An Accurate and Invertible Sketch for Super Spread Detection

Round 1

Reviewer 1 Report

Comments and Suggestions for Authors

This paper tackles the complex task of real-time super spread detection with limited memory resources, a critical concern in network management, recommender systems, and cyberspace security. The suggested invertible sketch method, along with a power-weakening increment strategy, presents an effective approach to foster early-stage competition and ensure accuracy in identifying super spread instances. Through experimental evaluation using genuine Internet traffic traces and recommender system datasets, the proposed sketch demonstrates superior performance compared to state-of-the-art alternatives. The notable reduction in super spread cardinality estimation error, ranging from at least 2.6 times lower than previous algorithms, highlights the significance and efficacy of the proposed method in refining the precision of super spread detection, even when faced with memory constraints.

This paper commendably shares the dataset and relevant code via Github, facilitating the validation of research outcomes and enabling scholars to extend the discourse on this study's topic. Regrettably, an issue is noted in the numbering format of Section 2, "Overview," starting at line 141, and the subsequent Section 3.1. The author is kindly advised to carefully review and rectify this numbering discrepancy. Additionally, it is recommended to consider refining the presentation of Theorem 1 at lines 268 and 272 for enhanced readability by the readers.

Author Response

Please see the attachment.

Author Response File: Author Response.pdf

Reviewer 2 Report

Comments and Suggestions for Authors

The authors propose a variant of the Adaptive Insertion Sort (AIS) algorithm with the Self-Tuning Sequential Dictionary (SSD) data structure, thus providing an improved computational method for detecting superspreads within data streams in real time. Based on numerical simulations, the authors show that their method outperforms existing methods in terms of higher accuracy while being more resource efficient.

 

This is a very solid paper, not only very detailed on the aspects of the proposed improvements, but also very thorough in testing them against competing methods. The topic of the paper is highly relevant, as the efficient detection of super-spreads is becoming increasingly important as Internet traffic grows and with it spamming and hacking activity. The paper includes a detailed description of the problems commonly encountered in detecting super-spreads and the strategy that their method uses to overcome these problems. The paper also includes a mathematical proof of a central inequality concerning their so-called power-weakening probability.

There are only a few minor issues that should be addressed:

1. The introduction is clearly aimed at a highly specialised audience. None of the technical terms ("flow", "super spread", "sketch", etc.) are explained or motivated. I would recommend that at least a few lines be devoted to introducing and contextualising the key technical terms, to make it easier for a more general reader to get started.

2. Although flow cardinality and flow spread are explained to mean the same thing, it is still confusing when they are both used in the same sentence to refer to the same concept, as in LL28-29.

3. To improve readability, the names of algorithms such as "cSkt", "gmf", "Count-Min" or "SpreadSketch" should be distinguished from ordinary words, e.g. by italicising them or using a different font.

4. The first column in Table 2 contains vertically compressed and therefore unreadable symbols.

5. Theorem 1 on page 8 starts with an incomplete paragraph, which makes the core statement of the theorem difficult to understand. Also, the paragraph is an almost perfect copy of the paragraph before Theorem 1. Something must have gone wrong in the typesetting of the manuscript.

6. Figures should be grouped into fewer, larger figures with individual labelled panels and a corresponding caption. As it is, there are too many different figures with highly repetitive captions.

7. The authors should consider, compare and refer to a very recent and highly relevant study by Zhang et al, which also presents an improved method for superspread detection. The study is available at doi: 10.1016/j.comnet.2023.110059.

With these issues adequately addressed, I would recommend the paper for publication.

Author Response

Please see the attachment.

Author Response File: Author Response.pdf

Reviewer 3 Report

Comments and Suggestions for Authors

Your work on SSD-AIS is innovative and fills a significant gap in network data analysis. 

 

To enhance the robustness of your findings, consider including a wider range of datasets and real-world scenarios in your testing. Diverse network environments and traffic conditions could provide a more comprehensive evaluation of SSD-AIS's effectiveness.

 

Possible limitations in scalability and adaptability in diverse network environments not extensively discussed. The complexity of the concepts might limit its accessibility; lack of broad real-world testing.

 

Potentially complex for practical implementation, possible scalability issues.

Comments on the Quality of English Language

None

Author Response

Please see the attachment.

Author Response File: Author Response.pdf