# MSLCFinder: An Algorithm in Limited Resources Environment for Finding Top-\(k\) Elephant Flows
## 5 Conclusions  
Finding the top-\(k\) elephant flows is critical for network traffic measurement, especially with resource constraints. As the network traffic overgrows, finding top-\(k\) flows with limited resources is challenging. In order to overcome the mutual restriction of hardware resources, massive data, and measurement precision, we adopt a novel strategy called _count-with-uth-level-sampling_. Moreover, we propose a novel core component named Multi-Sampled Lightweight Counting Finder (MSLCFinder) to achieve a measurement scheme for finding top-\(k\) flows based on hardware resource-constrained environments. The MSLCFinder has three primary modules: a lightweight counting module, a multi-sampling module, and a flow label recording module. Three modules complement and constrain each other to maximize the optimization of the MSLCFinder in the measurement task. The essential technique of MSLCFinder is that it uses a \(u\)th-level multi-sampling module to relieve the storage pressure of the MSLCFinder, and also reduces the possibility of the mouse flows being recorded by the flow label recording module. Our evaluation confirms that MSLCFinder can achieve more than 97% precision. With MSLCFinder that we proposed, we can effectively find top-\(k\) elephant flows with less memory overhead and counters under resource constraints. Although the MSLCFinder can achieve good measurement results with small hardware resources, experiments show that this overhead is still high, especially in the flow label recording module. Therefore, in future research, we have the following issues that need to be further studied and optimized: (1) We first need to improve the efficiency of MSLCFinder, including updating the technology and methods at this stage, reconstructing core record data structure instead of min-heap to achieve a faster, more efficient, and more concise recording algorithm. (2) Our _count-with-uth-level-sampling_ strategy can sample each flow for many continuous arriving flows in the network before the finder counts. Compared with the _count-all_ strategy, it achieves a certain degree of filtering effect on mouse flows, but the accuracy of the strategy in filtering mouse flows needs further research and discussion. Therefore, we need to introduce effective filtering strategies in future work to improve the utilization of memory resources and the accuracy of identifying top-\(k\) elephant flows. (3) The initial sampling threshold \(\theta\) has a decisive influence on the global measurement results. Determining how to generate sampling threshold \(\theta\) based on flow adaptation or self-learning is the focus of our future research. (4) This paper only focuses on identifying elephant flow in network measurement, ignoring the identification of mouse flow. In the actual network environment, the traffic information of many attacks (such as DDoS attacks) in the network is composed of mouse flows. Based on the distribution characteristics of network traffic, it can be seen that many mouse flows in high-speed network links cannot be accurately monitored in real time. Therefore, in future work, we will continue to study how to identify mouse flow accurately. (5) In future research, we plan to design a machine learning or integrated learning method to adaptively calculate the initial sampling threshold for per-flow according to the traffic distribution in the current network environment to be tested to replace the current single global threshold scheme. (6) We will continue developing parallel hardware versions of MSLCFinder to achieve more efficient measurement results. Conceptualization, X.D. and G.C. ; methodology, X.D. and R.Z. ; software, X.D. and Z.Y. ; validation, X.D. and G.C. ; formal analysis, X.D. and Z.Y. ; investigation, X.D. and R.Z. ; resources, Z.Y. and R.Z. ; data processing, Z.Y. and X.D. ; writing--original draft preparation, X.D. ; writing--review and editing, X.D. and Y.Y. ; visualization, X.D. ; supervision, G.C. ; project administration, G.C. ; funding acquisition, G.C.