## 3 Related Work  
In SDN, the HHs identification has been addressed from different network places: Controller, Switch, and Host. The Controller-based approaches compare the flow size statistics with a static and predefined threshold to identify HHs. There are two approaches to obtain the flow size statistics: pulling, and sampling. In pulling, the central controller maintains statistics (e.g., packets, bytes, and duration time) provided by OpenFlow [15; 19; 60]. Also, the Controller maintains the network state by sending Read-State messages periodically to the Data Plane. Sampling reduces the original traffic data characteristics by extracting the representative traffic data part. The sampling of flows is a trade-off between data reduction and preserving the details of the original data [61].  
In the literature, the switch-based approach moves the task of HHs identification from the Controller to the switches. This identification introduces new functionalities in switches to record flows size statistics. Then, the flow sizes are compared with a static and predefined threshold at the end-switch [2; 62]. In Host-Based identification, when the measurement of a flow (e.g., socket buffer and flow size) exceeds a previously set threshold value, the detector determines if the flow is a HH or not [24; 35; 63]. It is important to highlight that the use of a static and pre-defined threshold offers a rapid identification but low accuracy when the traffic is dynamic and grows suddenly. Table 2 summarises the main shortcomings for the different approaches.  
In short, the HHs identification approaches that use per-flow statistics collection in SDDCNs [15; 16; 17; 18; 19] yield both relatively high overhead and low granularity of traffic flow semantics. To avoid network overload and latency, some approaches, such as [17; 18; 20], utilise sampling for data collection. Unfortunately, since sampling does not take into account the packet size, large packets can be missed, resulting in a large error in the HHs identification. Usually, the switch-based approaches can only be realised by hardware modifications [21]. This fact contradicts the softwarization principle of SDN.  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Approach** & **Related Works** & **Network Overhead** & **Processing Overhead** & **HW 1** & **SW 2** \\ \hline \multirow{3}{*}{Controller} & [PERSON] et al. [15] & & & & \\ \cline{2-6}  & [PERSON] et al. [60] & High & High & ✗ & ✗ \\ \cline{2-6}  & [PERSON] and [PERSON] [61] & & & & \\ \hline \multirow{3}{*}{Switch} & [PERSON] et al. [2] & & & & \\ \cline{2-6}  & [PERSON] et al. [62] & Medium & Low & \(\surd\) & ✗ \\ \cline{2-6}  & [PERSON] et al. [2] & & & & \\ \hline \multirow{3}{*}{Host} & [PERSON] et al. [24] & & & & \\ \cline{2-6}  & [PERSON] _et al._[35] & & & & \\ \cline{1-1} \cline{2-6}  & [PERSON] et al. [63] & & & & \\ \hline \hline \end{tabular}  
* Hardware Modifications, 2 Software Modifications  
\end{table}
Table 2: Approaches for HHs identification shortcomings.  
On the other hand, despite that host-based approaches reduce the overhead on the network, they require modification of the operating system in each host leading to scalability issues [22; 23; 24].