## 4 KDN-Based Heavy-Hitter Identification Approach
### Architecture and Modules
#### 4.2.2 Heavy-Hitters Data Acquisition Module  
HH-DANM is in charge of storing and generating a network traffic state model targeted to identify HHs smartly. To carry out this module, we performed a clustering-based analysis, on the \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Flow Size** & **TCP** & **[\%]** & **UDP** & **[\%]** & **Total** & **[\%]** \\ \hline \(\text{f}_{\text{s}}\leq 10\) KB & 74,915 & 25.48 & 175,029 & 59.54 & 249,944 & 85.02 \\ \(10\) KB \(<\text{f}_{\text{s}}\leq 100\) KB & 38,775 & 13.19 & 195 & 0.07 & 38,970 & 13.26 \\ \(100\) KB \(<\text{f}_{\text{s}}\leq 1\) MB & 4446 & 1.51 & 86 & 0.029 & 4532 & 1.54 \\ \(1\) MB \(<\text{f}_{\text{s}}\leq 10\) MB & 457 & 0.16 & 17 & 0.01 & 474 & 0.16 \\ \(\text{f}_{\text{s}}<10\) MB & 46 & 0.02 & 4 & 0.0 & 50 & 0.02 \\ \(\text{Total}\) & 118,639 & 40.4 & 175,331 & 59.6 & 293,970 & 100 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Flows size distribution obtained using \(f_{\text{it0}}=150\) s. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Flow Size** & **TCP** & **[\%]** & **UDP** & **[\%]** & **Total** & **[\%]** \\ \hline \(\text{f}_{\text{s}}\leq 10\) KB & 89,261 & 33.07 & 180,581 & 57.2 & 269,842 & 85.47 \\ \(10\) KB \(<\text{f}_{\text{s}}\leq 100\) KB & 40,165 & 12.72 & 378 & 0.12 & 40,543 & 12.84 \\ \(100\) KB \(<\text{f}_{\text{s}}\leq 1\) MB & 4697 & 1.49 & 115 & 0.036 & 4812 & 1.52 \\ \(1\) MB \(<\text{f}_{\text{s}}\leq 10\) MB & 437 & 0.14 & 21 & 0.007 & 458 & 0.145 \\ \(\text{f}_{\text{s}}<10\) MB & 43 & 0.013 & 3 & 0.001 & 46 & 0.14 \\ \(\text{Total}\) & 134,603 & 42.63 & 181,098 & 57.36 & 315,701 & 100 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Flows size distribution obtained using \(f_{\text{it0}}=15\) s.  
UNIV1 dataset, targeted to determine the optimal threshold that would separate the flows into HHs and non-HHs. We performed this analysis since there is no generally accepted and widely recognised uniform threshold for HHs detection. Indeed, different works use different thresholds without detailed or systematic justification. Some examples of such unjustified citation chains include [PERSON] et al. [66], [PERSON] et al. [67]\(\Rightarrow\) [PERSON] et al. [68]\(\Rightarrow\) [PERSON] et al. [69]; [PERSON] et al. [62]\(\Rightarrow\) [PERSON] et al. [70]\(\Rightarrow\) [PERSON] et al. [71]; and [PERSON] [15] [PERSON] et al. [2]\(\Rightarrow\) [PERSON] et al. [64]. Cluster analysis belongs to unsupervised ML techniques. It examines unlabelled data by either constructing a hierarchical structure or forming a set of groups. Data points belonging to the same cluster exhibit features with similar characteristics. In HH-DANM, we have decided to use K-means mainly because of its simplicity, speed, and accuracy. In addition, several research works report on its high efficacy when deployed on network traffic data [50]. There are several methods to determine the optimal number of clusters that K-means needs to operate, such as V-measure, Adjusted rank Index, V-score, and Homogeneity [72]. However, these methods are usually used with labelled datasets. Since our datasets are not labelled, we have decided to use the Silhouette score that does not require labelled data. In addition, the Silhouette method was also shown to be an effective approach for determining the number of clusters in data as well as for validation by [PERSON] [36] and [PERSON] [73]. In HH-DANM, we applied the Silhouette method by varying \(k\) from 2 to 15. This method uses a coefficient (\(S_{i}\)) that measures how well a point is clustered and estimates the average distance between clusters. The values of \(S_{i}\) range between -1 and 1. The closer the values are to 1, the better the points are clustered. As Figure 4 shows, in our analysis the \(S_{i}\) range is quite wide, with values that vary between 0.6 and the maximum, 0.99. In both \(f_{ito}\) = 15 s and \(f_{ito}\) = 150 s, the possible optimal \(k\) is between \(k\) = 2 to \(k\) = 11.