## 4 KDN-Based Heavy-Hitter Identification Approach
### Architecture and Modules
#### 4.2.2 Heavy-Hitters Data Acquisition Module
Both UNIV1 with \(f_{ito}\) = 15 s and \(f_{ito}\) = 150 s, got the highest \(S_{i}\) for \(k\) = 2. With \(k\) = 2, there is a significant distance between classes, as Figure 5b,f shows by the Principal Component Analysis (PCA) that performs linear transformations process resulting in primary components [36]. However, despite the promising \(S_{i}\) value and the evident distance between the classes, the imbalance between clusters is also evident, i.e., one cluster contains a large number of flows while the other, extremely few. The specific numbers of this distribution are provided in Table 5. This distribution can produce an important deterioration of the classifier performance in particular with patterns belonging to the less represented classes. Figure 4: Silhouette coefficients for UNIV1 with \(f_{ito}\)= 15 s and \(f_{ito}\) = 150 s.  
Figure 5: Visualisation of UNIV1 \(f_{flu}=150\) s and \(f_{flu}=15\) s along the two first principal components: (**a**) UNIV1 \(f_{flu}=150\) s; (**b**) UNIV1 \(f_{flu}=150\) s, \(k=2\); (**c**) UNIV1 \(f_{flu}=150\) s, \(k=5\); (**d**) UNIV1 \(f_{flu}=150\) s, \(k=10\); (**e**) UNIV1 \(f_{flu}=15\) s; (**f**) UNIV1 \(f_{flu}=15\) s, \(k=2\); (**g**) UNIV1 \(f_{flu}=15\) s, \(k=5\); (**h**) UNIV1 \(f_{flu}=15\) s, \(k=10\). Another promising \(S_{i}\) value is for k = 5, in which for both datasets it is almost 1. We applied K-means clustering with \(k\) = 5. Figure 5c,g show PCA with \(k\) = 5. Our analysis focuses on the relationship between statistical features of the flows, in particular, their size, number of packets, and duration. Table 5 summarises the relationship between them. While \(k\)= 5 provides better results than clustering with \(k\) = 2, in terms of flow distribution, the imbalance is still noticeable. The results show class I as the most dominant class while class II to V seem to be outliers. This distance is evident from both Figure 5c,g as well as in Table 6.  
We also performed the cluster analysis using \(k\) = 10. The new clusters seem to appear by splitting the old classes, in particular classes II to V. However, as Figure 5d,h show, the flows belonging to class I seems to keep the same shape and number of flows. This motivated us to analyse class I in detail. The analysis of flows belonging to class I followed the same steps that were applied previously. We have decided to use \(k\) = 5. Table 7 summarises the results that were obtained. Overall, the results show there is no clear threshold that separates flows into HHs and non-HHs. This is because the flow sizes have a diverse character that leads to more than two natural clusters. We stress that the threshold selection should include a detailed analysis of the network and its traffic. However, a pattern in the clusters I, II, IV, and V regarding flow size and the number of packets is evident, as Table 7 shows. Therefore, we suggest the use of the following thresholds for HH identification in traffic similar to UNIV1, [PERSON] et al [74]: flow size \(\theta_{s}\) = 7 KB and packet count \(\theta_{pkt}\) = 14.