1. A High-Throughput Hardware Accelerator for Network Entropy Estimation Using Sketches
- Author
-
Javier E. Soto, Paulo Ubisse, Yaime Fernandez, Miguel Figueroa, and Cecilia Hernandez
- Subjects
network monitoring ,streaming algorithms ,General Computer Science ,Computer science ,02 engineering and technology ,Computational science ,Computer Science::Hardware Architecture ,Empirical entropy ,hardware acceleration ,0202 electrical engineering, electronic engineering, information engineering ,Forwarding plane ,Entropy (information theory) ,General Materials Science ,Field-programmable gate array ,field-programmable gate arrays ,Throughput (business) ,sketches ,Network packet ,General Engineering ,020206 networking & telecommunications ,TK1-9971 ,Memory management ,Hardware acceleration ,020201 artificial intelligence & image processing ,Electrical engineering. Electronics. Nuclear engineering ,Streaming algorithm - Abstract
Network traffic monitoring uses empirical entropy to detect anomalous events such as various types of attacks. However, the exact computation of the entropy in high-speed networks is a difficult process due to the limited memory resources available in the data plane hardware. In this paper, we present a method and hardware accelerator to approximate the empirical entropy of a large data set with high throughput and sublinear memory requirements. Our method uses streaming algorithms that exploit the fine-grained parallelism of existing hardware platforms for data plane processing, such as field-programmable gate arrays (FPGAs). The method uses sketches to compute the cardinality of the stream and the frequencies of the top-K elements on line, and then it estimates the contribution to the entropy of the rest of the stream assuming a simple uniform distribution for these elements. Implemented on a Xilinx UltraScale+ ZCU102 FPGA, the accelerator implements the method using only on-chip memory, with less than 50% resource usage. Tested on real network traces of up to 120 million packets and more than 5 million flows, the accelerator estimates the empirical entropy with less than 1.5% mean relative error and $21~\mu \text{s}$ latency, and supports a minimum throughput of 204 gigabits per second.
- Published
- 2021