14. Our computer security firm has been hired by a Fortune 500 company to improv

Question

14. Our computer security firm has been hired by a Fortune 500 company to improve its network security. Specifically, their company executives are worried by he recent rise in denial of Service (DoS) attacks against large corporations. (A Denial of Service attack attempts to exhaust the resources (memory, disk space, etc.) of a target computer, thereby preventing its normal operation. For instance, a DoS attack against a web server might make a large website unavailable.) We wish to construct an automated DoS detection program using some basic facts. Our preliminary investigation suggests that, on average, a server will receive 30 suspicious connection attempts per hour. (We need not dwell on the definitiorn of "suspicious" here.) (This question was formulated by student Chris Green in response to a homework assignment.) (a) Define an appropriate model for this situatioa, and specify the value(s) we will use for any parameter(s) in this model Based on this model, answer the following questions. (b) Find the probability of no suspicious attempts in the next 10 minutes. (c) What is the mean number of suspicious attempts over the span of one day? (a) What is the expected time until the next suspicious attempt? Given that there have been 3 suspicious attempts in the previous 20 minutes what is the probability that the next such attempt will occur in the next 5 minutes? () Given 3 suspicious connection attempts in the previous 20 minutes, what is the probability that the last previous attempt occurred in the past 5 minutes 4st ?"cv:aus ecc4md. «.st 5 m;

Explanation / Answer

Question 14 .

(a) Here we can define a poissson distribution model where the random variable is the number of suspicious connection attempts per hour.

so the distribution funciton p(x) = POISSON (X ; )

where = 30 per hour.

(b) Here, expected number of suspected attempts in next 10 minutes = (30/60) * 10 = 5 per 10 minutes

so Pr(X =0) = POISSON (X = 0; 5) = e-5 = 0.0067

(c) Mean number of suspicious attempts in one day = 30 * 24 = 720

(d) Expected time for next suspicious attemptes = 1/ = 1/30 Hour = 2 minute

(e) Here there are 3 suspicious attempts in the previous 20 minutes,. But as exponential and poisson distribution are memoryless than it will not affect the probability of next such attempt.

So expected number of attempts in next 5 minutes = 5/2 = 2.5

so Pr( next attempt will happen in next 5 minutes) = 1 - Pr(no attempt will happen in next 5 minutes)

Pr(no attempt will happen in next 5 minutes) = POISSON (X = 0 ; 2.5) = e-2.5 = 0.0821

Pr( next attempt will happen in next 5 minutes) = 1 - 0.0821 = 0.9179

(f) Here the 3 suspicios attempts occue in the previous 20 minutes. So, we have to find that the last previous attempt occur in past 5 minutes.

Pr(Last previous attempt occur in last 5 minutes l 3 attempts in last 20 minutes) = 1 - Pr(No attempt occur in last 5 minutes l 3 attempts in last 20 minutes)

Pr(No attempt occur in last 5 minutes l 3 attempts in last 20 minutes) = Pr(3 attempts in initial 15 minutes) * Pr( NO attempt in last 5 minutes)/ Pr(3 attempts in last 20 minutes)

= POISSON (X = 3; =15/2 = 7.5) * POISSON (X = 0 ; = 5/2 = 2.5) / POISSON (X = 3 ; = 20/2 = 10)

= e-7.5  7.53/3! * e-2.5  2.50/0! / e-10  103/3!

= (7.5/10)3

= 0.4219

Pr(Last previous attempt occur in last 5 minutes l 3 attempts in last 20 minutes) = 1 - 0.4219 = 0.5781

Related Questions

Navigate

• Browse (All)
• Browse 1
• Subjects

---

---

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.