  In the zettabyte era, per-flow measurement becomes more challenging owing to
the growth of both traffic volumes and the number of flows. Also, swiftness of
detection of anomalies (e.g., DDoS attack, congestion, link failure, and so on)
becomes paramount. For fast and accurate anomaly detection, managing an
accurate working set of active flows (WSAF) from massive volumes of packet
influxes at line rates is a key challenge. WSAF is usually located in a very
fast but expensive memory, such as TCAM or SRAM, and thus the number of entries
to be stored is quite limited. To cope with the scalability issue of WSAF, we
propose to use In-DRAM WSAF with scales, and put a compact data structure
called FlowRegulator in front of WSAF to compensate for DRAM's slow access time
by substantially reducing massive influxes to WSAF without compromising
measurement accuracy. We prototype and evaluated our system in a large scale
real-world experiment (connected to monitoring port of our campus main gateway
router for 113 hours, and capturing 122.3 million flows). As one key
application, FlowRegulator detected heavy hitters with 99.8% accuracy.
