Faster and More Accurate

Measurement through
Additive-Error Counters
Ran Ben Basat Michael Mitzenmacher
Harvard University Harvard University

Gil Einziger Shay Vargaftik

Ben Gurion University VMware Research

INFOCOM 2020
 Network Measurements
Applications:
• DDoS prevention
• Traffic engineering
• SLA enforcement VM1 VM2 VM3 VM4
APP APP APP APP
•… OS OS OS OS

Measurement examples: Virtual NIC

• Per flow accounting.

vSwitch
• What are the k largest flows?
Physical NIC
Physical switch
Resource Limitations?
Memory Cannot allocate a counter to each item
CPU Cannot perform too many operations on each item

• Limited amount of fast memory

• Limited number of operations per item

vSwitch
• Cache residency
• Harder to support high rates

Silkroad, Miao et al., SIGCOMM 2017.

NitroSketch, Liu et al., SIGCOMM 2019. vSwitch
Streaming algorithms
• Input: sequence of items (can be examined once)

• Constraints:
• Limited memory.
• Limited processing time per item.

‘’…motivates approximate measurements

which reduce the overheads at the cost of
introducing a provably bounded error.’’

• Output: approximate answer.

Example: reducing memory consumption
via Count Min Sketch (CM Sketch)
Count Min Sketch (Cormode et al.,
2005)
h1
𝑑𝑒𝑝𝑡h 𝑑 h2
h3

𝑤𝑖𝑑𝑡h 𝑤
Count Min Sketch (Cormode et al.,
2005)
0 0 0 0 0 0 0 0 0 0 h1
𝑑𝑒𝑝𝑡h 𝑑 0 0 0 0 0 0 0 0 0 0 h2
0 0 0 0 0 0 0 0 0 0 h3

𝑤𝑖𝑑𝑡h 𝑤

h1 ( )% 𝑤 h2 ( ) % 𝑤 h3 () % 𝑤
Count Min Sketch (Cormode et al.,
2005)
0 0 0 1 0 0 0 0 0 0 h1
𝑑𝑒𝑝𝑡h 𝑑 1 0 0 0 0 0 0 0 0 0 h2
0 0 0 0 0 0 0 1 0 0 h3

𝑤𝑖𝑑𝑡h 𝑤

h1 ( )% 𝑤 h2 ( ) % 𝑤 h3 () % 𝑤
Count Min Sketch (Cormode et al.,
2005)
0 0 0 1 0 0 0 0 0 0 h1
𝑑𝑒𝑝𝑡h 𝑑 1 0 0 0 0 0 0 0 0 0 h2
0 0 0 0 0 0 0 1 0 0 h3

𝑤𝑖𝑑𝑡h 𝑤

h1 ( )% 𝑤 h2 ( ) % 𝑤 h3 () % 𝑤
Count Min Sketch (Cormode et al.,
2005)
0 0 0 2 0 0 0 0 0 0 h1
𝑑𝑒𝑝𝑡h 𝑑 1 0 0 0 1 0 0 0 0 0 h2
0 1 0 0 0 0 0 1 0 0 h3

𝑤𝑖𝑑𝑡h 𝑤
Count Min Sketch (Cormode et al.,
2005)
0 0 0 2 0 0 0 0 0 0 h1
𝑑𝑒𝑝𝑡h 𝑑 1 0 0 0 1 0 0 0 0 0 h2
0 1 0 0 0 0 0 1 0 0 h3

𝑤𝑖𝑑𝑡h 𝑤

h1 ( )% 𝑤 h2 ( ) % 𝑤 h3 () % 𝑤
Count Min Sketch (Cormode et al.,
2005)
0 0 0 2 0 0 0 0 0 1 h1
𝑑𝑒𝑝𝑡h 𝑑 2 0 0 0 1 0 0 0 0 0 h2
0 1 0 0 0 0 0 2 0 0 h3

𝑤𝑖𝑑𝑡h 𝑤
Count Min Sketch (Cormode et al.,
2005)
0 0 0 2 0 0 0 0 0 1 h1
𝑑𝑒𝑝𝑡h 𝑑 2 0 0 0 1 0 0 0 0 0 h2
0 1 0 0 0 0 0 2 0 0 h3

𝑤𝑖𝑑𝑡h 𝑤

( ) = min( h1 ( )% 𝑤 ,
h2 ( ) % 𝑤 ,
) = min(2,1,1) = 1
Count Min Sketch (Cormode et al.,
2005)
0 0 0 2 0 0 0 0 0 1 h1
𝑑𝑒𝑝𝑡h 𝑑 2 0 0 0 1 0 0 0 0 0 h2
0 1 0 0 0 0 0 2 0 0 h3

𝑤𝑖𝑑𝑡h 𝑤

( ) = min ( h1 ( )% 𝑤 ,
h2 ( ) % 𝑤 ,
) = min(2,2,2) = 2
 Count Min Sketch (Cormode et al.,
2005)
𝑑𝑒𝑝𝑡h 𝑑

𝑤𝑖𝑑𝑡h 𝑤

Guarantee for specified (,):

Additive error
Set and . Then:
,
where is the total traffic seen so far (= the sum of each row in CMS).
Example: reducing CPU consumption
via sampling
Sampling
Introduces:
1. Convergence time
2. Increased error
Data structure
0.01 (e.g., CM Sketch)

0.99 Ignore
packet
 Revisiting sketch counters

Idea (not new):

Replace full counters with shorter probabilistic
counters

Related work: Multiplicative* error counters

e.g. CEDAR (Tsidon et al. INFOCOM 2012), ICE-Buckets (Einziger et
al. INFOCOM 2015), CASE (Li et al. INFOCOM 2016), SAC (Yang et
al, INFOCOM 2019)

*
Overview of related work
0 0 0 2 0 0 0 0 0 1 h1
𝑑𝑒𝑝𝑡h 𝑑 3 0 0 0 1 0 0 0 0 0 h2
0 1 0 0 0 0 0 2 0 0 h3

𝑤𝑖𝑑𝑡h 𝑤
( )

1. Access sketch counters

2. Calculate the minimum
3. Flip a coin to increment the minimal counters
Overview of related work
0 0 0 2 0 0 0 0 0 1 h1
𝑑𝑒𝑝𝑡h 𝑑 3 0 0 0 1 0 0 0 0 0 h2
0 1 0 0 0 0 0 2 0 0 h3

𝑤𝑖𝑑𝑡h 𝑤
(3,2,2) =2

1. Access sketch counters

2. Calculate the minimum
3. Flip a coin to increment the minimal counters
Overview of related work
0 0 0 2 0 0 0 0 0 1 h1
𝑑𝑒𝑝𝑡h 𝑑 3 0 0 0 1 0 0 0 0 0 h2
0 1 0 0 0 0 0 2 0 0 h3

𝑤𝑖𝑑𝑡h 𝑤
𝑝 ( 2 )=0.5

1. Access sketch counters

2. Calculate the minimum
3. Flip a coin to increment the minimal counters
Overview of related work
0 0 0 3 0 0 0 0 0 1 h1
𝑑𝑒𝑝𝑡h 𝑑 3 0 0 0 1 0 0 0 0 0 h2
0 1 0 0 0 0 0 3 0 0 h3

𝑤𝑖𝑑𝑡h 𝑤
𝑝 ( 2 )=0.5

1. Access sketch counters

2. Calculate the minimum
3. Flip a coin to increment the minimal counters
 Related work vs our work

Accuracy Speed
Estimators
Sampling
Our work
Where is the magic?
Related work
1. Access sketch counters
2. Calculate the minimum
3. Flip a coin to increment the minimal counters
Our work
1. Flip a coin (with high probability do nothing)
2. Access sketch counters
3. Increment the minimal counters
Our Additive Error Estimators (AEE)
Probabilistic increment (): Adds one to our estimator with a
(fixed) probability .

Query: Estimates the number of s by returning the value

where is the estimator value.

Extend counting range: reduce p, and down sample the

estimators.
 Our : Additive Error Estimators (AEE)
Arrival 1 𝑄𝑢𝑒𝑟𝑦=0 , 𝐸𝑥𝑎𝑐𝑡=0 Arrival 5 𝑄𝑢𝑒𝑟𝑦=4 , 𝐸𝑥𝑎𝑐𝑡=4
𝑝=1 0 0 𝑝=0.5 1 0

Arrival 2 𝑄𝑢𝑒𝑟𝑦=1 , 𝐸𝑥𝑎𝑐𝑡=1 Arrival 6 𝑄𝑢𝑒𝑟𝑦=4 , 𝐸𝑥𝑎𝑐𝑡=5

𝑝=1 0 1 𝑝=0.5 1 0

Arrival 3 𝑄𝑢𝑒𝑟𝑦=2 , 𝐸𝑥𝑎𝑐𝑡=2 Arrival 7 𝑄𝑢𝑒𝑟𝑦=4 , 𝐸𝑥𝑎𝑐𝑡=6

𝑝=1 1 0 𝑝=0.5 1 0

***Arrival 4 𝑄𝑢𝑒𝑟𝑦=3 , 𝐸𝑥𝑎𝑐𝑡=3 ***Arrival 8 𝑄𝑢𝑒𝑟𝑦=6 , 𝐸𝑥𝑎𝑐𝑡=7

𝑝=1 1 1 𝑝=0.5 1 1

𝑄𝑢𝑒𝑟𝑦=8 , 𝐸𝑥𝑎𝑐𝑡=8
***Overflow? then, before adding 1: 𝑝=0.25 1 0


 Our : Additive Error Estimators (AEE)
AEE:

Probability bits 𝑓 (𝜖 , 𝛿)
 Our : Additive Error Estimators (AEE)
AEE:

Probability bits 𝑓 (𝜖 , 𝛿)
AEE array:
 Our: Additive Error Estimators (AEE)
AEE array:

All counters share the sampling probability:

• Access estimators only if packet is sampled
• Unlike in existing multiplicative error estimators

𝑝 Data
1− 𝑝 Structure

Ignore
packet
 Evaluation
• A single Core: i7-7700 CPU @3.60GHz.

• RMSE: in a stream with packets we have error values .

1. and
2. Normalized RMSE (in [0,1]):

• 16-bit AEE vs. 16-bit SAC* vs. 32-bit counters.

*Yang, et al. "A Generic Technique for Sketches to Adapt to Different Counting Ranges." INFOCOM’19.
 Evaluation: Accuracy

More accurate than previous estimators.

(CM Sketch, CAIDA (2018) backbone trace, ~100M packets, ~6.5M flows)
 Evaluation: Speed

Much faster than the baseline (and other estimators)

(CM Sketch, CAIDA (2018) backbone trace, ~100M packets, ~6.5M flows)
 Takeaways
Current work:
• Faster & more accurate
• Guaranteed accuracy (formally proven)
• No overflows (ever)
• Supports weights (not in presentation)

Possible future work:

• Support deletions
• P4 adaptation
• …
Thank you!