An Approach Based on Knowledge-Defined Networking for Identifying Heavy-Hitter Flows in Data Center Networks  
[PERSON]  
1 Telematics Engineering Group, Telematics Department, Universidad del Cauca, Popapan 190003, Colombia; [EMAIL_ADDRESS] (F.A.-S.); [EMAIL_ADDRESS] (O.M.C.R. ); [EMAIL_ADDRESS] (A.O.) Programa de Ingenieria Electronica, Universidad del Quindio, Armenia 630002, Colombia; [EMAIL_ADDRESS]  
2 October 20  
that are programmable through standardised protocols such as OpenFlow [4] and ForCES [5]. DCNs using SDN are referred to as Software-Defined Data Center Networks (SDDCNs) [6]. Centralized control of the network provides a flexible architecture for more efficiently managing the network traffic. However, this centralized control does not guarantee that the network performance will not degrade when traffic volume raises [7]. One class of traffic that constantly poses a challenge is Heavy-Hitter (HH) flows--large-volume flows that consume considerably more network resources than other flows combined [7; 8; 9; 10]. One of the consequences of unsupervised forwarding of HHs is that it often leads to network congestion and, subsequently, to overall network performance degradation [7; 8; 11; 12; 13; 14]. A pivotal task for handling HHs efficiently is their identification. In the literature, there are different approaches [15; 16; 17; 18; 19] that use per-flow statistics collection in SDDCNs for identifying HHs. Nevertheless, these approaches present both relatively high overhead and low granularity of traffic flow semantics. To avoid network overload and latency, other approaches [17; 18; 20] utilise sampling for data collection. Nonetheless, since sampling does not consider the packet size, large packets can be missed, resulting in a large error in the HHs identification. To identify HHs, switch-based and host-based approaches can also be used. However, switch-based can only be carried out by hardware modifications [21]. This fact contradicts the softwarization principles of SDN. In turn, despite the fact that the host-based approaches reduce the overhead on the network, they require modification of the operating system in each host leading to scalability issues [22; 23; 24]. It is noteworthy that all approaches afore-cited perform a threshold-based HH identification. However, they lack a smart system that efficiently identifies HH according to the network behaviour; it means they are unaware of traffic in the network. In this paper, we propose a novel HH flow identification approach aiming at overcoming the lack above-mentioned and investigating the feasibility of using the Knowledge-Defined Networking (KDN) concept in the HH identification. KDN is a networking concept which takes advantage of Machine Learning (ML) techniques to improve several network management services. To the best of our knowledge, to date, there is no similar approach in the HH identification domain. Our approach is composed of three main modules: HH-Data Acquisition Module (HH-DAM), HH-Data ANalyser Module (HH-DANM), and HH-APplication Module (HH-APM). In particular, in HH-DAM, we present the flowRecorder tool [25] that is used for generating and organizing packets into flows records. Using this tool, we generated a dataset from publicly accessible university DCN traffic traces. In HH-DANM, we performed a cluster-based analysis to determine an optimal threshold that separates the flows into HHs and non-HHs. Through this analysis, we suggest the use of the flow size \(\theta_{\text{s}}=7\) KB, and packet count \(\theta_{\text{pkt}}=14\) as thresholds for HH classification. In HH-APM, we propose the use of MiceDCER to efficiently route non-HHs. MiceDCER results show that it can reduce the number of routing rules by installing wildcard rules based on the information carried by the Address Resolution Protocol (ARP) packets. In summary, the per-module evaluation results show the usefulness and feasibility of our KDN-based approach for identifying HHs smartly.