How does BRIGHT determine the monitoring intensity based on "uncertainty"? (For example, allocating more detection quotas to which streams?)
BRIGHT uses uncertainty to guide monitoring intensity in the following way:
Flows with high uncertainty get probed more frequently. Uncertainty is measured by the posterior entropy of each flows Gaussian model — a larger variance means the controller is less confident about the flows true rate, so it deserves more attention. Flows that have not been observed recently naturally accumulate higher uncertainty over time.
Stability further refines probing frequency. Beyond entropy, BRIGHT computes a stability score reflecting short-term traffic volatility. Flows with poor stability (i.e., highly variable behavior) receive shorter probing periods, meaning they are polled more aggressively. Conversely, flows that remain stable over time are probed more sparsely, freeing up budget for uncertain or volatile ones.
Flow classification translates uncertainty into priority. Based on entropy and stability, each flow is assigned to one of four categories — stable elephant, stable mouse, unstable, or event flow — each with different default probing periods and priority levels. Event flows (detected anomalies) receive the highest priority boost via the event flag in the scoring function.
Within each slot, a composite score determines who gets probed. When the available budget cannot cover all due flows, BRIGHT ranks them by a score combining normalized entropy, temporal urgency (how overdue the flow is), and the event flag. Only the top-ranked flows are actually polled.
In essence, BRIGHT continuously concentrates its limited monitoring budget on flows where measurement would reduce uncertainty the most, while leaving well-understood stable flows largely unattended.
