Salvato in:
| Autori principali: | , , , , , , , , , , |
|---|---|
| Natura: | Preprint |
| Pubblicazione: |
2026
|
| Soggetti: | |
| Accesso online: | https://arxiv.org/abs/2604.02379 |
| Tags: |
Aggiungi Tag
Nessun Tag, puoi essere il primo ad aggiungerne!!
|
| _version_ | 1866911564267782144 |
|---|---|
| author | Zhao, Yilin Huang, Jiawei Su, Xianshi Li, Weihe Li, Xin Liu, Yan Xie, Jiacheng Su, Qichen Ye, Jin Jiang, Wanchun Wang, Jianxin |
| author_facet | Zhao, Yilin Huang, Jiawei Su, Xianshi Li, Weihe Li, Xin Liu, Yan Xie, Jiacheng Su, Qichen Ye, Jin Jiang, Wanchun Wang, Jianxin |
| contents | Accurately detecting super host that establishes connections to a large number of distinct peers is significant for mitigating web attacks and ensuring high quality of web service. Existing sketch-based approaches estimate the number of distinct connections called flow cardinality according to full IP addresses, while ignoring the fact that a malicious or victim super host often communicates with hosts within the same subnet, resulting in high false positive rates and low accuracy. Though hierarchical-structure based approaches could capture flow cardinality in subnet, they inherently suffer from high memory usage. To address these limitations, we propose SegSketch, a segmented cardinality estimation approach that employs a lightweight halved-segment hashing strategy to infer common prefix lengths of IP addresses, and estimates cardinality within subnet to enhance detection accuracy under constrained memory size. Experiments driven by real-world traces demonstrate that, SegSketch improves F1-Score by up to 8.04x compared to state-of-the-art solutions, particularly under small memory budgets. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2604_02379 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | Cardinality is Not Enough: Super Host Detection via Segmented Cardinality Estimation Zhao, Yilin Huang, Jiawei Su, Xianshi Li, Weihe Li, Xin Liu, Yan Xie, Jiacheng Su, Qichen Ye, Jin Jiang, Wanchun Wang, Jianxin Networking and Internet Architecture Accurately detecting super host that establishes connections to a large number of distinct peers is significant for mitigating web attacks and ensuring high quality of web service. Existing sketch-based approaches estimate the number of distinct connections called flow cardinality according to full IP addresses, while ignoring the fact that a malicious or victim super host often communicates with hosts within the same subnet, resulting in high false positive rates and low accuracy. Though hierarchical-structure based approaches could capture flow cardinality in subnet, they inherently suffer from high memory usage. To address these limitations, we propose SegSketch, a segmented cardinality estimation approach that employs a lightweight halved-segment hashing strategy to infer common prefix lengths of IP addresses, and estimates cardinality within subnet to enhance detection accuracy under constrained memory size. Experiments driven by real-world traces demonstrate that, SegSketch improves F1-Score by up to 8.04x compared to state-of-the-art solutions, particularly under small memory budgets. |
| title | Cardinality is Not Enough: Super Host Detection via Segmented Cardinality Estimation |
| topic | Networking and Internet Architecture |
| url | https://arxiv.org/abs/2604.02379 |