Knowledge Discovery: Can It Shed New Light on Threshold Definition for Heavy-Hitter Detection?

Heavy-Hitter (HH) flows are well-known in the field of networking, mainly due to their resource consumption, which is considerably higher than the majority of flows. Their reliable detection and management are critical to optimising network performance. Nevertheless, to date, there is no generally accepted and widely used methodology for HH threshold selection. Indeed, different works use distinct thresholds without the support of a detailed or systematic study. In this paper, we provide useful insights and suggestions on how to determine more justified and valid thresholds. Based on the obtained results, we conclude that no threshold can be used universally to separate flows into HHs and non-HHs. A threshold that performs efficiently in one network may underperform in another. Threshold and HH definitions are often application-dependent, and therefore, threshold selection should include a detailed analysis of the network and its traffic. We also highlight that TCP and UDP flows should be classified with different thresholds because HHs exhibit different characteristics in such protocols. Lastly, we point out that the use of more than one threshold leads to accuracy and efficacy improvements in HHs classification.