Gil Einziger

Sampling is a fundamental method to detect traffic anomalies. However, some traffic anomalies (E.g., micro-bursts) require high sampling rates to identify. Unfortunately, current NFV deployments cannot cope with high sampling rates for a prolonged duration of time. Therefore, our work augments Open vSwitch nodes with a light-weight change detection algorithm that determines when to amplify the sampling ratio to detect traffic anomalies. Our preliminary results on real Nokia lab data demonstrate the potential in this method.