Open Access

ARTICLE

SP-Sketch: Persistent Flow Detection with Sliding Windows on Programmable Switches

Yuqian Huang¹, Luyi Chen², Zilun Peng¹, Lin Cui^1,*

1 Department of Computer Science, Jinan University, Guangzhou, 510632, China
2 Department of ICNOC, China Telecom Corporation Shenzhen Branch, Shenzhen, 518000, China

* Corresponding Author: Lin Cui. Email:

Computers, Materials & Continua 2025, 84(3), 6015-6034. https://doi.org/10.32604/cmc.2025.066717

Received 15 April 2025; Accepted 10 July 2025; Issue published 30 July 2025

Abstract

Persistent flows are defined as network flows that persist over multiple time intervals and continue to exhibit activity over extended periods, which are critical for identifying long-term behaviors and subtle security threats. Programmable switches provide line-rate packet processing to meet the requirements of high-speed network environments, yet they are fundamentally limited in computational and memory resources. Accurate and memory-efficient persistent flow detection on programmable switches is therefore essential. However, existing approaches often rely on fixed-window sketches or multiple sketches instances, which either suffer from insufficient temporal precision or incur substantial memory overhead, making them ineffective on programmable switches. To address these challenges, we propose SP-Sketch, an innovative sliding-window-based sketch that leverages a probabilistic update mechanism to emulate slot expiration without maintaining multiple sketch instances. This innovative design significantly reduces memory consumption while preserving high detection accuracy across multiple time intervals. We provide rigorous theoretical analyses of the estimation errors, deriving precise error bounds for the proposed method, and validate our approach through comprehensive implementations on both P4 hardware switches (with Intel Tofino ASIC) and software switches (i.e., BMv2). Experimental evaluations using real-world traffic traces demonstrate that SP-Sketch outperforms traditional methods, improving accuracy by up to 20% over baseline sliding window approaches and enhancing recall by 5% compared to non-sliding alternatives. Furthermore, SP-Sketch achieves a significant reduction in memory utilization, reducing memory consumption by up to 65% compared to traditional methods, while maintaining a robust capability to accurately track persistent flow behavior over extended time periods.

---

Keywords

---