range spread estimation, while showing 15× better accuracy and 39× faster detection speed for super range identification across all datasets.