ResidualSketch: Enhancing Layer Efficiency and Error Reduction in Hierarchical Heavy Hitter Detection with ResNet Innovations

2025-05-18

AI Summary

Addressing key challenges in Hierarchical Heavy Hitters (HHH) detection for high-speed networks—including error accumulation, excessive memory overhead, and poor cross-layer consistency—this paper proposes the first HHH detection framework incorporating ResNet-style residual architecture. Specifically, residual blocks with skip connections are embedded at critical hierarchical levels of IP address prefixes to effectively suppress progressive gradient error diffusion (GED) and enhance inter-layer detection consistency. Integrated with sketch-based data structures, the method introduces hierarchical hashing and a lightweight streaming update mechanism, achieving both low latency and high accuracy. Evaluated on multiple real-world network traffic datasets, the approach achieves an average 12.7% improvement in detection precision, a 3.2× increase in update throughput, and a 28% reduction in memory footprint, significantly outperforming state-of-the-art methods.

Technology Category

• Machine Learning: Hardware-aware ML
• Data Mining & Knowledge Management: Anomaly/Outlier Detection
• Search and Optimization: Distributed Search

Application Category

• Graph Algorithms and Modeling for the Web: Representation, reconstruction, and subgraph or motif discovery in Web-related graphs
• Responsible Web: Measurement, analysis, and circumvention of Web censorship
• Systems and Infrastructure for Web, Mobile and WoT: Data management and stream processing for Web, mobile and wireless applications

Abstract

In network management, swiftly and accurately identifying traffic anomalies, including Distributed Denial-of-Service (DDoS) attacks and unexpected network disruptions, is essential for network stability and security. Key to this process is the detection of Hierarchical Heavy Hitters (HHH), which significantly aids in the management of high-speed IP traffic. This study introduces ResidualSketch, a novel algorithm for HHH detection in hierarchical traffic analysis. ResidualSketch distinguishes itself by incorporating Residual Blocks and Residual Connections at crucial layers within the IP hierarchy, thus mitigating the Gradual Error Diffusion (GED) phenomenon in previous methods and reducing memory overhead while maintaining low update latency. Through comprehensive experiments on various datasets, we demonstrate that ResidualSketch outperforms existing state-of-the-art solutions in terms of accuracy and update speed across multiple layers of the network hierarchy. All related codes of ResidualSketch are open-source at GitHub.

Problem

• Detects Hierarchical Heavy Hitters in network traffic efficiently
• Reduces error diffusion and memory overhead in traffic analysis
• Improves accuracy and speed in multi-layer network anomaly detection

Innovation

• Uses Residual Blocks for error reduction
• Incorporates Residual Connections in IP hierarchy
• Reduces memory overhead with low latency