Tabular Interpolation Approach Based on Stable Random Projection for Estimating Empirical Entropy of High-Speed Network Traffic

The empirical entropy of the network flow attributes is an essential measure for identifying anomalous traffic. However, computing exact values high-speed networks in real-time computationally expensive. Accordingly, present study replaces complex computations existing stable random projection methods estimation with a simple table lookup procedure. Notably, size reduced through piece-wise linear interpolation heuristic order to facilitate implementation proposed scheme resource-constrained pipeline environments. architecture enables be performed using both Log-Mean Estimator (LME) method and New Compressed Counting (NECC) algorithm reported literature. feasibility approach verified empirically real-world traffic traces synthetic data streams. Moreover, practical applicability demonstrated via stream-based programmable planes NetFPGA-Plus framework Tofino P4 switch, respectively. results indicate that tabulation-based allows minimum-sized Ethernet frames processed wire speed up several hundred gigabits per second.