Real-Time DDoS Attack Detection using Sketch-based Entropy Estimation on the NetFPGA SUME Platform

With the rapid increase in network traffic and different types of attacks, real-time anomaly detection has received much attention recently. Shannon entropy can be an essential measure for identifying untypical network traffic; however, it is a time-consuming task to calculate entropy in real-time in the highspeed network environment. This work transforms the complex computations of the Shannon entropy estimation, proposed by Clifford and Cosma, into pre-computed lookup tables in the FPGA. Together with the LSTM-RNN, the proposed system on the NetFPGA SUME platform can detect DDoS attacks accurately at wire-speed of 40 Gbps throughput.