2026-09-19T18:34:53Z https://www.ideals.illinois.edu/oai-pmh

oai:www.ideals.illinois.edu:2142/49735 2023-07-11 col_2142_5131 col_2142_16359 com_2142_5130 com_2142_16358 com_2142_234

Sowers, Richard B. Sowers, Richard B. Abbas, Ali E. Kiyavash, Negar Song, Renming Kone, Roseline 2014-05-30T17:07:05Z 2014-05-30T17:07:05Z 2016-09-22T20:59:27Z 2014-05 2014-05-30T17:07:05Z 2014-05 This thesis presents three procedures to detect Distributed Denial of Service (DDoS) attacks. DDoS attacks are known as one of the most expensive and destructive Internet threats. Assuming network tra c is a marked Poisson process, two parametric detection models are developed. The arrival of packet ows is modeled as Poisson process with cluster sizes that follows a mixture of discrete and heavy tailed distributions. Both detection systems monitor the percentage of unknown source IP addresses. The rst detection model is formulated as a xed sample size binary hypothesis testing. The decision making is based on the Neyman-Pearson criteria. The second parametric model is a sequential probability ratio test where the sample size is a random variable. Acceptance and rejection boundaries are deduced based on Wald's Fundamental Identity. Given that parametric distributions may fail to capture the complex and dynamic nature of the Internet, a third non-parametric detection model is proposed. In addition to the percentage of unknown source IP addresses, a second test statistic is introduced. The latter represents the mean to standard deviation ratio of data packet sizes. The Neyman-Pearson threshold is estimated from the empirical distribution functions of both random variables. Item withdrawn by Mark Zulauf (zulauf@illinois.edu) on 2014-04-23T18:00:19Z Item was in collections: University of Illinois Theses & Dissertations (ID: 1) No. of bitstreams: 2 Kone_Estelle.pdf: 1904919 bytes, checksum: b4b350e1618c4fd2445fbf1276a6352b (MD5) Kone_Estelle.zip: 1200829 bytes, checksum: 3364b2849e9e39756eb130816ee96d59 (MD5) Made available in DSpace on 2014-05-30T17:07:05Z (GMT). No. of bitstreams: 3 Roseline_Kone.pdf: 1904919 bytes, checksum: b4b350e1618c4fd2445fbf1276a6352b (MD5) Kone_Estelle.zip: 1200829 bytes, checksum: 3364b2849e9e39756eb130816ee96d59 (MD5) license.txt: 4060 bytes, checksum: 53232e683498250f19800e67353cd882 (MD5) Item marked as restricted to the 'UIUC Users [automated]' Group (id=2) by Seth Robbins (robbins.sd@gmail.com) on 2014-05-30T17:09:55Z Item is restricted until 2016-05-30T17:09:03Z Restriction data tranferred 2014-07-01T11:39:17-05:00 Original Data Group with Access UIUC Users [automated] Release Date: 2016-05-30 12:09:03 UTC Reason: Author requested U of Illinois access only (OA after 2yrs) in Vireo ETD system U of I Only Restriction Lifted for Item 49786 on 2016-09-22T20:59:27Z. http://hdl.handle.net/2142/49735 en Copyright 2014 Roseline Estelle Sindolmane Kone Poisson Cluster Process Compound Pareto Distribution Binary Hypothesis Testing Sequential Detection Distributed Denial of Service (DDoS) Attacks Monitoring unknown source IP addresses and packet sizes to detect DDoS attacks text Industrial&Enterprise Sys Eng 1422 Industrial Engineering 0127 University of Illinois at Urbana-Champaign Dissertation Ph.D. PHD:Industrial Enginerng -UIUC 10KS0127PHD