Randomized algorithm based entropy norm computation in hardware for anomaly detection of IP data streams

Entropy measurements have been used for anomaly detection purposes in IP data streams. Randomized algorithms with efficient storage requirements for estimating entropy of data streams are now available in the literature. The main challenge in software implementation for IP data streams has been in storing large volumes of data, along with, the requirement of analysis at high speed. Although hardware architectures for executing such algorithms would be several orders of magnitude faster than software, no attempts to explore hardware for this purpose have been made so far. In this paper, a randomized algorithm available in literature is evaluated for hardware implementation. First the chosen randomized algorithm is improved to obtain a 30.0% reduction in memory requirements. Next two hardware architectural designs are described and analyzed for possible FPGA implementation. The corresponding trade-offs, limitations and resource requirements are discussed.