1: \begin{abstract}

2: Finding hierarchical heavy hitters (HHHs) (i.e., hierarchical aggregates with

3: exceptionally huge amounts of traffic) is critical to network management, yet

4: it is often challenged by the requirements of fast packet processing,

5: real-time and accurate detection, as well as resource efficiency. Existing HHH

6: detection schemes either incur expensive packet updates for multiple

7: aggregation levels in the IP address hierarchy, or need to process sufficient

8: packets to converge to the required detection accuracy.  We present \sysname,

9: an invertible sketch that achieves both lightweight updates and

10: fast convergence in HHH detection.  \sysname builds on the skewness property

11: of IP traffic to process packets via a pipeline of majority voting executions,

12: such that most packets can be updated for only one or few aggregation levels

13: in the IP address hierarchy.  We show how \sysname

14: can be feasibly deployed in P4-based programmable switches subject to limited

15: switch resources.  We also theoretically analyze the accuracy and coverage

16: properties of \sysname.  Evaluation with real-world Internet traces shows that

17: \sysname achieves high accuracy, high throughput, and fast convergence

18: compared to six state-of-the-art HHH detection schemes.  It also incurs low

19: resource overhead in the Tofino switch deployment. 

20: \end{abstract}

21: