## 4 System Design and Analysis
### Synergetic Software-defined Sampling and Detection Approach
#### 4.1.2 Self-Adaption Sampling  
Almost all of the conventional sampling schemes rely on fixed period (e.g., NetFlow) or a fixed percentage (e.g., Hedera). The advantages of these two fixed samplings are reducing the sampling operation overhead of the switch and facilitating the deployment of the sampling strategy. However, the disadvantage is missing important data packets.  
If the purpose of sampling is long flow detection, a self-adaption sampling approach can adjust the sampling rate dynamically according to the packet arrival rate and the length of the sampled queue. It is generally believed that the abnormal increase of network traffic is usually caused by long flow transmission. Therefore, the increase in packet arrival rate implies that a potentially long flow is generated and being transmitted. For ease of deployment, Sonum cannot take up too much storage resources. The queue length indicates the number of statistics in a table. As the sampling progresses, queue length also fluctuates. The increase in the average queue length means that the number of statistics has been added to the already established list. The decrease in the average queue length means that the new sample item is established.  
Taking into account the above two parameters, we have established a formula for the relationship between the two parameters and the sampling rate. First, the synergetic software-defined sampling approach windowed historical sampling rate data.  
\[R=\{v_{1},v_{2},...,v_{p}\} \tag{5}\]  
where \(p\) is the window size, and \(v_{i}\) is the sampling rate when \(t=i\). Then this approach calculates the statistical average of the packet arrival rate and the average queue length in the window period, which are \(\bar{r}\) and \(\bar{I}\). According to the change of packet arrival rate and queue length at the latest sampling time, this approach determines the sampling rate for the next cycle, as shown in the Equation (6).  
\[R_{p+1}=\frac{R_{p}}{2}(\frac{r_{p}}{\bar{r}}+\frac{l_{p}}{\bar{I}}) \tag{6}\]  
where \(R_{p}\) is the sampling rate of the previous sampling period. As long flow detection needs to meet the demands of the traffic characteristics, the sampling rate should not be too slow. To make the sampling rate adjustment smoother, this approach uses the rate adjustment by means of an Exponentially Weighted Moving Average (EWMA) [41], as shown in Equation (7). EWMA is a commonly used method of sequential data processing. By weighting historical data and recent observations, EWMA makes the rate adjustment smoother, avoiding the situation that the sampling rate is repeatedly adjusted due to the rapid change of the packet rate.  
\[R_{p+1}^{EWMA}=\lambda\cdot R_{p+1}+(1-\lambda)\cdot R_{p},0<\lambda<1 \tag{7}\]  
where \(\lambda\) is the smoothing parameter. The bigger \(\lambda\) is, the sampling adjustment function is more concerned with the latest sampling data. The complete Rate Adjustment Algorithm is described in Algorithm 1.  
```
0: Historical sampling rate data \(R\), Smoothing parameter \(\lambda\)
0: Next sampling rate data \(R_{p+1}\)
1: Calculate \(R_{p+1}\) according to Equation (6);
2:if\(R_{p+1}\
eq R_{p}\)then
3: Calculate \(R_{p+1}^{EWMA}\) according to Equation (7);
4:\(R_{p+1}=R_{p+1}^{EWMA}\);
5:else
6:\(R_{p+1}=R_{p}\);
7:endif
8: Return \(R_{p+1}\);
```  
**Algorithm 1** Rate adjustment algorithm (RAA)