## 4 KDN-Based Heavy-Hitter Identification Approach
### Architecture and Modules
#### 4.2.3 Heavy-Hitters Application Module  
HH-APM is responsible for sending instructions about what the network (i.e., the SDN controller) needs to do, when a HH or non-HH is identified. Once the HHs are identified, the Controller instructs \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline  & \multicolumn{3}{c}{\(f_{fto}\) = 15 s} & \multicolumn{3}{c}{\(f_{fto}\) = 150 s} \\ \hline
**Percentile [\%]** & **[\%]** & **Percentile [\%]** & **[\%]** & **Percentile [\%]** & **[\%]** & **Percentile [\%]** & **[\%]** \\ \hline
20 & 0.08 & 80 & 0.87 & 20 & 0.10 & 80 & 0.84 \\
30 & 0.12 & 90 & 2.20 & 30 & 0.15 & 90 & 1.67 \\
40 & 0.18 & 92 & 4.34 & 40 & 0.21 & 92 & 2.63 \\
50 & 0.23 & 94 & 5.62 & 50 & 0.25 & 94 & 4.42 \\ \hline
60 & 0.30 & 96 & 16.00 & 60 & 0.31 & 96 & 15.23 \\
70 & 0.41 & 98 & 21.07 & 70 & 0.41 & 98 & 22.83 \\ \hline  & **Coun** & \multicolumn{3}{c}{6 122} & \multicolumn{3}{c}{**Count**} & \multicolumn{3}{c}{4 043} \\  & **Mean** & \multicolumn{3}{c}{1.752} & \multicolumn{3}{c}{**Mean**} & \multicolumn{3}{c}{3.666} \\  & **Std** & \multicolumn{3}{c}{5.807} & \multicolumn{3}{c}{**Std**} & \multicolumn{3}{c}{30.116} \\  & **Max** & \multicolumn{3}{c}{157.108} & \multicolumn{3}{c}{**Max**} & \multicolumn{3}{c}{480.636} \\  & **Min** & \multicolumn{3}{c}{0.003} & \multicolumn{3}{c}{**Min**} & \multicolumn{3}{c}{0.004} \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Flow duration statistics of the first 14 packets in UNIV1. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Threshold [KB]** & **GPR** & **oBMM** & **NN** & **HH-DANM** \\ \hline
10 & 96.1 & 98.03 & 97.6 & 96.2 \\
100 & 94.6 & 98.4 & 96.3 & 96.03 \\
1000 & 70.2 & 98.1 & 90.4 & 96.1 \\ \hline \hline \end{tabular}
\end{table} 
Table 9: True positive rate comparison. the forwarder devices to do a variety of network managerial related activities aiming at improving the overall network performance. To carry out HH-APM and routing the non-HHs identified, we propose the use of MiceDCER (Mice Data Center Efficient Routing) [35]. MiceDCER is an algorithm, proposed by our research group in a previous work [35], that efficiently routes non-HHs in SDDCN by assigning internal Pseudo-MAC (PMAC) addresses to the ToR switches and hosts. MiceDCER generates the PMAC of the switches that received the flow intercepted by the controller based on their position in the topology. PMACs are stored in a table that associates them with the corresponding actual MAC (Media Access Control) address of each switch. Also, MiceDCER reduces the number of routing rules by installing wildcard rules based on the information carried by the ARP packets. In a high-abstraction level, MiceDCER-based HH-APM performs three significant procedures: _Generation of initial rules for the edge switches, Intercepted message management_, and _Generation of table entries_. Figure 6 shows the flowcharts of each procedure performed by MiceDCER. The _Generation of initial rules for the edge switches_ is carried out by installing routing rules for the edge switches with the ARP field type. These initial rules allow the controller to intercept the ARP messages that arrive at the switch. To install rules on the switch tables, the algorithm performs the procedure _Intercepted message management_. In this procedure, a verification is carried out about the intercepted IP destination address of the ARP request message. If the controller does not recognise such address, then the controller instructs the switch that received the message intercepted to flood and instructs the other edge switches to flood with requests. If the controller recognises the IP address, it sends a reply ARP message back to the source host. The _Generation of table entries_ procedure has two major processes. Firstly, it verifies if the source IP address of the intercepted message is stored in the host PMACs table. Secondly, if the source IP (Internet Protocol) address is not stored, then this procedure proceeds to generate the PMAC and save it into the table, associating it with the source IP address.