Pith. sign in

REVIEW 5 major objections 6 minor 1 cited by

LLM-Sketch: Enhancing Network Sketches with LLM

T0 review · 5 major / 6 minor · reviewed 2026-08-08 · deepseek-v4-flash

Pith's one-line read A fine-tuned language model that reads full packet headers can predict which flows will grow large, making two-tier network sketches far more accurate—average relative error on flow-size queries drops by more than an order of magnitude.

desk verdict Genuinely new idea and likely right direction, but the headline accuracy/memory claim is not supported as stated because the memory axis excludes the LLM's off-budget footprint and no runtime is measured. read the letter →

arxiv 2502.07495 v1 pith:52URTZKH submitted 2025-02-11 cs.NI cs.LG

classification cs.NIcs.LG
keywords networkstreamminingsketchesflowclassificationlargelanguagemodelstwo-tierdatastructuresoft-labellearningsizeestimationheavyhitterquery
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

LLM-Sketch is a two-tier sketch data structure that combines a heavy key-value table for large flows with a light Count-Min sketch for small flows, and it uses a fine-tuned language model to classify each incoming flow in real time. The paper's central claim is that packet header fields beyond the flow ID, with IP addresses removed, carry enough signal to predict whether a flow will be large, and that this signal persists over time. The reported result is that this design cuts average relative error by more than an order of magnitude compared with state-of-the-art learned sketches on flow-size queries, and it improves F1 scores for heavy hitter and hierarchical heavy hitter queries. The broader implication is that network measurement sketches can be made adaptive to skewed, shifting traffic by leveraging the contextual pattern-capturing ability of a language model.

What carries the argument

The mechanism is a two-tier sketch: a heavy part built from hash buckets of eight cells that records flows predicted to be large, and a light part, a Count-Min sketch with three hash functions, that records the rest. A fine-tuned RoBERTa model, applied to the packet header with source and destination IPs removed, outputs a soft label in $[0,1]$; flows near threshold get labels around $0.5$, so borderline misclassifications cost less. A per-cell lock flag, updated as an unbiased estimator of the running average of predicted labels, prevents young-but-large flows from being evicted early. The heavy-light split plus the soft-label classifier together are what let the sketch keep large-flow counters clean under skewed traffic.

What would settle it

A concrete test would be to train the soft-label classifier on a one-hour trace, then evaluate it on a trace collected a day later from the same link; if the classifier's F1 drops to the level of an ID-only baseline (or the sketch's ARE advantage vanishes), the persistence claim fails. A second, quicker test is to run the same procedure on a trace from a different network type—for example, a datacenter with mostly short flows—and check whether the header signal still separates large from small flows.

Watch

Extended reading notes

Core claim

On its own terms, the paper discovers that the full packet header—not just the flow ID—contains usable signal for predicting whether a flow will be large, and that a fine-tuned RoBERTa model can extract that signal reliably enough to drive a sketch's insertion decisions. The authors show that a soft-label regression formulation, where the target is $\sigma(2.298(\log_2 n - \log_2 64))$, reduces the penalty for misclassifying flows near the large/small threshold. They prove that the lock flag is an unbiased estimator of the running average of predicted labels, and they give bounds on the probability that a large flow is tracked exactly and on the error contributed by the light part. In experiments, LLM-Sketch's average relative error on the CAIDA flow-size query is 11.8 times lower than LCMS and 18.8 times lower than ElasticSketch, with smaller but consistent gains on MAWI and IMC DC.

Load-bearing premise

The load-bearing premise is that packet header fields other than the flow ID (specifically transport-layer information, with IP addresses removed) reliably predict future flow size, and that this predictability persists over time as network traffic shifts.

Editorial extensions

If this is right

  • Flow-size estimation under a fixed memory budget can be made dramatically more accurate by exploiting header fields beyond the flow ID, not just by tuning counters or hashing.
  • Because the classifier's accuracy decays only slightly over a 20-minute window (F1 drop 0.059 vs 0.113 for an ID-only baseline), the approach is more robust to traffic shift than prior learned sketches.
  • Heavy hitter and hierarchical heavy hitter queries inherit the accuracy gain: F1 score 0.94 at 50 KB versus 0.74 for ElasticSketch and 0.82 for CocoSketch.
  • Since the method reads only header bytes, it avoids payload inspection, which keeps it compatible with privacy constraints while still capturing transport-layer cues.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural stress test is to run the same soft-label classifier on traces from a different network type, such as heavily encrypted tunnels or datacenter traffic with different protocols; if the ARE advantage over an ID-only baseline shrinks to near zero, the generality of the header signal is limited.
  • The paper reports no throughput or latency numbers; an inference from the design is that deployment on real packet pipelines would require a distilled or quantized model, and measuring whether the accuracy gains survive that compression is the key open engineering question.
  • Because the soft-label objective is continuous, the same classifier output could be reused for other measurement goals, such as per-class flow-size statistics or anomaly scoring, though the paper does not explore these connections.
  • The 20-minute stability window is short; a longer study over hours or days, possibly with periodic fine-tuning, would show whether the approach holds in operational settings.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper proposes LLM-Sketch, a two-tier sketch composed of a heavy key-value table and a light CMS (or CocoSketch for HHH), in which insertions are guided by a fine-tuned RoBERTa classifier. The classifier consumes packet header bytes with IP addresses removed and outputs a soft label estimating whether a flow will be large, and a lock-flag mechanism is introduced to reduce premature eviction of young large flows. The authors present insertion/query algorithms, a theoretical analysis of accuracy and error bounds under stated assumptions, and experiments on CAIDA, MAWI, and IMC DC datasets for flow-size query, heavy-hitter query, and hierarchical heavy-hitter query. They report large empirical gains over LCMS, ElasticSketch, and CocoSketch, including a headline 7.5x average accuracy improvement.

Significance. The core idea of exploiting header fields beyond the flow ID with a pretrained transformer is genuinely novel and, if the comparison were made like-for-like, would be an interesting contribution to learned sketches. The paper provides a concrete data structure, a public code release, and a modular analysis in which the classifier accuracy A is an input parameter rather than a derived quantity, which is a reasonable way to separate classifier error from sketch error. The reported results are internally consistent and the direction of the improvement is plausible. However, the central accuracy-versus-memory claim is not currently supported because the classifier's parameters, activation memory, and GPU are excluded from the reported memory budget, and several design choices are tuned and evaluated on the same data. These issues require substantial additional experiments before the headline claims can be accepted.

major comments (5)
  1. [Section 5.3, Figures 7-11] The memory comparison is not like-for-like. The x-axis 'Memory (KB)' covers only the two-tier sketch, while the classifier is a fine-tuned RoBERTa model with LoRA running on an NVIDIA-4090 (Section 5.1). The classifier's parameters, activation workspace, and GPU are not included in the memory budget or in any reported compute cost. Consequently, the claims of 'minimizing memory usage' and the reported 11.8x and 18.8x ARE reductions over LCMS and ElasticSketch are established only under an arbitrarily large external-model budget. The paper should report the model footprint, include it in the memory Pareto comparison (or compare at equal total memory), and provide an ablation with a much smaller classifier trained on the same header features to show that the LLM's capacity is necessary. In addition, the headline '7.5x accuracy improvement' is not defined: it is not stated over which tasks, datasets, and metrics this average is computed.
  2. [Section 5.2, Figures 4-6] The hyperparameters bucket size, heavy ratio, and number of hash functions are selected from Figures 4-6 and then used for the CAIDA results in Figures 7-9. As far as the text discloses, the same dataset is used for both tuning and reporting, which risks overfitting the comparison. The authors should either use a held-out validation split for parameter selection, perform cross-validation, or clearly report the parameters chosen on the training set only. This is load-bearing because the magnitude of the reported gains depends on these choices.
  3. [Section 3.1 and Section 4.2, Theorem 4.3] The lock-flag theorem is inconsistent with the algorithm as written. Theorem 4.3 proves unbiasedness under the assumption that a prediction y_t is obtained at every insertion and the lock flag is updated after every packet. In the insertion procedure, however, the classifier is invoked only in Case 3, when a flow is not in the heavy part and its bucket is full; otherwise the lock flag is not updated. The proof's induction over all t therefore does not match the algorithm. Either the algorithm must be changed so that every packet triggers a classifier call (which would have severe performance implications), or the theorem must be restated for the actual update schedule.
  4. [Section 4, Assumptions 1 and 2] The theoretical results in Theorems 4.1 and 4.2 depend on two strong assumptions that are not validated experimentally. Assumption 1 (the predicted label of a flow never changes during its lifetime) is likely violated in practice, and Assumption 2 (the heavy part is large enough that correctly classified large flows are never evicted) is an idealization that the lock-flag mechanism only approximates. The paper should report how often labels flip and how often large flows are evicted in the real datasets, or at least provide a sensitivity analysis, to show that the theorems describe the operational regime of the algorithm rather than an idealized setting.
  5. [Section 5.4, Figure 13] The paper calls the classifier 'real-time' and claims practical relevance, but it provides no throughput or latency measurement. A fine-tuned RoBERTa model on an NVIDIA-4090 is not shown to keep up with packet arrival rates, and the 20-minute stability experiment in Figure 13 does not address per-packet processing cost. The authors should report inference time per packet or an end-to-end processing rate, and either discuss the deployment scenario in which LLM inference on the data path is feasible or temper the real-time claim accordingly.
minor comments (6)
  1. [Section 3.1] In the eviction policy paragraph, 'evicts tthe' should be 'evicts the'.
  2. [Section 5.2, Figure 5] The text states that a heavy ratio of 10% consistently yields the lowest ARE, but then sets the heavy ratio to 20% 'as a balance'; this choice needs a more explicit justification, especially since the preceding sentence says 10% is best.
  3. [Figure 11 caption] The caption for Figure 11 says 'Accuracy of flow size query on other datasets', but the figure plots F1 score and ARE for the heavy hitter query, as described in the Section 5.3 text. The caption should be corrected.
  4. [Section 5.3] The sentence 'its AAE is also 8.1 and 12.1 lower than those of LCMS and ES' should specify '8.1x and 12.1x lower' (or 'times lower') to match the ARE phrasing.
  5. [Section 4.1, Theorem 4.2 proof] In the CMS analysis portion, 'with probability 1-e^{-d_light}' should be 'with probability at least 1-e^{-d_light}', since the subsequent tail bound is the complement of the success probability.
  6. [Section 5.1] The model name is inconsistently capitalized: 'Roberta' should be 'RoBERTa'.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the theoretical bounds condition on the classifier accuracy as an exogenous input, and the central accuracy claim is an empirically measured result on held-out data.

full rationale

The paper's derivation chain is not circular. In Section 4.1, Theorem 4.1 writes P_LLMS = A + (1 - A) * P_CMS, but A is explicitly defined as the classifier's accuracy for large flows and is taken as an input parameter, not derived from the sketch; Theorem 4.2 similarly conditions on A and uses standard CMS analysis. These are conditional decompositions, not predictions forced by construction. The soft-label objective label = sigma(2.298(log2 n - log2 64)) is a hand-chosen design choice, not fitted to test data, and the classifiers are trained on separate adjacent sub-datasets and tested on held-out sub-datasets (five-second windows), so the reported 7.5x accuracy improvement is an empirical comparison rather than a tautology. The self-citations (e.g., ElasticSketch, CocoSketch) are used as baselines or building blocks, not as load-bearing uniqueness arguments. The concern that the memory budget excludes the RoBERTa model is a fairness/correctness issue about what resource envelope is being compared, not a circularity of the derivation. No step reduces, by the paper's own equations or by self-citation, to its own inputs.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The paper introduces no new particles, forces, or physical entities. The LLM classifier is a learned model, not an invented entity. The soft-label strategy is a training technique, not an entity. The free parameters listed are the main hand-tuned numbers that the central accuracy claim depends on.

free parameters (6)
  • Heavy threshold T = 64
    Chosen by hand to define large vs small flows; also used in soft label.
  • Soft-label scaling a = 2.298
    Chosen so that flows >256 get label >0.99 and flows <16 get label <0.01.
  • Heavy ratio = 20%
    Selected based on parameter sweep in Figure 5 to balance ARE and AAE across memory sizes.
  • Heavy-part bucket size = 8
    Selected from Figure 4; larger sizes give marginal gains.
  • Number of light-part hash functions = 3
    Selected from Figure 6 as near-optimal across memory budgets.
  • RoBERTa fine-tuned weights = Not reported
    The classifier is fit to the training data; exact weights and LoRA hyperparameters are not listed.
assumptions (5)
  • ad hoc to paper Assumption 1: predicted label of a flow does not change from large to small during its lifetime
    Used in Theorems 4.1 and 4.2; unrealistic in practice, and the lock flag is a partial mitigation.
  • ad hoc to paper Assumption 2: heavy part large enough that correctly classified large flows are never evicted
    Used in Theorem 4.1; in finite memory heavy parts can still evict large flows.
  • standard math Standard CMS error bound with Poisson collision approximation
    Used in Theorem 4.2 for the light part's error.
  • domain assumption Header fields (excluding IPs) contain learnable signal about flow size
    The paper's core insight; validated only on three datasets over 20 minutes.
  • domain assumption Training and test sub-datasets come from the same underlying distribution
    The evaluation uses adjacent time windows from the same trace; this may overestimate deployment accuracy.

how reviews work

0 comments
Cite this review

Pith. "Pith review of LLM-Sketch: Enhancing Network Sketches with LLM." pith.science (2026). https://pith.science/paper/52URTZKH

@misc{pith2026250207495,
  author       = {Pith},
  title        = {Pith review of: LLM-Sketch: Enhancing Network Sketches with LLM},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/52URTZKH}},
  note         = {Machine review of arXiv:2502.07495}
}
abstract

Network stream mining is fundamental to many network operations. Sketches, as compact data structures that offer low memory overhead with bounded accuracy, have emerged as a promising solution for network stream mining. Recent studies attempt to optimize sketches using machine learning; however, these approaches face the challenges of lacking adaptivity to dynamic networks and incurring high training costs. In this paper, we propose LLM-Sketch, based on the insight that fields beyond the flow IDs in packet headers can also help infer flow sizes. By using a two-tier data structure and separately recording large and small flows, LLM-Sketch improves accuracy while minimizing memory usage. Furthermore, it leverages fine-tuned large language models (LLMs) to reliably estimate flow sizes. We evaluate LLM-Sketch on three representative tasks, and the results demonstrate that LLM-Sketch outperforms state-of-the-art methods by achieving a $7.5\times$ accuracy improvement.

Figures

Figures reproduced from arXiv: 2502.07495 by the authors.

Figure 1
Figure 1. The Count-Min sketch. 3 The LLM-Sketch Algorithm In this section, we first propose the data structure and operations of LLM-Sketch. Then we present how the flow classifier is designed. After that, we describe the application of LLM-Sketch. 3.1 Data Structure and Operations Data structure: As shown in [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Workflow of LLM-Sketch. Insertion: When inserting a packet of flow 𝑓 , LLM-Sketch locates the mapped bucket 𝐵[ℎ(𝑓 )] using the hash function ℎ. There are three cases: Case 1: If 𝑓 is already recorded in 𝐵[ℎ(𝑓 )], LLM-Sketch simply increments its flow size by 1. Case 2: If 𝑓 is not in 𝐵[ℎ(𝑓 )] and there is an empty cell, LLM￾Sketch inserts (𝑓 , 1) into that cell. Case 3: If 𝑓 is not in 𝐵[ℎ(𝑓 )] and all cells in the b… view at source ↗
Figure 3
Figure 3. An example of LLM-Sketch. Example 1 [PITH_FULL_IMAGE:figures/full_fig_p003_3.png] view at source ↗
Figures from the paper (10 more)
Figure 4
Figure 4. Figure 4: Accuracy vs. # bucket size. 200 300 400 500 600 700 800 900 1000 Memory (KB) 0 1 2 3 4 ARE Heavy Ratio = 10% Heavy Ratio = 20% Heavy Ratio = 30% Heavy Ratio = 40% Heavy Ratio = 50% (a) ARE. 200 300 400 500 600 700 800 900 1000 Memory (KB) 0 1 2 3 4 5 6 7 AAE Heavy Rati…
Figure 5
Figure 5. Figure 5: Accuracy vs. heavy ratio. 200 300 400 500 600 700 800 900 1000 Memory (KB) 0.0 0.5 1.0 1.5 2.0 2.5 3.0 ARE Hash Num = 1 Hash Num = 2 Hash Num = 3 Hash Num = 4 (a) ARE. 200 300 400 500 600 700 800 900 1000 Memory (KB) 1 2 3 4 5 AAE Hash Num = 1 Hash Num = 2 Hash Num = 3…
Figure 6
Figure 6. Figure 6: Accuracy vs. # hash functions. avoiding collision-induced errors. Once the bucket size reaches 8, further increases lead to only marginal improvements. Therefore, we set the bucket size in the heavy part to 8. Heavy ratio ( [PITH_FULL_IMAGE:figures/full_fig_p006_6.png]
Figure 7
Figure 7. Figure 7: Accuracy of flow size query on CAIDA dataset. [PITH_FULL_IMAGE:figures/full_fig_p007_7.png]
Figure 8
Figure 8. Figure 8: Accuracy of heavy hitter query on CAIDA dataset. [PITH_FULL_IMAGE:figures/full_fig_p007_8.png]
Figure 9
Figure 9. Figure 9: Accuracy of HHH query on CAIDA dataset. that for heavy hitter query, we only use the heavy part, because heavy hitter query focuses solely on large-flow accuracy. # hash functions ( [PITH_FULL_IMAGE:figures/full_fig_p007_9.png]
Figure 10
Figure 10. Figure 10: Accuracy of flow size query on other datasets. [PITH_FULL_IMAGE:figures/full_fig_p008_10.png]
Figure 11
Figure 11. Figure 11: Accuracy of flow size query on other datasets. [PITH_FULL_IMAGE:figures/full_fig_p008_11.png]
Figure 12
Figure 12. Figure 12: Model accuracy. 0.0 2.5 5.0 7.5 10.0 12.5 15.0 17.5 20.0 Time from Training Data (min) 0.78 0.80 0.82 0.84 0.86 0.88 0.90 Model F1 Ours Baseline (a) F1 score of model. 0.0 2.5 5.0 7.5 10.0 12.5 15.0 17.5 20.0 Time from Training Data (min) 0.87 0.88 0.89 0.90 0.91 0.92…
Figure 13
Figure 13. Figure 13: Accuracy over time. accuracy shows only a slight decrease. At the 20-minute mark, the classifier’s F1 scores for LLM-Sketch and the baseline drop by 0.059 and 0.113, respectively, while the sketch’s end-to-end F1 scores also drop by 0.017 and 0.069, respectively. 6 Re…

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Towards a Playground to Democratize Experimentation and Benchmarking of AI Agents for Network Troubleshooting

    cs.NI 2025-07 conditional novelty 5.0 of 10

    A proposal and proof-of-concept for a modular Kathara-based platform that lets AI agents interact with emulated networks and be benchmarked on troubleshooting tasks.

Reference graph

Works this paper leans on

43 extracted references · 32 canonical work pages · cited by 1 Pith paper

  1. [1]

    Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Floren- cia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. 2023. Gpt-4 technical report. arXiv preprint arXiv:2303.08774 (2023)

  2. [2]

    Mohammad Al-Fares, Sivasankar Radhakrishnan, Barath Raghavan, Nelson Huang, Amin Vahdat, et al . 2010. Hedera: dynamic flow scheduling for data center networks.. In Nsdi, Vol. 10. San Jose, USA, 89–92

  3. [3]

    Mohammad Alizadeh, Tom Edsall, Sarang Dharmapurikar, Ramanan Vaidyanathan, Kevin Chu, Andy Fingerhut, Vinh The Lam, Francis Matus, Rong Pan, Navindra Yadav, et al. 2014. CONGA: Distributed congestion-aware load balancing for datacenters. In Proceedings of the 2014 ACM conference on SIGCOMM. 503–514

  4. [4]

    Ran Ben Basat, Xiaoqi Chen, Gil Einziger, and Ori Rottenstreich. 2020. Design- ing heavy-hitter detection algorithms for programmable switches. IEEE/ACM Transactions on Networking 28, 3 (2020), 1172–1185

  5. [5]

    Ran Ben-Basat, Gil Einziger, Roy Friedman, and Yaron Kassner. 2016. Heavy hitters in streams and sliding windows. In IEEE INFOCOM 2016-The 35th Annual IEEE International Conference on Computer Communications . IEEE, 1–9

  6. [6]

    Ran Ben Basat, Gil Einziger, Roy Friedman, Marcelo C Luizelli, and Erez Waisbard

  7. [7]

    Theophilus Benson, Aditya Akella, and David A Maltz. 2010. Network traffic char- acteristics of data centers in the wild. In Proceedings of the 10th ACM SIGCOMM conference on Internet measurement . 267–280

  8. [8]

    Dimitris Bertsimas and Vassilis Digalakis. 2021. Frequency estimation in data streams: Learning the optimal hashing scheme. IEEE Transactions on Knowledge and Data Engineering 35, 2 (2021), 1541–1553

Show all 43 references
  1. [9]

    Burton H Bloom. 1970. Space/time trade-offs in hash coding with allowable errors. Commun. ACM 13, 7 (1970), 422–426

  2. [10]

    Yukun Cao, Yuan Feng, and Xike Xie. 2023. Meta-sketch: A neural data structure for estimating item frequencies of data streams. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 37. 6916–6924

  3. [11]

    Moses Charikar, Kevin Chen, and Martin Farach-Colton. 2002. Finding frequent items in data streams. In International Colloquium on Automata, Languages, and Programming. Springer, 693–703

  4. [12]

    Graham Cormode and Shan Muthukrishnan. 2005. An improved data stream summary: the count-min sketch and its applications. Journal of Algorithms 55, 1 (2005), 58–75

  5. [13]

    Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2018. Bert: Pre-training of deep bidirectional transformers for language understanding.arXiv preprint arXiv:1810.04805 (2018)

  6. [14]

    Rui Ding, Shibo Yang, Xiang Chen, and Qun Huang. 2023. Bitsense: Universal and nearly zero-error optimization for sketch counters with compressive sensing. In Proceedings of the ACM SIGCOMM 2023 Conference . 220–238

  7. [15]

    Cristian Estan and George Varghese. 2002. New directions in traffic measurement and accounting. In Proceedings of the 2002 conference on Applications, technologies, architectures, and protocols for computer communications . 323–336

  8. [16]

    Hong Ye He, Zhi Guo Yang, and Xiang Ning Chen. 2020. PERT: Payload encoding representation from transformer for encrypted traffic classification. In 2020 ITU Kaleidoscope: Industry-Driven Digital Transformation (ITU K) . IEEE, 1–8

  9. [17]

    Chen-Yu Hsu, Piotr Indyk, Dina Katabi, and Ali Vakilian. 2019. Learning-Based Frequency Estimation Algorithms.. In International Conference on Learning Rep- resentations

  10. [18]

    Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. 2021. Lora: Low-rank adaptation of large language models. arXiv preprint arXiv:2106.09685 (2021)

  11. [19]

    Qun Huang, Patrick PC Lee, and Yungang Bao. 2018. Sketchlearn: Relieving user burdens in approximate measurement with automated statistical inference. In Proceedings of the 2018 Conference of the ACM Special Interest Group on Data Communication. 576–590

  12. [20]

    Qun Huang, Siyuan Sheng, Xiang Chen, Yungang Bao, Rui Zhang, Yanwei Xu, and Gong Zhang. 2021. Toward{Nearly-Zero-Error} sketching via compressive sens- ing. In 18th USENIX Symposium on Networked Systems Design and Implementation (NSDI 21). 1027–1044

  13. [21]

    Zhenzhong Lan, Mingda Chen, Sebastian Goodman, Kevin Gimpel, Piyush Sharma, and Radu Soricut. 2019. Albert: A lite bert for self-supervised learning of language representations. arXiv preprint arXiv:1909.11942 (2019)

  14. [22]

    Yuliang Li, Rui Miao, Hongqiang Harry Liu, Yan Zhuang, Fei Feng, Lingbo Tang, Zheng Cao, Ming Zhang, Frank Kelly, Mohammad Alizadeh, et al. 2019. HPCC: High precision congestion control. In Proceedings of the ACM special interest group on data communication . 44–58

  15. [23]

    Xinjie Lin, Gang Xiong, Gaopeng Gou, Zhen Li, Junzheng Shi, and Jing Yu. 2022. Et-bert: A contextualized datagram representation with pre-training transformers for encrypted traffic classification. In Proceedings of the ACM Web Conference

  16. [24]

    Zaoxing Liu, Ran Ben-Basat, Gil Einziger, Yaron Kassner, Vladimir Braverman, Roy Friedman, and Vyas Sekar. 2019. Nitrosketch: Robust and general sketch- based monitoring in software switches. In Proceedings of the ACM Special Interest Group on Data Communication . 334–350

  17. [25]

    Zaoxing Liu, Hun Namkung, Georgios Nikolaidis, Jeongkeun Lee, Changhoon Kim, Xin Jin, Vladimir Braverman, Minlan Yu, and Vyas Sekar. 2021. Jaqen: A{High-Performance}{ Switch-Native} approach for detecting and mitigating volumetric{DDoS} attacks with programmable switches. In30...

  18. [26]

    Rui Miao, Hongyi Zeng, Changhoon Kim, Jeongkeun Lee, and Minlan Yu. 2017. Silkroad: Making stateful layer-4 load balancing fast and cheap using switching asics. In Proceedings of the Conference of the ACM Special Interest Group on Data Communication. 15–28

  19. [27]

    Victor Sanh, L Debut, J Chaumond, and T Wolf. 2019. DistilBERT, a distilled version of BERT: Smaller, faster, cheaper and lighter. arXiv 2019. arXiv preprint arXiv:1910.01108 (2019)

  20. [28]

    Lu Tang, Qun Huang, and Patrick PC Lee. 2019. Mv-sketch: A fast and compact invertible sketch for heavy flow detection in network data streams. In IEEE INFOCOM 2019-IEEE Conference on Computer Communications . IEEE, 2026–2034

  21. [29]

    Lu Tang, Qun Huang, and Patrick PC Lee. 2020. SpreadSketch: Toward invertible and network-wide detection of superspreaders. In IEEE INFOCOM 2020-IEEE Conference on Computer Communications . IEEE, 1608–1617

  22. [30]

    Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yas- mine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhos- ale, et al. 2023. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288 (2023)

  23. [31]

    Hengrui Wang, Huiping Lin, Zheng Zhong, Tong Yang, and Muhammad Shahzad

  24. [32]

    Duo Wu, Xianda Wang, Yaqi Qiao, Zhi Wang, Junchen Jiang, Shuguang Cui, and Fangxin Wang. 2024. Netllm: Adapting large language models for networking. In Proceedings of the ACM SIGCOMM 2024 Conference . 661–678

  25. [33]

    Yuchen Xu, Wenfei Wu, Bohan Zhao, Tong Yang, and Yikai Zhao. 2023. MimoS- ketch: A Framework to Mine Item Frequency on Multiple Nodes with Sketches. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. 2838–2849

  26. [34]

    2023.{AAsclepius}: Monitoring, Diagnosing, and Detouring at the Internet Peering Edge

    Kaicheng Yang, Yuanpeng Li, Sheng Long, Tong Yang, Ruijie Miao, Yikai Zhao, Chaoyang Ji, Penghui Mi, Guodong Yang, Qiong Xie, et al. 2023.{AAsclepius}: Monitoring, Diagnosing, and Detouring at the Internet Peering Edge. In 2023 USENIX Annual Technical Conference (USENIX ATC 23...

  27. [35]

    Tong Yang, Jie Jiang, Peng Liu, Qun Huang, Junzhi Gong, Yang Zhou, Rui Miao, Xiaoming Li, and Steve Uhlig. 2018. Elastic sketch: Adaptive and fast network- wide measurements. In Proceedings of the 2018 Conference of the ACM Special Interest Group on Data Communication . 561–575

  28. [36]

    Liu Yinhan, Ott Myle, Goyal Naman, Du Jingfei, Joshi Mandar, Chen Danqi, Levy Omer, and Lewis Mike. 2019. Roberta: A robustly optimized bert pretraining approach. arXiv preprint arXiv:1907.11692 364 (2019). Conference’17, July 2017, Washington, DC, USA Li et al

  29. [37]

    Minlan Yu, Lavanya Jose, and Rui Miao. 2013. Software {Defined}{ Traffic} Measurement with{OpenSketch}. In 10th USENIX symposium on networked systems design and implementation (NSDI 13) . 29–42

  30. [38]

    Menghao Zhang, Guanyu Li, Shicheng Wang, Chang Liu, Ang Chen, Hongxin Hu, Guofei Gu, Qianqian Li, Mingwei Xu, and Jianping Wu. 2020. Poseidon: Mitigating volumetric ddos attacks with programmable switches. In the 27th Network and Distributed System Security Symposium (NDSS 2020)

  31. [39]

    Yinda Zhang, Zaoxing Liu, Ruixin Wang, Tong Yang, Jizhou Li, Ruijie Miao, Peng Liu, Ruwen Zhang, and Junchen Jiang. 2021. CocoSketch: High-performance sketch-based measurement over arbitrary partial key query. In Proceedings of the 2021 ACM SIGCOMM 2021 Conference . 207–222

  32. [40]

    Bohan Zhao, Xiang Li, Boyu Tian, Zhiyu Mei, and Wenfei Wu. 2021. Dhs: Adaptive memory layout organization of sketch slots for fast and accurate data stream processing. In Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining . 2285–2293

  33. [41]

    Ruijie Zhao, Mingwei Zhan, Xianwen Deng, Yanhao Wang, Yijun Wang, Guan Gui, and Zhi Xue. 2023. Yet another traffic classifier: A masked autoencoder based traffic transformer with multi-level flow representation. In Proceedings of the AAAI Conference on Artificial Intelligence ...

  34. [2017]

    In Proceedings of the Conference of the ACM Special Interest Group on Data Communication

    Constant time updates in hierarchical heavy hitters. In Proceedings of the Conference of the ACM Special Interest Group on Data Communication . 127–140

  35. [2022]

    IEEE Trans

    Enhanced machine learning sketches for network measurements. IEEE Trans. Comput. 72, 4 (2022), 957–970

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.