Pith. sign in

REVIEW 3 major objections 5 minor 34 references

ResidualSketch: Enhancing Layer Efficiency and Error Reduction in Hierarchical Heavy Hitter Detection with ResNet Innovations

T0 review · 3 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read ResidualSketch claims to stop gradual error diffusion in hierarchical heavy-hitter detection by wiring APK-based sketches at pivotal prefix layers with ResNet-style residual connections.

desk verdict ResidualSketch is a plausible engineering hybrid, but the central unbiasedness theorem does not hold for the algorithm as implemented. read the letter →

arxiv 2505.12445 v1 pith:MNAHQ5VA submitted 2025-05-18 cs.DS

Xilai Liu , Yuxuan Tian , Xiangyuan Wang , Yuhan Wu , Wenhao Wu , Tong Yang , Gaogang Xie This is my paper · ORCID
classification cs.DS
keywords hierarchicalheavyhitterdatastreamsketchresidualconnectiongradualerrordiffusionnetworkmeasurementfrequencyestimationIPprefixhierarchy
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

ResidualSketch is a data-stream algorithm for detecting Hierarchical Heavy Hitters (HHH), the traffic aggregates from individual IP addresses up to subnets that dominate a network link. Its central claim is that placing Arbitrary Partial Key (APK) sketches at a few pivotal prefix lengths and connecting them with ResNet-style residual connections halts the Gradual Error Diffusion that makes subnet-level estimates drift in earlier methods, while removing duplicate counting so memory stays small. The paper argues the estimator is unbiased for any flow prefix, uses $O(L/\epsilon)$ space with $O(L)$ update cost in the worst case, and reports higher F1 and lower average relative error than prior HH-based and APK-based algorithms on real and synthetic traces. If correct, this gives network operators a way to spot DDoS-style aggregation points under tight memory and line-rate update constraints.

What carries the argument

The central mechanism is the pair of a Residual Block and a Residual Connection. A Residual Block is an APK-based sketch, such as USS or CocoSketch, assigned to a contiguous range of prefix layers $[l_i, l_{i+1})$; it estimates counts for all keys whose prefixes fall in that range. The Residual Connection is the rule that once a flow's estimated value crosses a fixed threshold $\theta_i$ in a lower block, the flow is marked so it cannot be evicted, its count is subtracted from its ancestor bucket in the next higher block, and the flow is not forwarded upward. This is the mechanism that is supposed to break the cascade of sampling variance underlying Gradual Error Diffusion and to prevent the same heavy flow from being recorded in multiple hierarchy levels.

What would settle it

Run a two-level ResidualSketch with threshold $\theta=50$, insert a single flow of true size $150$ so it locks at the lower level, and then query its upper-level prefix: Algorithm 1 subtracts $50$, not $150$, from the ancestor bucket, so repeated runs should return an estimate near $100$ rather than $150$, a bias that disproves the unbiasedness claim.

Watch

Extended reading notes

Core claim

The paper's central claim is that ResidualSketch mitigates Gradual Error Diffusion by rebuilding the sketch at selected layers of the IP hierarchy: each Residual Block is an APK-based sketch (Unbiased Space Saving or CocoSketch) that owns a range of prefix lengths, and each Residual Connection removes a heavy flow's contribution from upper blocks once it has been counted below, so only residual counts travel upward. Theorem 1 asserts that the resulting estimate $\hat{V}_{f_p}$ of any flow key $f_p$ at prefix length $p$ is unbiased, $\mathbb{E}(\hat{V}_{f_p}) = V_{f_p}$. The experiments report that ResidualSketch with CocoSketch raises F1 by about five percentage points over CocoSketch on CAIDA and by up to twenty-six points on a synthetic set, cuts average relative error to a fifth or a tenth, holds memory to a few hundred kilobytes, and raises throughput from 21.73 to 29.2 million packets per second when residual connections are enabled.

Load-bearing premise

The unbiasedness proof assumes that when a heavy flow is connected upward, the upper-layer prefix bucket loses exactly that flow's own count, but the implemented algorithm decrements the bucket by a fixed threshold value instead, so the theorem's equality does not follow from the pseudocode as written.

Editorial extensions

If this is right

  • If the central claim is correct, operators can monitor subnet-level aggregates with a few hundred kilobytes of memory, avoiding per-layer duplicate storage.
  • DDoS-style attacks that concentrate at particular prefix lengths become visible at the aggregation point rather than being masked by accumulated sampling error.
  • The update path stays fast: each level is a constant-time hash update plus a threshold check, giving worst-case $O(L)$ updates and smaller actual cost once large flows lock.
  • Two or three levels placed at natural prefix clusters ($/32$, $/24$, $/12$) capture most of the benefit, while four levels degrade because memory per level shrinks.
  • The same structure can be carried to 2D source-destination and sliding-window HHH settings, where the paper argues multi-level placement helps most.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A direct repair of the threshold-decrement gap would be to decrement upper buckets by the flow's exact residual count, which would make Theorem 1 match Algorithm 1 at the cost of storing per-flow counts for locked keys.
  • The method's gains should be largest on skewed traffic with heavy flows clustered at a few prefix lengths; on uniform or adversarial streams the residual connections may remove little while the extra levels add overhead.
  • If Gradual Error Diffusion really scales with the number of small flows composing an upper-level heavy hitter, then the optimal level placement should track the empirical HH-clustering curve, and datasets without such clustering should erase the advantage.
  • A natural stress test is a stream engineered so that many distinct large flows share one prefix; the fixed-threshold decrement would then show up as a systematic downward bias in that prefix's estimated count.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes ResidualSketch, a hierarchical heavy hitter (HHH) detection algorithm that combines APK-based sketches at a small number of 'residual block' levels in the IP prefix hierarchy with a 'residual connection' mechanism intended to remove duplicate counts of heavy flows from higher levels. The authors claim that this design mitigates gradual error diffusion (GED), reduces memory overhead, and provides unbiased estimates for arbitrary flow keys (Theorem 1). Experiments on CAIDA, MAWI, Campus, and a synthetic dataset compare ResidualSketch against HH-based and APK-based baselines and report improved F1 and ARE at comparable or lower memory.

Significance. If the theoretical and empirical claims were sound, ResidualSketch would be a useful improvement for online HHH detection, because it would combine the memory efficiency of APK sketches with improved accuracy at subnet levels and low update latency. The paper has real strengths: it addresses a practically important problem, uses multiple real-world datasets, compares against several representative baselines, reports throughput, and makes code available. However, the central unbiasedness proof is not consistent with the implemented residual connection, and the evaluation gives the proposed method favorable level placement; these issues undermine the paper's main claims and prevent acceptance in the current form.

major comments (3)
  1. [§IV.C (Theorem 1) and §III.A (Algorithm 1)] The proof's central equality E(V̂_fp)=Σ_{e∈D∪H}E(V̂_e)=Σ_{e∈D∪H}V_e assumes that a residual connection removes exactly a descendant heavy flow's full count from the upper-level estimate. Algorithm 1 (lines 6-7 and 17-20) instead subtracts the fixed threshold θ_i from the matching upper bucket when the lower-level count equals θ_i, and then stops forwarding the flow. Because the upper bucket is an aggregate shared by many keys, this bucket-level decrement also reduces the estimate for any other prefix hashing to the same bucket. The query-time 'restore' mentioned in Section III.A is not specified or analyzed in the proof, and the estimator V̂_fp is never formally defined, so the unbiasedness claim for arbitrary flow keys does not follow from the algorithm as written.
  2. [§V.A (Synthetic Dataset) and §V.B.2 (Comparison with APK-based Sketches)] The synthetic benchmark replaces the top 1000 IPs with random IPs 'engineered to aggregate into HHs at prefix lengths 20 to 24,' and ResidualSketch is then configured with levels at 12, 24, and 32. This places a residual block exactly at the injected cluster, making the comparison favorable by construction. The real-trace level settings (e.g., layers 12 and 32 on CAIDA) are also chosen after inspecting the HH-ratio clusters in Figure 5. To support the claimed general improvement, the paper should evaluate level configurations that are not aligned with the injected or observed clusters and report sensitivity to level positions.
  3. [§III.B (Level Setting) and §V.C (Impact of Algorithm Parameters)] The algorithm's performance depends on several free parameters—the number and positions of residual blocks, the per-level memory allocation, and the residual threshold θ_i—but the experimental section only sweeps the number of levels (Figure 11) and total memory (Figure 12). The residual threshold θ_i is never varied, and the level positions are fixed at 12, 24, and 32 based on observed cluster structure. Without a sensitivity analysis over these parameters, the reported gains cannot be attributed to the residual design rather than to carefully chosen settings.
minor comments (5)
  1. [§IV] The heading 'Unbiasness' and the proof text use a nonstandard spelling; it should be 'Unbiasedness'.
  2. [§IV.C] Theorem 1 should define the estimator V̂_fp explicitly, for example as a function of the bucket values at the relevant level, before stating the unbiasedness result.
  3. [§III.A (Algorithm 1)] The pseudocode reads 'cnt' on lines 17 and 19 before it is assigned on line 22; although the first iteration avoids the read, initializing 'cnt' before the loop would make the control flow clearer.
  4. [Throughout] The naming is inconsistent: 'Cocosketch', 'CocoSketch', and 'COCO' are all used; please standardize to one form.
  5. [References] Reference [33] points to a generic GitHub repository name; please ensure the link resolves to the exact version of the code used in the experiments.

Circularity Check

2 steps flagged · score 6.0 of 10

Experimental GED validation is fitted rather than predictive: residual-block layers are chosen from the same HH-cluster distributions at test time, and the synthetic test injects its cluster at exactly the layer where a residual block is placed.

  1. fitted input called prediction [Section III.B (Level Setting) and Section V.B.2 (APK comparison, CAIDA/synthetic)]
    "The level number and its corresponding range are selected according to the potential for HHH cluster formation. we hypothesize the existence of three cluster ranges: ... A cluster with a layer of prefix length near 24 ... As illustrated in Figure 5, large backbone networks demonstrate attributes that align with the previously described cluster formations. In light of this observation, we recommend adopting either a 2 or 3 level hierarchy. ... For ResidualSketch, we set two levels on layer12and32for CAIDA dataset and three levels on layers12,24and32on synthetic dataset."

    The claimed benefit is that Residual Blocks at 'crucial layers' reset error diffusion. The crucial layers are not fixed a priori; they are chosen after inspecting the HH-ratio distribution on the evaluation traces (Figure 5) and, for the synthetic trace, after knowing that the injected HHs aggregate at prefixes 20-24. The subsequent F1/ARE comparison then demonstrates improvement at the configuration that was fitted to the same data. This is parameter fitting presented as validation: the GED-mitigation result is a property of the chosen configuration, not an independent prediction.

  2. fitted input called prediction [Section V.A (Synthetic Dataset) and Section V.B.2 (Experimental Results on Synthetic, Figure 9)]
    "Synthetic Dataset: ... we replaced the top 1000 IPs from the CAIDA dataset, representing54%of traffic, with randomly generated IPs. These IPs are engineered to aggregate into HHs at prefix lengths 20 to 24, enabling effective accuracy assessment of competing algorithms. ... Residual+COCO stands out as the most effective, achieving an F1 score exceeding87%and an ARE of less than0.005. This represents a26%improvement in F1 score over COCO, with the ARE being one-tenth of COCO's."

    The synthetic benchmark is constructed so that the ground-truth HHs concentrate in prefix-length range 20-24, and ResidualSketch is configured with a residual block at layer 24 (along with 12 and 32). The comparison therefore measures the algorithm on a distribution engineered to match its own level placement. The large F1/ARE win and the layer-wise GED comparison in Figure 9 are forced by this alignment between the injected cluster and the chosen residual-block position, rather than by a prediction from an independently specified design.

full rationale

The paper's central unbiasedness theorem is not circular but is internally unsupported: the proof writes E(V̂_fp)=Σ_{e∈D∪H}V_e=V_fp without accounting for Algorithm 1's threshold subtraction (B_i.v ← max(0,B_i.v−θ_i)) and for the fact that a flow at the threshold is no longer forwarded, so the upper-level bucket is systematically short by about V_e−θ_i per heavy descendant. I flag this as a correctness gap, not a circular step. The self-citations to CocoSketch/Hyper-USS are used as base-sketch building blocks and do not by themselves make the ResidualSketch claim self-referential. The genuine circularity is in the evaluation: the 'crucial layers' that define the method are chosen from the same traces that are later used to demonstrate GED mitigation, and the synthetic trace is injected with HHs at the very prefix range where a Residual Block is then inserted. The headline empirical claim therefore reduces, in the reported experiments, to a configuration fitted to the evaluation distribution. That warrants a partial-circularity score of 6, not a higher score, because the algorithm construction and the attempted theoretical analysis contain independent content beyond the fitted layer choice.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The design depends on four load-bearing premises: level count and positions, residual threshold, memory division, and the assumption that residual connections act as exact conditional-count subtraction. The last is the most consequential because it is the central step in the unbiasedness proof and is not true of the algorithm as written.

free parameters (3)
  • Number and layer positions of residual blocks = L=2 at layers 12 and 32 for CAIDA; L=3 at layers 12, 24, 32 for synthetic
    Chosen per dataset from observed cluster structure in Figure 5; no data-independent rule is given.
  • Residual connection threshold theta_i = Example uses 50; otherwise 'slightly lower than the general threshold setting of HH'
    Controls when a flow is locked in a lower level and subtracted from upper levels; the proof's exact-removal assumption depends on a value that is not specified.
  • Per-level memory allocation = Equal memory per level, e.g., 256KB total split across levels
    Chosen for simplicity in Section III-B; alternative allocations could change the accuracy and memory tradeoff.
assumptions (4)
  • standard math A PPS sampling update with replacement probability v/(v+Bmin.v) makes the updated key's estimate unbiased in expectation.
    Used in the proof of Theorem 1 in Section IV.C and standard from USS and CocoSketch; accepted as background.
  • domain assumption Real IP traffic has heavy-hitter clusters at a small number of prefix lengths, around 32, near 24, and 8 to 12.
    Section III-B hypothesizes three cluster ranges based on Figure 5; the recommended level settings depend on this empirical claim.
  • standard math Each sketch level needs O(1/epsilon) buckets to guarantee a maximum error of epsilon N, as analyzed for prior HHH sketches.
    Invoked in Section IV.B for the space bound; taken from the analysis in reference [18].
  • ad hoc to paper Residual connections can be modeled as exact removal of descendant heavy-hitter counts when proving unbiasedness.
    This is the unproved link used in Theorem 1; the implemented decrement by a fixed threshold is not exact removal, so the proof does not match the algorithm.

how reviews work

0 comments
Cite this review

Pith. "Pith review of ResidualSketch: Enhancing Layer Efficiency and Error Reduction in Hierarchical Heavy Hitter Detection with ResNet Innovations." pith.science (2026). https://pith.science/paper/MNAHQ5VA

@misc{pith2026250512445,
  author       = {Pith},
  title        = {Pith review of: ResidualSketch: Enhancing Layer Efficiency and Error Reduction in Hierarchical Heavy Hitter Detection with ResNet Innovations},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MNAHQ5VA}},
  note         = {Machine review of arXiv:2505.12445}
}
read the original abstract

In network management, swiftly and accurately identifying traffic anomalies, including Distributed Denial-of-Service (DDoS) attacks and unexpected network disruptions, is essential for network stability and security. Key to this process is the detection of Hierarchical Heavy Hitters (HHH), which significantly aids in the management of high-speed IP traffic. This study introduces ResidualSketch, a novel algorithm for HHH detection in hierarchical traffic analysis. ResidualSketch distinguishes itself by incorporating Residual Blocks and Residual Connections at crucial layers within the IP hierarchy, thus mitigating the Gradual Error Diffusion (GED) phenomenon in previous methods and reducing memory overhead while maintaining low update latency. Through comprehensive experiments on various datasets, we demonstrate that ResidualSketch outperforms existing state-of-the-art solutions in terms of accuracy and update speed across multiple layers of the network hierarchy. All related codes of ResidualSketch are open-source at GitHub.

Figures

Figures reproduced from arXiv: 2505.12445 by the authors.

Figure 1
Figure 1. F1 Score for HHH Detection Across Various Layers [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 1
Figure 1. This gradual decline in accuracy, though not as [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. The binary tree represents the hierarchical flow IDs structure, such as [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figures from the paper (8 more)
Figure 3
Figure 3. Figure 3: The Architecture of Our Algorithm (A*, A’ represents [PITH_FULL_IMAGE:figures/full_fig_p004_3.png]
Figure 5
Figure 5. Figure 5: HH ratio of Different Layers on the CAIDA and MAWI [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]
Figure 6
Figure 6. Figure 6: Average Composition of Full Keys Across Various [PITH_FULL_IMAGE:figures/full_fig_p006_6.png]
Figure 7
Figure 7. Figure 7: Performance Comparison with HH-based Sketches on MAWI Dataset. [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]
Figure 9
Figure 9. Figure 9: Performance Comparison with APK-based Sketches on [PITH_FULL_IMAGE:figures/full_fig_p008_9.png]
Figure 10
Figure 10. Figure 10: F1 Score for HHH Detection Across Various Layers [PITH_FULL_IMAGE:figures/full_fig_p008_10.png]
Figure 13
Figure 13. Figure 13: Evaluation of ResidualSketch on Parameter Setting: [PITH_FULL_IMAGE:figures/full_fig_p009_13.png]
Figure 11
Figure 11. Figure 11: Evaluation of ResidualSketch on Parameter Setting: [PITH_FULL_IMAGE:figures/full_fig_p009_11.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

34 extracted references · 32 canonical work pages

  1. [1]

    Burstsketch: Finding bursts in data streams

    Zheng Zhong, Shen Yan, Zikun Li, Decheng Tan, Tong Yang, and Bin Cui. Burstsketch: Finding bursts in data streams. InProceedings of the 2021 International Conference on Management of Data, pages 2375– 2383, 2021

    work page 2021

  2. [2]

    AOC-IDS: Autonomous Online Framework with Contrastive Learning for Intrusion Detection

    Xinchen Zhang, Running Zhao, Zhihan Jiang, Zhicong Sun, Yulong Ding, Edith CH Ngai, and Shuang-Hua Yang. Aoc-ids: Autonomous online framework with contrastive learning for intrusion detection.arXiv preprint arXiv:2402.01807, 2024

    work page Pith review arXiv 2024

  3. [3]

    Ddos threat report for 2023 q4, January 2024

    Omer Yoachimik, Jorge Pacheco. Ddos threat report for 2023 q4, January 2024. Available at https://blog.cloudflare.com/ ddos-threat-report-2023-q4

    work page 2023

  4. [4]

    Poseidon: Mitigating volumetric ddos attacks with programmable switches

    Menghao Zhang, Guanyu Li, Shicheng Wang, Chang Liu, Ang Chen, Hongxin Hu, Guofei Gu, Qianqian Li, Mingwei Xu, and Jianping Wu. Poseidon: Mitigating volumetric ddos attacks with programmable switches. Inthe 27th Network and Distributed System Security Sympo- sium (NDSS 2020), 2020

    work page 2020

  5. [5]

    Jaqen: A{High-Performance}{Switch-Native}approach for detecting and mitigating volumetric{DDoS}attacks with programmable switches

    Zaoxing Liu, Hun Namkung, Georgios Nikolaidis, Jeongkeun Lee, Changhoon Kim, Xin Jin, Vladimir Braverman, Minlan Yu, and Vyas Sekar. Jaqen: A{High-Performance}{Switch-Native}approach for detecting and mitigating volumetric{DDoS}attacks with programmable switches. In30th USENIX Security Symposium (USENIX Security 21), pages 3829–3846, 2021

    work page 2021

  6. [6]

    Quantifying the impact of blocklisting in the age of address reuse

    Sivaramakrishnan Ramanathan, Anushah Hossain, Jelena Mirkovic, Minlan Yu, and Sadia Afroz. Quantifying the impact of blocklisting in the age of address reuse. InProceedings of the ACM Internet Measurement Conference, pages 360–369, 2020

    work page 2020

  7. [7]

    The unintended consequences of block- ing ip addresses, December 2022

    Alissa Starzak, Marwan Fayed. The unintended consequences of block- ing ip addresses, December 2022. Available at https://blog.cloudflare. com/consequences-of-ip-blocking

    work page 2022

  8. [8]

    Online identification of hierarchical heavy hitters: algorithms, evaluation, and applications

    Yin Zhang, Sumeet Singh, Subhabrata Sen, Nick Duffield, and Carsten Lund. Online identification of hierarchical heavy hitters: algorithms, evaluation, and applications. InProceedings of the 4th ACM SIGCOMM Conference on Internet Measurement, pages 101–114, 2004

    work page 2004

Show all 34 references
  1. [9]

    Heavy-hitter detection entirely in the data plane

    Vibhaalakshmi Sivaraman, Srinivas Narayana, Ori Rottenstreich, Shan Muthukrishnan, and Jennifer Rexford. Heavy-hitter detection entirely in the data plane. InProceedings of the Symposium on SDN Research, pages 164–176, 2017

    2017

  2. [10]

    Dear: Accelerating distributed deep learning with fine-grained all-reduce pipelining

    Lin Zhang, Shaohuai Shi, Xiaowen Chu, Wei Wang, Bo Li, and Chengjian Liu. Dear: Accelerating distributed deep learning with fine-grained all-reduce pipelining. In2023 IEEE 43rd International Conference on Distributed Computing Systems (ICDCS), pages 142–

  3. [11]

    One sketch to rule them all: Rethinking network flow monitoring with univmon

    Zaoxing Liu, Antonis Manousis, Gregory V orsanger, Vyas Sekar, and Vladimir Braverman. One sketch to rule them all: Rethinking network flow monitoring with univmon. InProceedings of the 2016 ACM SIGCOMM Conference, pages 101–114, 2016

    2016

  4. [12]

    Finding fre- quent items in data streams

    Moses Charikar, Kevin Chen, and Martin Farach-Colton. Finding fre- quent items in data streams. InAutomata, Languages and Programming. Springer, 2002

    2002

  5. [13]

    An improved data stream sum- mary: the count-min sketch and its applications.Journal of Algorithms, 55(1):58–75, 2005

    Graham Cormode and S Muthukrishnan. An improved data stream sum- mary: the count-min sketch and its applications.Journal of Algorithms, 55(1):58–75, 2005

    2005

  6. [14]

    New directions in traffic measure- ment and accounting.ACM SIGMCOMM CCR, 32(4), 2002

    Cristian Estan and George Varghese. New directions in traffic measure- ment and accounting.ACM SIGMCOMM CCR, 32(4), 2002

    2002

  7. [15]

    Elastic sketch: Adaptive and fast network-wide measurements

    Tong Yang, Jie Jiang, Peng Liu, Qun Huang, Junzhi Gong, Yang Zhou, Rui Miao, Xiaoming Li, and Steve Uhlig. Elastic sketch: Adaptive and fast network-wide measurements. InProceedings of the 2018 Conference of the ACM Special Interest Group on Data Communication, pages 561– 575, 2018

    2018

  8. [16]

    https://mawi.wide.ad.jp/mawi/

    MAWI Working Group Traffic Archive. https://mawi.wide.ad.jp/mawi/

  9. [17]

    Finding hierarchical heavy hitters in streaming data.ACM Transactions on Knowledge Discovery from Data (TKDD), 1(4):1–48, 2008

    Graham Cormode, Flip Korn, S Muthukrishnan, and Divesh Srivastava. Finding hierarchical heavy hitters in streaming data.ACM Transactions on Knowledge Discovery from Data (TKDD), 1(4):1–48, 2008

    2008

  10. [18]

    Hierarchical heavy hitters with the space saving algorithm

    Michael Mitzenmacher, Thomas Steinke, and Justin Thaler. Hierarchical heavy hitters with the space saving algorithm. In2012 Proceedings of the Fourteenth Workshop on Algorithm Engineering and Experiments (ALENEX), pages 160–174. SIAM, 2012

    2012

  11. [19]

    Mvpipe: Enabling lightweight updates and fast convergence in hierarchical heavy hitter detection

    Lu Tang, Qun Huang, and Patrick PC Lee. Mvpipe: Enabling lightweight updates and fast convergence in hierarchical heavy hitter detection. IEEE/ACM Transactions on Networking, 2023

    2023

  12. [20]

    Data sketches for disaggregated subset sum and frequent item estimation

    Daniel Ting. Data sketches for disaggregated subset sum and frequent item estimation. InProceedings of the 2018 International Conference on Management of Data, pages 1129–1140, 2018

    2018

  13. [21]

    Cocosketch: High- performance sketch-based measurement over arbitrary partial key query

    Yinda Zhang, Zaoxing Liu, Ruixin Wang, Tong Yang, Jizhou Li, Ruijie Miao, Peng Liu, Ruwen Zhang, and Junchen Jiang. Cocosketch: High- performance sketch-based measurement over arbitrary partial key query. InProceedings of the 2021 ACM SIGCOMM 2021 Conference, pages 207–222, 2021

    2021

  14. [22]

    Hyper-uss: Answering subset query over multi-attribute data stream

    Ruijie Miao, Yiyao Zhang, Guanyu Qu, Kaicheng Yang, Tong Yang, and Bin Cui. Hyper-uss: Answering subset query over multi-attribute data stream. InProceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 1698–1709, 2023

    2023

  15. [23]

    Constant time updates in hierarchical heavy hitters

    Ran Ben Basat, Gil Einziger, Roy Friedman, Marcelo C Luizelli, and Erez Waisbard. Constant time updates in hierarchical heavy hitters. In Proceedings of the Conference of the ACM Special Interest Group on Data Communication, pages 127–140, 2017

    2017

  16. [24]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. InProceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016

    2016

  17. [25]

    Efficient computation of frequent and top-k elements in data streams

    Ahmed Metwally, Divyakant Agrawal, and Amr El Abbadi. Efficient computation of frequent and top-k elements in data streams. In International conference on database theory, pages 398–412. Springer, 2005

    2005

  18. [26]

    Approximate frequency counts over data streams

    Gurmeet Singh Manku and Rajeev Motwani. Approximate frequency counts over data streams. InVLDB’02: Proceedings of the 28th International Conference on Very Large Databases, pages 346–357. Elsevier, 2002

    2002

  19. [27]

    A fast and compact invertible sketch for network-wide heavy flow detection.IEEE/ACM Transactions on Networking, 28(5):2350–2363, 2020

    Lu Tang, Qun Huang, and Patrick PC Lee. A fast and compact invertible sketch for network-wide heavy flow detection.IEEE/ACM Transactions on Networking, 28(5):2350–2363, 2020

    2020

  20. [28]

    Visibility of ipv4 and ipv6 prefix lengths in 2019, April 2019

    Stephen Strowes. Visibility of ipv4 and ipv6 prefix lengths in 2019, April 2019. Available at https://labs.ripe.net/author/stephen strowes/ visibility-of-ipv4-and-ipv6-prefix-lengths-in-2019/

    2019

  21. [29]

    Sliding sketches: A framework using time zones for data stream processing in sliding windows

    Xiangyang Gou, Long He, Yinda Zhang, Ke Wang, Xilai Liu, Tong Yang, Yi Wang, and Bin Cui. Sliding sketches: A framework using time zones for data stream processing in sliding windows. InProceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data M...

    2020

  22. [30]

    Microscopesketch: Accurate sliding estimation using adaptive zooming

    Yuhan Wu, Shiqi Jiang, Siyuan Dong, Zheng Zhong, Jiale Chen, Yutong Hu, Tong Yang, Steve Uhlig, and Bin Cui. Microscopesketch: Accurate sliding estimation using adaptive zooming. InProceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 2660...

    2023

  23. [31]

    Omniwin- dow: A general and efficient window mechanism framework for network telemetry

    Haifeng Sun, Jiaheng Li, Jintao He, Jie Gui, and Qun Huang. Omniwin- dow: A general and efficient window mechanism framework for network telemetry. InProceedings of the ACM SIGCOMM 2023 Conference, pages 867–880, 2023

    2023

  24. [32]

    Double-anonymous sketch: Achieving top-k-fairness for finding global top-k frequent items.Proceedings of the ACM on Management of Data, 1(1):1–26, 2023

    Yikai Zhao, Wenchen Han, Zheng Zhong, Yinda Zhang, Tong Yang, and Bin Cui. Double-anonymous sketch: Achieving top-k-fairness for finding global top-k frequent items.Proceedings of the ACM on Management of Data, 1(1):1–26, 2023

    2023

  25. [33]

    https://github.com/ ResidualSketch/ResidualSketch

    Source code related to residualsketch. https://github.com/ ResidualSketch/ResidualSketch

  26. [34]

    http://www.caida.org/data/ overview/

    The caida anonymized 2018 internet traces. http://www.caida.org/data/ overview/. 10

    2018

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.