Approximate Discovery of Service Nodes by Duplicate Detection in Flows

Knowledge about which nodes provide services is of critical importance for network administrators. Discovery of service nodes can be done by making full use of duplicate element detection in flows. Because the amount of traffic across network is massive, especially in large ISPs or campus networks, we propose an approximate algorithm with Round-robin Buddy Bloom Filters(RBBF) for service detection using NetFlow data solely. The properties and analysis of RBBF data structure are also given. Our method has better time/space efficiency than conventional algorithm with a small false positive rate.%portion of false positive. We also demonstrate the contributions through a prototype system by real world case studies.