Cardinality Counting Circuit for Real-Time Abnormal Traffic Detection

Abstract

To resist the growth of abnormal traffic such as P2P, DDoS and Internet worms, this paper discusses a circuit design to realize real-time abnormal traffic detection from broadband networks. Real-time counting of cardinality is the key of the circuit. Although our previous study showed the effectiveness of cardinality counting to detect various abnormal traffic, the slowness of DRAM access prevented us from actually deploying the cardinality counting into backbone network. This paper shows that the use of self-timed pipeline circuit can realize a cardinality counting circuit that can handle up-to 100 Gbps networks by hiding the DRAM access latency.