Memento: Making Sliding Windows Efficient for Heavy Hitters

Ran Ben Basat, Gil Einziger, Isaac Keslassy, Ariel Orda, Shay Vargaftik, Erez Waisbard

Research output: Contribution to journalArticlepeer-review


Cloud operators require timely identification of Heavy Hitters (HH) and Hierarchical Heavy Hitters (HHH) for applications such as load balancing, traffic engineering, and attack mitigation. However, existing techniques are slow in detecting new heavy hitters. In this paper, we present the case for identifying heavy hitters through sliding windows. Sliding windows are quicker and more accurate to detect new heavy hitters than current interval-based methods, but to date had no practical algorithms. Accordingly, we introduce, design, and analyze the Memento family of sliding window algorithms for the HH and HHH problems in the single-device and network-wide settings. We use extensive evaluations to show that our single-device solutions are orders of magnitude faster than existing sliding window techniques and comparable in speed to state-of-the-art non-windowed sampling based technique. Furthermore, we exemplify our network-wide HHH detection capabilities on a realistic testbed. To that end, we implemented Memento as an open-source extension to the popular HAProxy cloud load-balancer. In our evaluations, using an HTTP flood by 50 subnets, our network-wide approach detected the new subnets faster and reduced the number of undetected flood requests by up to $37\times $ compared to the alternatives.

Original languageEnglish
Pages (from-to)1440-1453
Number of pages14
JournalIEEE/ACM Transactions on Networking
Issue number4
StatePublished - 1 Aug 2022


  • Communication technology
  • communication systems
  • computer networks
  • internet

ASJC Scopus subject areas

  • Software
  • Computer Science Applications
  • Computer Networks and Communications
  • Electrical and Electronic Engineering


Dive into the research topics of 'Memento: Making Sliding Windows Efficient for Heavy Hitters'. Together they form a unique fingerprint.

Cite this