## 3 RAD System
### Main Modules of RAD System
#### 3.2.1 Traffic Analyzer  
We utilize an sFlow (short for \"sampled flow\") real-time tool, known as sFlow-RT, to detect elephant flows dynamically. The sFlow-RT is a well-known industry standard and incorporates the asynchronous analytics technology of InMon [40]. It thereby enables the real-time management of SDN to reduce network outages and the new classes of performance-aware applications (e.g., load balancing) to improve network performance. Furthermore, sFlow-RT provides network visibility, which is essential to understanding the interactions among scale-out services running on a cloud  
Figure 1: RAD system architecture. infrastructure [26]. The sFlow-RT analytics engine receives a continuous stream from sFlow agents embedded in network devices (e.g., network switches) and monitors traffic information (i.e., the occupied link bandwidth) to detect elephant flows. An _elephant flow_ is a long-living flow that occupies high bandwidth (e.g., 10% of the link bandwidth); the ratio to judge an elephant flow can be controlled. Based on the reports of data center networks, the majority of flows are short-lived latency-sensitive mice flows. They consume small portions of traffic. The other kind of flow is the bandwidth-sensitive elephant flow, which accounts for 80% of the traffic but constitutes only 10% of all flows [41]. Typical examples for elephant flows are large data transfer transactions such as VM migration, video streaming, or peer-to-peer file sharing, whereas mice flows occur in small web requests and VoIP calls. A flow can be categorized as an elephant flow if it occupies more than 10% of the NIC bandwidth or if it occupies a specific bandwidth (e.g., 10 Mbps). In the event of an elephant flow, sFlow-RT notifies the traffic engineer to reactively reroute the elephant flow. The traffic engineer then makes appropriate routing decisions by considering the available link capacity or delay. This ensures that the elephant flow is routed on a better path from that point and thus reduces congestion of regular short-lived mice flows. The rules for mice flows can be proactively installed and reactive flow rules are then used only to route elephant flows and to manage attacks, failures, and changes in topology. This hybrid approach of utilizing both proactive and reactive rule management in an OpenFlow-based network offers better scalability than a completely reactive flow rule management. sFlow-RT converts the received streams from sFlow agents into actionable metrics, which are accessible through the RestFlow API [42]. The RestFlow API facilitates configuring customized measurements, retrieving metrics, setting thresholds, and receiving notifications. Applications can be external, and thus written in any language that supports HTTP and REST calls, or internal, using the embedded JavaScript or ECMAScript of sFlow-RT. By combining network, host, and application monitoring within an integrated analytics pipeline, sFlow-RT provides visibility into applications as well as server and network resources needed to sustain performance. To detect attacks in networks, we use Snort Tool. Snort is a free and open source network intrusion prevention system and network intrusion detection system created by [PERSON] in 1998 [27]. Snort can perform real-time traffic analysis and packet logging on IP networks. Snort performs protocol analysis as well as content searching and matching in order to detect probes or attacks, including but not limited to operating system fingerprinting attempts, common gateway interfaces, buffer overflows, server message block probes, and stealth port scans. Snort can be configured in three main modes: sniffer, packet logger, and network intrusion detection. In sniffer mode, it reads network packets and displays them on the console. In packet logger mode, it logs packets to the disk. In intrusion detection mode, it monitors network traffic using a rule set defined by the user. Snort then performs a specific action based on what has been identified.