## 4 KDN-Based Heavy-Hitter Identification Approach
### Architecture and Modules
#### 4.2.2 Heavy-Hitters Data Acquisition Module
\begin{table}
\begin{tabular}{c c c c c c c c c c c c} \hline \hline \multirow{2}{*}{**Class**} & \multirow{2}{*}{**UNIV1**} & \multicolumn{3}{c}{**Num. of**} & \multicolumn{3}{c}{**Flow Size (Bytes)**} & \multicolumn{3}{c}{**Number of Packets**} & \multicolumn{3}{c}{**Flow Duration**} \\ \cline{3-13}  & & **Flows** & **Max** & **Min** & **Avg** & **Max** & **Min** & **Avg** & **Max** & **Min** & **Avg** \\ \hline \multirow{4}{*}{I} & 15 s & 315,461 & \(1.88\times 10^{6}\) & 31 & \(8.27\times 10^{3}\) & 28,622 & 1 & \(8.27\times 10^{3}\) & 2643.73 & 0 & 2.85 \\  & 150 s & 293,709 & \(1.88\times 10^{6}\) & 32 & \(8.47\times 10^{3}\) & 11,394 & 1 & \(8.47\times 10^{3}\) & 2643.73 & 0 & 6.67 \\  & 15 s & 6 & \(180.23\times 10^{6}\) & \(137.52\times 10^{6}\) & \(154.93\times 10^{6}\) & 200,(26.19\(\pm\)0.047 & \(154.93\times 10^{6}\) & 511.61 & 151.9 & 277.6 \\  & 150 s & 6 & \(194.11\times 10^{6}\) & \(145.39\times 10^{6}\) & \(167.37\times 10^{6}\) & 281,168 & 149,047 & \(154.39\times 10^{6}\) & 511.61 & 151.9 & 277.6 \\  & 15 s & 29 & \(34.02\times 10^{6}\) & \(14.23\times 10^{6}\) & \(20.20\times 10^{6}\) & 75,988 & 13,136 & \(20.20\times 10^{6}\) & 1.962 & 860.9 & 1.96 \\  & 150 s & 32 & \(32.95\times 10^{6}\) & \(11.81\times 10^{6}\) & \(18.89\times 10^{6}\) & 33,972 & \(11,738\) & \(18.89\times 10^{6}\) & 2641.51 & 1.96 & 361.7 \\  & 15 s & 5 & \(76.86\times 10^{6}\) & \(42.73\times 10^{6}\) & \(55.80\times 10^{6}\) & 84,413 & \(34,243\) & \(55.80\times 10^{6}\) & 504.84 & 8.65 & 2133.9 \\  & 150 s & 6 & \(86.80\times 10^{6}\) & \(42.73\times 10^{6}\) & \(60.97\times 10^{6}\) & 85,848 & 34,243 & \(56.09\times 10^{6}\) & 504.84 & 8.65 & 2133 \\  & 15 s & 200 & \(11.81\times 10^{6}\) & \(1.89\times 10^{6}\) & \(3.77\times 10^{6}\) & 79,661 & 1418 & \(3.77\times 10^{6}\) & 2643.89 & 1.39 & 201.3 \\  & 150 s & 217 & \(11.81\times 10^{6}\) & \(1.89\times 10^{6}\) & \(3.77\times 10^{6}\) & 79,661 & 1418 & \(3.77\times 10^{6}\) & 2643.89 & 1.39 & 201.3 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Flows size and number of packets obtained using \(k\) = 5 and \(f_{ito}\) = 15 s and \(f_{ito}\) = 15 s. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**UNIV1** & **Class 1** & **Class 2** & **Total** \\ \hline \(f_{ito}\) = 15 s & 315,694 & 7 & 315,701 \\ \(f_{ito}\) = 150 s & 293,962 & 8 & 293,970 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Number of flows per class obtained using \(k\) = 2. Aiming at corroborating the applicability of our proposal, we evaluated the time that HH-DANM spends to identify the flows in UNIV1 by using the above-defined thresholds. As such, we analysed the time required to get 14 packets and an accuracy of over 96%. Table 8 summarizes the results obtained, provides statistical information about the flow duration for the first 14 packets, and reveals diverse facts. Firstly, the majority of flows can be identified in a short time. In particular, this time is less than 0.9 s for 80% of flows for \(f_{fto}\) = 15 s and \(f_{fto}\) = 150 s. Secondly, approximately 95% of flows are classified in a time less than 6 s for f ito = 15 s and \(f_{fto}\) = 150 s. Thirdly, roughly, for f ito = 15 s and \(f_{fto}\) = 150 s, only 4% of flows are identified in a time higher than 16 s. Fourthly, approximately, for f ito = 15 s and \(f_{fto}\) = 150 s, just 2% of flows are identified in a time higher than 23 s. Finally, some flows (worst cases) required up to 480 s to collect the required minimum volume of flow data and/or packets. Considering these facts, we argue that our proposal is applicable in real scenarios. Furthermore, it is possible to get less time by decreasing the accuracy; it is by establishing a trade-off between accuracy and identification time. Finally, in the evaluation of HH-DANM, we compared its True Positive Rate (TPR) with the provided by classification techniques used by [PERSON] et al. [75]. In particular, they used Neural Networks (NN), Gaussian Processes Regression (GPR), and Online Bayesian Moment Matching (oBMM) to classify HHs.