Uncovering Global Icebergs in Distributed Monitors

Security is becoming an increasingly important QoS parameter for which network providers should provision. The authors focus on monitoring and detecting one type of network event, which is important for a number of security applications such as DDoS attack mitigation and worm detection, called distributed global icebergs. While previous work has concentrated on measuring local heavy-hitters using "Sketches" in the non-distributed streaming case or icebergs in the non-streaming distributed case, the authors focus on measuring icebergs from distributed streams. Since an iceberg may be "Hidden" by being distributed across many different streams, they combine a sampling component with local sketches to catch such cases.