Due to the deficiency of traffic measurement capability in high-speed network,it's valuable for detecting large-scale network security incident to identify heavy hitters precisely in time.An algorithm of identifying heavy hitters based on two-level replacement mechanism is proposed in this paper.In this algorithm, LRU replacement and LEAST replacement are combined together to improve its accuracy.The heavy hitters can be identified accurately in small constant memory space,so the data can be treated more rapidly in limited space of SRAM.It's unnecessary to provide more memory space for more network data,so the algorithm is scalable.