Towards in-network time-decaying aggregates for heavy-hitter detection

Keeping track of heavy hitters (HH) entirely in the data plane is an all-important aspect of many real-time monitoring tasks (e.g., load-balancing, attack detection). Existing interval-reset-based sketch and hash table approaches are incapable of delivering consistent and high accuracy when operating in heterogeneous scenarios where various applications with different purposes require the flows to be tracked at different time scales, not to mention their dependence on the control plane for data structure management.