跨位置与服务类别的守恒容量预算的自适应两级分配
Adaptive Two-Level Allocation of a Conserved Capacity Budget Across Locations and Service Classes
AI总结：
该研究针对需求不均且可能超供给的场景，提出跨位置与服务类的自适应两级容量分配算法，在CDN防御流量攻击的评估中表现优异，还揭示了竞争场景下吞吐量最大化目标的缺陷及类间借用的价值。
AI中文摘要：
我们研究在需求不均、随时间变化且可能超过供给的情况下，如何将单一守恒容量预算分配给多个位置和两类服务。该场景具有通用性：例如某源点的请求速率上限在其边缘位置间的分配、授权吞吐量上限在 premium（高级）和 standard（标准）租户间的分配，或出口预算在延迟关键型和批处理工作负载间的分配。我们提出一种两级算法：第一级按比例赤字与盈余重分配，在同一服务类内跨位置重新分配容量；第二级在一类有盈余、另一类有赤字时，在服务类间弹性借出容量。我们证明该算法严格守恒预算、保持非负性，且在平稳需求下因无每周期状态，一次迭代即可达到稳定分配，每周期时间复杂度为O(KN)（K为服务类数，N为位置数）。我们在防御CDN（内容分发网络）每域名预算的流量攻击场景中评估该算法，其中两类服务为已确认合法流量与未清流量；在22位置拓扑的8种竞争场景下，该算法可满足66%-93%的高优先级需求，与单类线性规划最优解性能相当，且在总需求达到或超过预算（本次评估的竞争场景）时，不会出现容量闲置或超配情况。两项发现超出应用范畴：其一，竞争场景下吞吐量最大化目标存在缺陷：最大化总服务负载的两类线性规划，在多数场景下提供的高优先级负载少于我们的按需求比例、尊重预留的分配器，因其无法区分所服务的部分负载为竞争流量；其二，类间借用在突发负载下的复杂度是值得的，可将高优先级服务提升1.5个百分点（通过消融实验分离验证），而在平稳需求下无影响。搭载真实HTTP流量的5位置原型验证了该流程。
英文摘要：
We study how to share a single conserved capacity budget across many locations and two service classes when demand is uneven, time-varying, and can exceed supply. The shape recurs: an origin's request-rate cap split across its edge locations, a licensed throughput cap across premium and standard tenants, or an egress budget between latency-critical and batch workloads. We present a two-level algorithm. The first level redistributes capacity within a class across locations by proportional deficit and excess redistribution; the second lends capacity elastically between classes when one has surplus and the other deficit. We prove it conserves the budget exactly, preserves non-negativity, and reaches a stable allocation in one iteration under stationary demand because it carries no per-cycle state, at O(KN) cost per cycle for K classes and N locations. We evaluate it defending a CDN's per-domain budget under volumetric attack, where the classes are confirmed-legitimate and not-yet-cleared traffic; across 8 contention scenarios on a 22-location topology it serves 66-93% of high-priority demand, competitive with a single-class linear-programming optimum, while never leaving capacity idle or over-committing whenever aggregate demand meets or exceeds the budget (the contention regime these scenarios evaluate). Two findings carry beyond the application. First, a throughput-maximizing objective is wrong under contention: a two-class LP maximizing total served load serves less high-priority load than our demand-proportional, reservation-respecting allocator in most scenarios, because it cannot tell that some load it serves is the contention. Second, inter-class borrowing earns its complexity under bursty load, improving high-priority service by 1.5 points (isolated by ablation), and is neutral under stationary demand. A 5-location prototype with real HTTP traffic validates the pipeline.
