: Flow-based anomaly detection is a basic approach to identify large-scale network attacks such as Denial-of-Service (DoS) attack in high-speed computer networks. In this approach instead of packet content, the flows of network traffic are iected. One of the anomaly detection approaches is that big change is detected during data streaming computation. This approach can detect traffic anomalies by deriving a model of normal behavior based on the past traffic history and looking for significant changes in traffic pattern in short time intervals. In the other words, heavy changes often indicate network anomalies or attacks. To deal with the large volume of communication flows, a technique or data structure called sketch used to record and store useful information of the flows for realization heavy change detection. The most important advantage of this data structure is to organize and summarize the huge information in a small amount of memory. Sketch can be implemented in the software or hardware environment. However, software implementation is very easy, hardware implementation guarantees the throughput and efficiency in multi-gigabit network links. Consider to the flexibility and parallelism property of FPGA platform, it makes suitable choice for hardware sketch implementation. In this thesis, three FPGA frameworks based on sketch method has been proposed and implemented to detect heavy changes in the network. The first one, is a fully hardware system to implement K-ary Sketch which is one of the most important sketch for heavy change detection. In the second one, propose a new method for updating and querying to the sketch simultaneously. Since it can omit the delay of attack detection and alert generation, the second method is suitable for real time detection usage. By adding a level of accuracy, the third proposed method has offered a hybrid solution that combines the simultaneous update and query design with an after-interval detection technique. Keywords: Anomaly, Heavy Change Detection, Sketch, Simultaneous Update and Query, FPGA.
