A Sketch Framework for Fast, Accurate and Fine-Grained Analysis of Application Traffic.

The article focuses on AppSketch, a novel sketch-based framework designed for real-time, fine-grained application-level network traffic analysis. AppSketch employs a two-stage process: lightweight packet inspection classifies each packet by application type, and a multiple-key sketch data structure supports efficient, reversible queries on full and partial keys (e.g., application tags and source IPs). Evaluated on real-world campus network traffic, AppSketch demonstrated superior accuracy and update efficiency compared to existing sketch methods while requiring limited memory (≤64 KB), making it suitable for deployment on online network devices. The study also presents a use case analyzing campus traffic patterns, identifying HTTP/HTTPS and audio/video applications as dominant, and highlights potential future work on encrypted traffic handling and scalability.