摘要： 在网络通信和网络流量管理等领域中，快速、准确地识别大流对流量拥塞控制、恶意流量监测等任务具有重要意义。然而，现实网络环境中的数据流传输速率极高，使得大流检测变得异常复杂和具有挑战性。目前，大多数现有的大流检测方法主要依赖单一维度的统计数据，通常仅基于流中数据包的估计值进行流量统计与分析。这种方法的局限性在于忽略了其他潜在维度的关键信息，例如数据包间隔的分布特性，这些信息在准确识别大流时可能起到关键作用。针对上述问题提出了一种新颖的大流检测算法——间隔值草图。该算法通过引入两个维度的流量特征，即流的估计值大小和数据包间隔分布特性，优化了大流的保护与小流的替换策略。具体而言，间隔值草图通过结合数据包间隔特性，可以有效区分大流与小流，从而在低内存条件下显著提升检测性能。为验证间隔值草图的准确性和有效性，采用了两个真实网络流量数据集——CAIDA和MAWI进行实验分析。结果表明，间隔值草图在多种内存设置和流量分布情况下均表现出显著的优势。与现有方法相比，间隔值草图不仅能够在内存资源受限的情况下保持较高的检测精度，还在F1分数上实现了显著提升，最高可达到现有设计方案的2.4倍。

Abstract: In the fields of network communication and traffic management, the ability to quickly and accurately identify heavy flows is of great significance for tasks such as congestion control and malicious traffic monitoring. However, the extremely high transmission rates of data flows in real-world network environments make heavy flow detection highly complex and challenging. Most existing heavy flow detection methods rely primarily on single-dimensional statistical data, typically using only flow size estimation to perform traffic statistics and analysis. The limitation of these approaches lies in their neglect of other critical dimensions of information, such as the distribution characteristics of packet intervals, which may play a key role in accurately identifying heavy flows. To address these issues, this paper proposes a novel heavy flow detection algorithm called IntervalSketch. The algorithm introduces two key traffic features: flow size estimation and packet interval distribution characteristics. By leveraging these two dimensions, IntervalSketch optimizes the protection of heavy flows and the replacement of small flows. Specifically, by incorporating the packet interval distribution, IntervalSketch effectively distinguishes between heavy flows and small flows, thereby significantly improving detection performance under low-memory conditions. To evaluate the accuracy and effectiveness of IntervalSketch, two real-world network traffic datasets, CAIDA and MAWI, were used for experimental analysis. The results demonstrate that IntervalSketch exhibits significant advantages across various memory configurations and traffic distributions. Compared to existing methods, IntervalSketch not only maintains high detection accuracy in memory-constrained environments but also achieves substantial improvements in F1 score, with gains of up to 2.4 times over current state-of-the-art designs.