Efficient Sketch-Based Joint Heavy-Hitter and Super-Spreader Detection for Microgrid Communication Networks

Cyberattacks such as DoS and DDoS can block or delay data communications in microgrid networks, thereby impairing the control of power electronic converters. These attacks motivate the measurement of heavy hitters and super-spreaders in microgrid network traffic. Both measurement tasks commonly rely on sketches, a class of probabilistic data structures. The two tasks nevertheless impose conflicting requirements: super-spreader detection ignores duplicate items in data stream statistics, while heavy hitter detection retains flows with many duplicate items. Consequently, an existing sketch-based scheme generally specializes in one task even though a data stream may contain both traffic classes. DualMeasure Sketch (DMS) is proposed to resolve this conflict. DMS distinguishes super-spreaders from heavy hitters dynamically and maintains them separately, allowing both to be detected accurately at the same time. CPU and OVS platform implementations are used for performance evaluation. Experimental comparison with the state-of-the-art sketches shows concurrent support for both tasks. On CAIDA19 with 1 MB memory, DMS improves super-spreader F1-score by up to 40% and reduces heavy-hitter error by up to 80% compared with dedicated state-of-the-art sketches. In joint deployment on CAIDA19 with 1 MB total memory, DMS improves throughput by about 12% over Combine Sketch.