Cardinality is Not Enough: Super Host Detection via Segmented Cardinality Estimation
Abstract
Accurately detecting super host that establishes connections to a large number of distinct peers is significant for mitigating web attacks and ensuring high quality of web service. Existing sketch-based approaches estimate the number of distinct connections called flow cardinality according to full IP addresses, while ignoring the fact that a malicious or victim super host often communicates with hosts within the same subnet, resulting in high false positive rates and low accuracy. Though hierarchical-structure based approaches could capture flow cardinality in subnet, they inherently suffer from high memory usage. To address these limitations, we propose SegSketch, a segmented cardinality estimation approach that employs a lightweight halved-segment hashing strategy to infer common prefix lengths of IP addresses, and estimates cardinality within subnet to enhance detection accuracy under constrained memory size. Experiments driven by real-world traces demonstrate that, SegSketch improves F1-Score by up to 8.04x compared to state-of-the-art solutions, particularly under small memory budgets.
Cite
@article{arxiv.2604.02379,
title = {Cardinality is Not Enough: Super Host Detection via Segmented Cardinality Estimation},
author = {Yilin Zhao and Jiawei Huang and Xianshi Su and Weihe Li and Xin Li and Yan Liu and Jiacheng Xie and Qichen Su and Jin Ye and Wanchun Jiang and Jianxin Wang},
journal= {arXiv preprint arXiv:2604.02379},
year = {2026}
}
Comments
This paper has been accepted at WWW 2026