Abstract

Shannon's empirical entropy is widely used in network monitoring for anomaly detection and resource management. Since recent traffic is most relevant for predicting network behavior, entropy estimation is usually performed over sliding time windows. In modern links this task involves high-speed data streams, where both throughput and memory efficiency are critical. Hardware accelerators provide low-latency, energy-efficient processing within the network, but face strict on-chip memory limits. We propose a streaming algorithm for entropy estimation in sliding windows with discrete steps, tailored to these hardware constraints. The algorithm combines frequency and cardinality sketches, storing the most frequent flows and estimating the rest under a set of observations of the sorted log-log scaled histogram of the flows. Flow frequencies for a window W are reconstructed by merging ten non-sliding frequency sketches, each covering an interval s = W/10. We also design a Field-Programmable Gate Array (FPGA) accelerator architecture that implements this algorithm. On eight real traffic traces with two million flows per window, the algorithm achieves mean relative errors below 0.45% with a standard deviation of 0.14%. The accelerator, implemented on a Xilinx Virtex XCU55 UltraScale+ FPGA, sustains packet processing at over 160 Gbps while using 56% of the available BRAM, leaving capacity for additional tasks. These results show that accurate entropy estimation in sliding windows with discrete steps enables scalable, high-speed monitoring of modern networks.