Active elephant flows, which indicate the real-time data transmission status, are of primary interest in network management and various applications. However, existing network measurement efforts mainly focus on finding elephant flows, and limited works on identifying active elephant flows suffer from low accuracy and heavy overheads. To address this issue, this paper proposes ActiveGuardian to identify active elephant flows with high accuracy, low memory, and high throughput. The key idea is to intelligently separate potential elephant flows from mice flows, and guard and report the information of active elephant flows in every time window. To obtain high accuracy, we devise a filtering module that adaptively filters unnecessary flows with low arrival rates, by applying an strategy. To achieve high memory utilization, we design a algorithm for the guarding module to effectively solve hash collisions. Lastly, we perform theoretical derivation on the false positive and the error bound of ActiveGuardian, and experimental evaluations on its performance with real network traffic traces. The experimental results show that ActiveGuardian achieves higher accuracy (99.65%) with identical memory sizes, and higher throughput (26.53Mps) than the state-of-the-art solutions.

中文翻译：

---

ActiveGuardian：一种准确高效的算法，用于识别网络流量中的活跃大象流

活跃大象流指示实时数据传输状态，是网络管理和各种应用中最受关注的。然而，现有的网络测量工作主要集中在寻找大象流，而识别活跃大象流的工作有限，精度低且开销大。为了解决这个问题，本文提出了ActiveGuardian，以高精度、低内存和高吞吐量来识别活跃的大象流。关键思想是智能分离潜在的大象流和老鼠流，并在每个时间窗口内监视和报告活跃大象流的信息。为了获得高精度，我们设计了一个过滤模块，通过应用策略自适应过滤到达率低的不必要的流。为了实现高内存利用率，我们为保护模块设计了一种算法来有效解决哈希冲突。最后，我们对ActiveGuardian的误报和错误界限进行了理论推导，并通过真实的网络流量轨迹对其性能进行了实验评估。实验结果表明，与最先进的解决方案相比，ActiveGuardian 在相同内存大小的情况下实现了更高的准确度 (99.65%) 和更高的吞吐量 (26.53Mps)。