Abstract
Aggregated information regarding implicated entities is critical for online applications like network management, traffic characterization or identifying patters of resource consumption. Recently there has been a flurry of research for online aggregation on streams (like quantiles, hot items, hierarchical heavy hitters) but surprizingly the problem of summarizing implicated information in stream data has received no attention. As an example, consider an IP-network and the implication source → destination. Flash crowds, — such as those that follow recent sport events (like the olympics) or seek information regarding catastrophic events — or denial of service attacks direct a large volume of traffic from a huge number of sources to a very small number of destinations. In this paper we present novel randomized algorithms for monitoring such implications with constraints in both memory and processing power for environments like network routers. Our experiments demonstrate several factors of improvements over straightforward approaches.