RekindleSketch: Time-Aware Detection of Recent Persistent Flows via Arrival-Driven Rewards

Recent persistent flow, which refers to a flow that remains continuously active within the most recent R windows, is an important analytical object for recognizing the network situation and detecting anomalies. Existing methods struggle to effectively detect such flows due to prohibitive memory overhead or unstable accuracy caused by arrival gaps and hash collisions in limited memory. In this paper, we propose RekindleSketch, a novel time-aware data structure designed for accurate and efficient detection of recent persistent flows. First, we define a new metric to quantify recent persistence, called memory score. Taking into account both continuity and intermittency in the last R windows, the scores of recent persistent flows are continuously rewarded, while the scores of recent inactive flows are rapidly reduced, achieving a focus on recent activity and the forgetting of historical activity. Then, taking advantage of the memory score, RekindleSketch adopts a probabilistic replacement policy that faithfully tracks recent persistent flows while rapidly evicting those that have become inactive. We provide both theoretical analysis and extensive experimental tests. Experimental results demonstrate that RekindleSketch outperforms state-of-the-art methods in terms of accuracy and efficiency. The source code of RekindleSketch is available on GitHub.