# MSLCFinder: An Algorithm in Limited Resources Environment for Finding Top-\(k\) Elephant Flows
## 4 Evaluation
### Experimental Settings and Datasets  
**Platform**: We use a laptop with 4-core CPUs (8 threads, Intel Core i7-4940 MX @3.10 GHz) and 32 GB total system memory to complete the development and implementation of the algorithm this paper. We also use it to complete our experiments.  
**Dataset**: We use three datasets to perform the experiment. All information of datasets is shown in Table 2.  
(1) CAIDA-2018 [44]: The first dataset is a CAIDA Anonymized Internet Trace from 2018, made of anonymized IP packets. It has 27,121,713 packets belonging to 1,000,551 flows.  
(2) CERNET-30 and CERNET-60 [45]: The second and third datasets comprise IP packets captured from the CERNET Backbone Node of East China and North China at different dates. For ethical reasons, we anonymized the IP information to a certain extent. The collection time of CERNET-30 is 30 minutes in the peak period, and the data size is about 35 GB, including 17,596,416 packets, about 11,941,109 flows in total. The collection time of CERNET-60 is one hour in the off-peak period, and the data size is about 46 GB, including 32,674,187 packets, with a total of about 16,082,037 flows.  
As shown in Table 3, we roughly compared the flow size distribution of the three datasets, selected the samples with the first 100 flow lengths, and analyzed the maximum, minimum, variance, and standard deviation of the flow size distribution. Our work aims to illustrate the influence of flow size distribution on our proposed method.  
**Implementation**: The implementation of MSLCFinder is performed in C++. For the hash function, we use the improved IPSX [15] algorithm to support different measurement task requirements. To achieve at least 95% precision, we can calculate \(d=3\) by Formula (11). The total space cost is fixed as \(2^{20}\text{bit}=1\text{ Mbit}=128\text{ KB}\), and the counter size is fixed as \(n=8\text{ bit}\). There are two selected measurement tasks. One is to output the source IP and destination IP of top-\(k\) flows, and the other is to output the quintuple information of top-\(k\) flows.  
The total number of counters is determined by the total memory space (1 Mbit), the \(k\)-value of the top-\(k\) task, and the size of the measure required for the final maintenance  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Name** & **Number of Packets** & **Number of Flows** \\ \hline CAIDA-2018 & 27,121,713 & 1,000,551 \\ CERNET-30 & 17,596,416 & 11,941,109 \\ CERNET-60 & 32,674,187 & 16,082,037 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Information about the experimental datasets.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Name** & **Maximum** & **Minimum** & **Variance** & **Standard Deviation** \\ \hline CAIDA-2018 & 460,200 & 15,982 & \(\approx\)3.99 \(\times\) 10\({}^{9}\) & \(\approx\)6.29 \(\times\) 10\({}^{4}\) \\ CERNET-30 & 1,334,369 & 6568 & \(\approx\)1.77 \(\times\) 10\({}^{10}\) & \(\approx\)1.32 \(\times\) 10\({}^{5}\) \\ CERNET-60 & 537,966 & 12,808 & \(\approx\)1.16 \(\times\) 10\({}^{10}\) & \(\approx\)1.07 \(\times\) 10\({}^{5}\) \\ \hline \hline \end{tabular}
\end{table}
Table 3: The flow size distribution information about the experimental datasets.  
of the top-\(k\) flow information table. To improve the versatility in different measurement tasks, we can also use half of the total memory to support the measurement function of MSLCFinder, and the other half of the memory to record and maintain the top-\(k\) flow information required in measurement tasks. However, if the available memory is abundant, it is unnecessary to provide half of the memory resources for recording and maintaining the top-\(k\) flow information.