Abstract
In a software-defined network (SDN), traffic statis-tics from switches are essential for the controller to satisfy different application requirements (e.g., attack detection, load balancing, etc.). To pursue better measurement accuracy, some solutions utilize flow tables to obtain traffic statistics, but the limited TCAM-based flow entries fail to accommodate massive traffic. Another alternative solution is sketch (i.e., a compact data structure), which can be deployed to achieve fine-grained traffic measurement. Nevertheless, traditional sketches (e.g., Count-Min) cannot record flow labels of elephant flows, and meanwhile, sketches that pay excessive attention to the elephant flows in-evitably sacrifice the accuracy of the mouse flows. Consequently, this paper proposes a novel model that combines sketch and flow table for per-flow size measurement in SDNs. The sketch in our model not only separates the mouse and elephant flows but also counts the statistics of mouse flows. Moreover, with the designed algorithm, we take full advantage of precious flow entries to keep elephant flows in the flow table. Simulation experiments based on real-world datasets show that our approach has the best performance in per-flow size estimation, flow size distribution, entropy estimation, heavy hitter detection, and heavy change detection compared to existing methods.