Network traffic monitoring uses empirical entropy to detect anomalous events such as various types of attacks. However, the exact computation of the entropy in high-speed networks is a difficult process due to the limited memory resources available in the data plane hardware. In this paper, we present a method and hardware accelerator to approximate the empirical entropy of a large data set with high throughput and sublinear memory requirements. Our method uses streaming algorithms that exploit the fine-grained parallelism of existing hardware platforms for data plane processing, such as field-programmable gate arrays (FPGAs). The method uses sketches to compute the cardinality of the stream and the frequencies of the top-K elements on line, and then it estimates the contribution to the entropy of the rest of the stream assuming a simple uniform distribution for these elements. Implemented on a Xilinx UltraScale+ ZCU102 FPGA, the accelerator implements the method using only on-chip memory, with less than 50% resource usage. Tested on real network traces of up to 120 million packets and more than 5 million flows, the accelerator estimates the empirical entropy with less than 1.5% mean relative error and $21~\mu \text{s}$ latency, and supports a minimum throughput of 204 gigabits per second.

中文翻译：

---

使用草图进行网络熵估计的高吞吐量硬件加速器

网络流量监控使用经验熵来检测异常事件，例如各种类型的攻击。然而，由于数据平面硬件中可用的内存资源有限，高速网络中熵的精确计算是一个困难的过程。在本文中，我们提出了一种方法和硬件加速器来近似具有高吞吐量和次线性内存要求的大型数据集的经验熵。我们的方法使用流算法，利用现有硬件平台的细粒度并行性进行数据平面处理，例如现场可编程门阵列 (FPGA)。该方法使用草图来计算流的基数和在线前 K 个元素的频率，然后假设这些元素的简单均匀分布，它估计对流其余部分的熵的贡献。该加速器在 Xilinx UltraScale+ ZCU102 FPGA 上实现，仅使用片上存储器实现该方法，资源使用率低于 50%。在多达 1.2 亿个数据包和超过 500 万个流的真实网络轨迹上进行测试，加速器以小于 1.5% 的平均相对误差和 $21~\mu \text{s}$ 延迟，并支持每秒 204 吉比特的最小吞吐量。