Sketch-based Entropy Estimation for Network Traffic Analysis using Programmable Data Plane ASICs

Entropy can be used as a measure of concentration and dispersion on a particular header space for network traffic analysis. This work presents the implementation of a sketch-based entropy estimation on programmable data plane ASICs using P4. The estimation scheme, proposed by Clifford and Cosma, leverages the random projection of a maximally skewed stable distribution. On top of a Barefoot Tofino switch, this work transforms the complex computations of the random projection into fast lookup over pre-computed tables in the match-action pipeline. Performance is evaluated based on real-world network traffic traces. Minimum-sized Ethernet frames are generated by hardware traffic generator with pre-defined distributions. The system can estimate the entropy of network traffic accurately at full wire-speed of 100 Gbps throughput.