Regain Sliding super point from distributed edge routers by GPU

Abstract

Sliding super point is a special host defined under sliding time window with which there are huge other hosts contact. It plays important roles in network security and management. But how to detect them in real time from nowadays high-speed network which contains several distributed routers is a hard task. Distributed sliding super point detection requires an algorithm that can estimate the number of contacting hosts incrementally, scan packets faster than their flowing speed and reconstruct sliding super point at the end of a time period. But no existing algorithm satisfies these three requirements simultaneously. To solve this problem, this paper firstly proposed a distributed sliding super point detection algorithm running on GPU. The advantage of this algorithm comes from a novel sliding estimator, which can estimate contacting host number incrementally under a sliding window, and a set of reversible hash functions, by which sliding super points could be regained without storing additional data such as IP list. There are two main procedures in this algorithm: packets scanning and sliding super points reconstruction. Both could run parallel without any data reading conflict. When deployed on a low cost GPU, this algorithm could deal with traffic with bandwidth as high as 680 Gb/s. A real world core network traffic is used to evaluate the performance of this sliding super point detection algorithm on a cheap GPU, Nvidia GTX950 with 4 GB graphic memory. Experiments comparing with other algorithms under discrete time window show that this algorithm has the highest accuracy. Under sliding time widow, this algorithm has the same performance as in discrete time window, where no other algorithms can work.