A sketch is a probabilistic data structure that can accurately estimate massive network traffic with a small memory overhead. To improve the measurement accuracy, most sketch-based schemes separate elephant flows from mouse flows to accommodate the skewed network traffic. However, the increased algorithmic complexity often results in a sacrifice of measurement throughput. In addition, some improved sketches may be over-reliant on the skewed distribution of traffic, which results in unstable accuracy. To this end, a novel sketch, called Air Sketch, is proposed in this paper. It treats flows of different sizes as air with different temperatures. Meanwhile, a deterministic replacement strategy is applied to elephant flows. In order to improve throughput, an asymmetric insertion and query algorithm with a global hash is designed. The performance of Air Sketch is evaluated using real traffic transaction datasets, anonymized internet traces, and synthetic Zipf datasets. The experimental results demonstrate that Air Sketch can outperform the best typical measurement methods by up to 27 times in flow size measurement and up to 40 times in elephant flow detection. Additionally, Air Sketch achieves high accuracy and stability while achieving high insertion and query throughput.

Cyberattacks such as DoS and DDoS can block or delay data communications in microgrid networks, thereby impairing the control of power electronic converters. These attacks motivate the measurement of heavy hitters and super-spreaders in microgrid network traffic. Both measurement tasks commonly rely on sketches, a class of probabilistic data structures. The two tasks nevertheless impose conflicting requirements: super-spreader detection ignores duplicate items in data stream statistics, while heavy hitter detection retains flows with many duplicate items. Consequently, an existing sketch-based scheme generally specializes in one task even though a data stream may contain both traffic classes. DualMeasure Sketch (DMS) is proposed to resolve this conflict. DMS distinguishes super-spreaders from heavy hitters dynamically and maintains them separately, allowing both to be detected accurately at the same time. CPU and OVS platform implementations are used for performance evaluation. Experimental comparison with the state-of-the-art sketches shows concurrent support for both tasks. On CAIDA19 with 1 MB memory, DMS improves super-spreader F1-score by up to 40% and reduces heavy-hitter error by up to 80% compared with dedicated state-of-the-art sketches. In joint deployment on CAIDA19 with 1 MB total memory, DMS improves throughput by about 12% over Combine Sketch.