Botnets are becoming the predominant threat on the Internet today and is the primary vector for carrying out attacks against organizations and individuals. Botnets have been used in a variety of cybercrime, from click-fraud to DDOS attacks to the generation of spam. In this thesis we propose an approach to detect botnet activity using two different strategies both based on machine learning techniques. In one, we examine the network flow based metrics of potential botnet traffic and show that we are able to detect botnets with only data from a small time interval of operation. For our second technique, we use a similar strategy to identify botnets based on their potential fast flux behavior. For both techniques, we show experimentally that the presence of botnets may be detected with a high accuracy and identify their potential limitations. / Graduate

Este trabalho visa realizar uma análise exploratória de método utilizando Wavelet para analisar as variações na corrente de tráfego verificando simultaneamente os padrões no comportamento do tráfego e momentos atípicos, em diferentes escalas de tempo, através da Transformada Wavelet e métodos complementares em dados históricos do tráfego veicular. Os dados empíricos utilizados foram coletados separadamente para cada faixa de tráfego, em intervalos de curta duração (5 ou 6 minutos), em rodovias do estado de São Paulo. A partir desses dados, foram gerados os componentes de aproximação e detalhe da Transformada Wavelet Discreta de Haar. Os componentes gerados foram analisados e caracterizados antes de aplicar os métodos complementares. Para o reconhecimento de padrões no comportamento do tráfego foram utilizados os componentes de aproximação e a análise de agrupamento. Os resultados indicaram: (1) que existe grande tendência de classificar dias úteis típicos com terças, quartas e quintas-feiras, (2) a influência dos feriados na quantidade de agrupamentos, (3) a existência de diferentes efeitos para cada feriado e (4) influência do feriado de forma distinta a cada sentido da rodovia. Para detecção de momentos atípicos foram utilizados os coeficientes de detalhe e determinado um threshold em função do desvio padrão do coeficiente para determinar o que foi considerado como anomalia. Os resultados indicaram: (1) os primeiros níveis de decomposição apresentaram maior número de anomalias, (2) análises em sinais de período mensal concentraram mais anomalias do que a análise em um sinal de período anual, (3) a concentração de anomalias por tipo de dia está diretamente relacionada com o fluxo direcional e (4) identificou falhas no sensor. / This work aims to achieve an exploratory method analysis using Wavelet to analyze of traffic flow variations, evaluating both traffic behavior patterns and atypical moments, in different time scales, using Wavelet Transform and complementary traffic history data. Empirical data was collected separately for each traffic lane, in short intervals (5 or 6 minutes), in São Paulo state highways. The Haars Discrete Wavelet Transform approximation and detail components were generated from this collected data. These components were analyzed and characterized before using complementary methods. For pattern recognition in traffic behavior, approximation components were used, with cluster analysis. Results indicate that: (1) there is a great tendency in classifying work days in Tuesdays, Wednesdays and Thursdays, (2) holydays have influence in number of clusters, (3) each holyday have different effects and (4) holydays have different influences in each traffic direction. For the detection of atypical moments, detail coefficients were used with a determined threshold based on the standard deviation of said coefficient to define what was considered as an anomaly. Results indicate that: (1) the first levels of decomposition show a bigger number of anomalies, (2) monthly period signal analysis concentrate more anomalies than annual signals, (3) the anomaly concentration by each kind of day is directly related to traffic direction and (4) sensor flaws are identified.

Este trabalho visa realizar uma análise exploratória de método utilizando Wavelet para analisar as variações na corrente de tráfego verificando simultaneamente os padrões no comportamento do tráfego e momentos atípicos, em diferentes escalas de tempo, através da Transformada Wavelet e métodos complementares em dados históricos do tráfego veicular. Os dados empíricos utilizados foram coletados separadamente para cada faixa de tráfego, em intervalos de curta duração (5 ou 6 minutos), em rodovias do estado de São Paulo. A partir desses dados, foram gerados os componentes de aproximação e detalhe da Transformada Wavelet Discreta de Haar. Os componentes gerados foram analisados e caracterizados antes de aplicar os métodos complementares. Para o reconhecimento de padrões no comportamento do tráfego foram utilizados os componentes de aproximação e a análise de agrupamento. Os resultados indicaram: (1) que existe grande tendência de classificar dias úteis típicos com terças, quartas e quintas-feiras, (2) a influência dos feriados na quantidade de agrupamentos, (3) a existência de diferentes efeitos para cada feriado e (4) influência do feriado de forma distinta a cada sentido da rodovia. Para detecção de momentos atípicos foram utilizados os coeficientes de detalhe e determinado um threshold em função do desvio padrão do coeficiente para determinar o que foi considerado como anomalia. Os resultados indicaram: (1) os primeiros níveis de decomposição apresentaram maior número de anomalias, (2) análises em sinais de período mensal concentraram mais anomalias do que a análise em um sinal de período anual, (3) a concentração de anomalias por tipo de dia está diretamente relacionada com o fluxo direcional e (4) identificou falhas no sensor. / This work aims to achieve an exploratory method analysis using Wavelet to analyze of traffic flow variations, evaluating both traffic behavior patterns and atypical moments, in different time scales, using Wavelet Transform and complementary traffic history data. Empirical data was collected separately for each traffic lane, in short intervals (5 or 6 minutes), in São Paulo state highways. The Haars Discrete Wavelet Transform approximation and detail components were generated from this collected data. These components were analyzed and characterized before using complementary methods. For pattern recognition in traffic behavior, approximation components were used, with cluster analysis. Results indicate that: (1) there is a great tendency in classifying work days in Tuesdays, Wednesdays and Thursdays, (2) holydays have influence in number of clusters, (3) each holyday have different effects and (4) holydays have different influences in each traffic direction. For the detection of atypical moments, detail coefficients were used with a determined threshold based on the standard deviation of said coefficient to define what was considered as an anomaly. Results indicate that: (1) the first levels of decomposition show a bigger number of anomalies, (2) monthly period signal analysis concentrate more anomalies than annual signals, (3) the anomaly concentration by each kind of day is directly related to traffic direction and (4) sensor flaws are identified.

No description available.

The purpose of this study was to investigate how people in Skellefteå municipality transport behavior looks like. Skellefteå municipality is working on developing the traffic planning, but are the improvement opportunities similar to that the people in this study put forward. To investigate what limitations and other underlying factors there are that can influence these people's choice of means of transport. To see if these people could consider switching to using more environmentally friendly means of transport during their daily commute. Since Skellefteå municipality's goal is that car use within the municipality should not continue to relatively increase. To investigate and analyze this, seven respondents from the municipality of Skellefteå were interviewed, what their daily commutes look like and their experiences and opinions within the various transport options. The results show that depending on the stage of life the respondents are in, there are more or fewer restrictions on their daily commute. The people in the study also faced limitations in their daily commute that could be explained by restrictions in time geography that affected their movement between their home and work. With all aspects in mind, changing means of transport within the daily commute is seen as complex. Currently, the people in this study do not see public transport in Skellefteå as an alternative that would replace the car within their daily commute, as public transport does not meet their needs. But to use a bicycle within its daily commute as more likely, as the measures presented by the municipality and the improvement opportunities presented by the respondents in this study agreed to some extent. The development that the municipality of Skellefteå is carrying out in pedestrian and bicycle traffic could lead to these respondents switching to a certain extent using bicycles as an alternative means of transport within their daily commute. Nudging is used to see how the municipality of Skellefteå works with measures that could promote traffic behavior among the municipality's residents, which could result in more environmentally friendly passenger traffic.

This project is an in-depth investigation on the impact of lighting, marking and paint schemes on the operational aspects of police vehicles. This investigation consisted of two phases that ultimately consisted of four experiments. An array of lighting and marking schemes were implemented on police vehicles in a variety of jurisdictions for evaluation. The study then investigated the change in the visibility of police officers, the public reaction to these schemes, and the operational impacts of these systems. The first phase of the project was a naturalistic observation study where the goal was to better understand how traffic behaved around traffic stops. Test vehicles were positioned in simulated traffic stops and patrol locations to determine how traffic behavior was affected by various configurations of police lighting and markings. Camera and radar systems were used to measure the changes in driver speed and when drivers responded to the move over law. Based on the results of the naturalistic studies, the impact of the lighting system on officer visibility was investigated in a controlled human factors test where the ability of a driver to see a police officer outside of their vehicle was measured in the presence of the lighting systems. The purpose of this interjected effort was to verify that the experimental schemes would not increase risk to law enforcement despite data from the first phase indicating the vehicles were more visible. A second part to that study evaluated conventional methods of bolstering an officer's visibility outside of their vehicle at night. The second phase took the findings of the first phase and implemented changes to several police vehicles from local and state agencies to be in operation for at least 18 months. This was to assess the rate of near-misses and crash rate to relate the vehicle changes to law enforcement safety. Additionally, rates of citations were assessed, and surveys offered an opportunity for law enforcement to provide their own feedback on the implementations. The lighting systems evaluated included a completely blue lighting system, an enhanced all blue lighting system with twice the light output, a red and blue system, and a single flashing blue beacon. In terms of markings, retroreflective markings along the side of the vehicle, a retroreflective contour line, chevrons on the rear of the vehicle and unmarked vehicles were evaluated. Finally, a variety of vehicle colors were used to investigate the impact of the base vehicle paint color. The results indicate that both the red and blue lighting system and the high output blue lighting system increase the distance at which drivers moved over significantly. In general, at least 95% of traffic attempted to merge away from an actively lighted police vehicle, when possible. In terms of the speed change, drivers began reducing their speed by approximately 600 m from the police vehicle. Similarly, the addition of retroreflectivity to the rear of the vehicle showed an additional benefit for causing drivers to move over sooner. However, these benefits came at a cost to the officer's visibility. When outside of their vehicle, the high output blue system significantly reduced officer detectability while the red and blue configuration only impacted detection distance by 3 meters. The investigation did find that these impacts could be overcome with retroreflective vests worn by the officers. In the second phase, a preference revealed by officers favored the red-blue configuration. They stated that this configuration provided greater comfort for them and less glare to approaching drivers. The study also revealed that the alternative configurations did not impact the operational activities of police authority. / Doctor of Philosophy / This project evaluated how lighting, marking and paint schemes on police vehicles affected their visibility and how traffic responded to them. An observational study positioned police vehicles with alternative lighting and markings in simulated traffic stops and patrol locations to evaluate traffic behavior. Camera and radar systems were used to measure the changes in driver speed and when drivers responded to the Move Over law. A second study evaluated how the lighting systems on a police car affect the visibility of an officer at night in a traffic stop scenario. A followup experiment looked into methods for bolstering the visibility of officers at night through conventional implementations such as body worn LED lighting, the use of a retroreflective vest, or by using lighting on the police vehicle's light bar to increase illumination of the police officer. A third study took the findings of the previous experiments and outfitted 64 Virginia State Police vehicles for 18 months. Another 64 Virginia State Police vehicles participated in a control condition where no changes were made to their vehicles. Data collected included the rate of near-misses or crashes and the rates of written citations. Surveys were administered to each participating officer regarding their perception of safety and comfort and allowed their open feedback and suggestions. The lighting systems evaluated included a completely blue lighting system, an enhanced all blue lighting system with twice the light output, a red and blue system, and a single flashing blue beacon. In terms of markings, retroreflective markings along the side of the vehicle, a retroreflective contour line, chevrons on the rear of the vehicle, and unmarked vehicles were evaluated. Finally, a variety of vehicle colors were used to investigate the impact of the base vehicle paint color. The results indicate that both the red and blue lighting system and the high output blue lighting system increase the distance at which drivers moved over significantly. In general, at least 95% of traffic attempted to merge away from an actively lighted police vehicle, when possible. In terms of the speed change, drivers began reducing their speed by approximately 600 m from the police vehicle. Similarly, the addition of retroreflectivity to the rear of the vehicle showed an additional benefit for causing drivers to move over sooner. However, these benefits came at a cost to the officer's visibility. When outside of their vehicle, the high output blue system significantly reduced officer detectability while the red and blue configuration only impacted detection distance by 3 meters. The investigation did find that these impacts could be overcome with retroreflective vests worn by the officers. In the second phase, a preference revealed by officers favored the red-blue configuration. They stated that this configuration provided greater comfort for them and less glare to approaching drivers. The study also revealed that the alternative configurations did not impact the rate of citations.

Multimodalität, die Nutzung mehrerer Verkehrsmittel innerhalb eines bestimmten Zeitraums, ist ein Sammelbegriff für sehr unterschiedlich in der Alltagspraxis umgesetztes Mobilitätsverhalten. Sie wird als Gegenkonzept zur einseitigen Nutzung des privaten Autos verstanden, mit dem sich große Hoffnungen für die zukünftige Entwicklung des Verkehrs verbinden. Bisherige Arbeiten grenzen den betrachteten Personenkreis fast immer auf eine bestimmte Form multimodalen Verhaltens ein, allen voran auf die Nutzung des Autos und öffentlicher Verkehrsmittel. Ansatzpunkt der vorliegenden Arbeit ist es, die verschiedenen Facetten multimodalen Verhaltens in ihrer Gesamtheit darzustellen und zu untersuchen. Hierzu wird eine Klassifikation entwickelt, die sich aus der Modalwahl ableitet. Die Analyse des Mobilitätsverhaltens basiert auf den Daten des Deutschen Mobilitätspanels von 1999 bis 2008 und der Studie Mobilität in Deutschland aus den Jahren 2002 und 2008. In Abhängigkeit davon, welche der Verkehrsmittel MIV, ÖV und Fahrrad im Verlauf einer Woche zum Einsatz kommen, werden die Probanden einer Modalgruppe zugeordnet. Die Analyse lässt den enormen Facettenreichtum multimodalen Verhaltens erkennen. Generell ist multimodales Verhalten eine urbane Verhaltensweise, die v.a. den Alltag junger Personen prägt und dies in zunehmendem Maß. In Summe legen Multimodale weniger Kilometer mit dem Auto zurück als monomodale Autofahrer. Ihr CO2-Fußabdruck fällt je nach Datensatz um 20 bis 34 Prozent geringer aus als der von ausschließlichen Autofahrern. Nichtsdestotrotz nutzen viele Multimodale das Auto für einen erheblichen Anteil ihrer Wege. In Zukunft wird ausschlaggebend sein, wie sich die Verkehrsmittelanteile v.a. in Bezug auf weite Wege verändern und wie sich die gegenwärtig auf der Nachfrage- und Angebotsseite feststellbaren Veränderungen auswirken. / Multimodality, the use of several modes of transportation during a specified time period, is a general term for a wide variety of everyday mobility behaviors. It is perceived as an alternative to one-sided use of private cars, and one which has attracted great hopes for the future development of transportation. Based on the research which has been done in the past, people almost always limit themselves to a particular form of multimodal behavior, most often to use of cars and public transportation. The starting point of the present paper is to present and examine the various facets of multimodal behavior in their entirety. To this end, a method of classification will be developed which is derived from the selection of modes of transportation. The analysis of mobility behavior will be based on the data of the German Mobility Panel from 1999 to 2008 and the Mobility in Germany study from the years 2002 and 2008. Subjects will be assigned to modal groups depending on which of the modes of transportation, motorized individual traffic, public transportation and bicycle, are used in the course of a week. The analysis reveals the enormously diverse nature of multimodal behavior. In general, multimodal behavior is an urban phenomenon which is increasingly characterizing the everyday urban routine, especially for younger persons. In aggregate, multimodal persons drive fewer kilometers by car than monomodal car drivers. Their carbon footprint is 20-34 percent less than that of exclusive car drivers, depending on the data set. Nevertheless, many multimodal persons do use cars for a considerable portion of their travel needs. How the relative share of the various modes of transportation will change in the future, especially with respect to long-distance travel, and the impact of the currently observable changes in supply and demand will be decisive factors in the future.

[ES] En la actualidad, uno de los principales desafíos a los que se enfrentan las grandes áreas metropolitanas es la congestión provocada por el tráfico, la cual se ha convertido en un problema importante al que se enfrentan las autoridades de cada ciudad. Para abordar este problema es necesario implementar una solución eficiente para controlar el tráfico que genere beneficios para los ciudadanos, como reducir los tiempos de viaje de los vehículos y, en consecuencia, el consumo de combustible, el ruido, y la contaminación ambiental. De hecho, al analizar adecuadamente la demanda de tráfico, es posible predecir las condiciones futuras del tráfico, y utilizar esa información para la optimización de las rutas tomadas por los vehículos. Este enfoque puede ser especialmente efectivo si se aplica en el contexto de los vehículos autónomos, que tienen un comportamiento más predecible, lo cual permite a los administradores de la ciudad mitigar los efectos de la congestión, como es la contaminación, al mejorar el flujo de tráfico de manera totalmente centralizada. La validación de este enfoque generalmente requiere el uso de simulaciones que deberían ser lo más realistas posible. Sin embargo, lograr altos grados de realismo puede ser complejo cuando los patrones de tráfico reales, definidos a través de una matriz de Origen/Destino (O-D) para los vehículos en una ciudad, son desconocidos, como ocurre la mayoría de las veces. Por lo tanto, la primera contribución de esta tesis es desarrollar una heurística iterativa para mejorar el modelado de la congestión de tráfico; a partir de las mediciones de bucle de inducción reales hechas por el Ayuntamiento de Valencia (España), pudimos generar una matriz O-D para la simulación de tráfico que se asemeja a la distribución de tráfico real. Si fuera posible caracterizar el estado del tráfico prediciendo las condiciones futuras del tráfico para optimizar la ruta de los vehículos automatizados, y si se pudieran tomar estas medidas para mitigar de manera preventiva los efectos de la congestión con sus problemas relacionados, se podría mejorar el flujo de tráfico en general. Por lo tanto, la segunda contribución de esta tesis es desarrollar una Ecuación de Predicción de Tráfico para caracterizar el comportamiento en las diferentes calles de la ciudad en términos de tiempo de viaje con respecto al volumen de tráfico, y aplicar una regresión logística a esos datos para predecir las condiciones futuras del tráfico. La tercera y última contribución de esta tesis apunta directamente al nuevo paradigma de gestión de tráfico previsto, tratándose de un servidor de rutas capaz de manejar todo el tráfico en una ciudad, y equilibrar los flujos de tráfico teniendo en cuenta las condiciones de congestión del tráfico presentes y futuras. Por lo tanto, realizamos un estudio de simulación con datos reales de congestión de tráfico en la ciudad de Valencia (España), para demostrar cómo se puede mejorar el flujo de tráfico en un día típico mediante la solución propuesta. Los resultados experimentales muestran que nuestra solución, combinada con una actualización frecuente de las condiciones del tráfico en el servidor de rutas, es capaz de lograr mejoras sustanciales en términos de velocidad promedio y tiempo de trayecto, ambos indicadores de un menor grado de congestión y de una mejor fluidez del tráfico. / [CA] En l'actualitat, un dels principals desafiaments als quals s'enfronten les grans àrees metropolitanes és la congestió provocada pel trànsit, que s'ha convertit en un problema important al qual s'enfronten les autoritats de cada ciutat. Per a abordar aquest problema és necessari implementar una solució eficient per a controlar el trànsit que genere beneficis per als ciutadans, com reduir els temps de viatge dels vehicles i, en conseqüència, el consum de combustible, el soroll, i la contaminació ambiental. De fet, en analitzar adequadament la demanda de trànsit, és possible predir les condicions futures del trànsit, i utilitzar aqueixa informació per a l'optimització de les rutes preses pels vehicles. Aquest enfocament pot ser especialment efectiu si s'aplica en el context dels vehicles autònoms, que tenen un comportament més predictible, i això permet als administradors de la ciutat mitigar els efectes de la congestió, com és la contaminació, en millorar el flux de trànsit de manera totalment centralitzada. La validació d'aquest enfocament generalment requereix l'ús de simulacions que haurien de ser el més realistes possible. No obstant això, aconseguir alts graus de realisme pot ser complex quan els patrons de trànsit reals, definits a través d'una matriu d'Origen/Destinació (O-D) per als vehicles en una ciutat, són desconeguts, com ocorre la majoria de les vegades. Per tant, la primera contribució d'aquesta tesi és desenvolupar una heurística iterativa per a millorar el modelatge de la congestió de trànsit; a partir dels mesuraments de bucle d'inducció reals fetes per l'Ajuntament de València (Espanya), vam poder generar una matriu O-D per a la simulació de trànsit que s'assembla a la distribució de trànsit real. Si fóra possible caracteritzar l'estat del trànsit predient les condicions futures del trànsit per a optimitzar la ruta dels vehicles automatitzats, i si es pogueren prendre aquestes mesures per a mitigar de manera preventiva els efectes de la congestió amb els seus problemes relacionats, es podria millorar el flux de trànsit en general. Per tant, la segona contribució d'aquesta tesi és desenvolupar una Equació de Predicció de Trànsit per a caracteritzar el comportament en els diferents carrers de la ciutat en termes de temps de viatge respecte al volum de trànsit, i aplicar una regressió logística a aqueixes dades per a predir les condicions futures del trànsit. La tercera i última contribució d'aquesta tesi apunta directament al nou paradigma de gestió de trànsit previst. Es tracta d'un servidor de rutes capaç de manejar tot el trànsit en una ciutat, i equilibrar els fluxos de trànsit tenint en compte les condicions de congestió del trànsit presents i futures. Per tant, realitzem un estudi de simulació amb dades reals de congestió de trànsit a la ciutat de València (Espanya), per a demostrar com es pot millorar el flux de trànsit en un dia típic mitjançant la solució proposada. Els resultats experimentals mostren que la nostra solució, combinada amb una actualització freqüent de les condicions del trànsit en el servidor de rutes, és capaç d'aconseguir millores substancials en termes de velocitat faig una mitjana i de temps de trajecte, tots dos indicadors d'un grau menor de congestió i d'una fluïdesa millor del trànsit. / [EN] Currently, one of the main challenges that large metropolitan areas have to face is traffic congestion, which has become an important problem faced by city authorities. To address this problem, it becomes necessary to implement an efficient solution to control traffic that generates benefits for citizens, such as reducing vehicle journey times and, consequently, use of fuel, noise and environmental pollution. In fact, by properly analyzing traffic demand, it becomes possible to predict future traffic conditions, and to use that information for the optimization of the routes taken by vehicles. Such an approach becomes especially effective if applied in the context of autonomous vehicles, which have a more predictable behavior, thus enabling city management entities to mitigate the effects of traffic congestion and pollution by improving the traffic flow in a city in a fully centralized manner. Validating this approach typically requires the use of simulations, which should be as realistic as possible. However, achieving high degrees of realism can be complex when the actual traffic patterns, defined through an Origin/Destination (O-D) matrix for the vehicles in a city, are unknown, as occurs most of the times. Thus, the first contribution of this thesis is to develop an iterative heuristic for improving traffic congestion modeling; starting from real induction loop measurements made available by the City Hall of Valencia, Spain, we were able to generate an O-D matrix for traffic simulation that resembles the real traffic distribution. If it were possible to characterize the state of traffic by predicting future traffic conditions for optimizing the route of automated vehicles, and if these measures could be taken to preventively mitigate the effects of congestion with its related problems, the overall traffic flow could be improved. Thereby, the second contribution of this thesis was to develop a Traffic Prediction Equation to characterize the different streets of a city in terms of travel time with respect to the vehicle load, and applying logistic regression to those data to predict future traffic conditions. The third and last contribution of this thesis towards our envisioned traffic management paradigm was a route server capable of handling all the traffic in a city, and balancing traffic flows by accounting for present and future traffic congestion conditions. Thus, we perform a simulation study using real data of traffic congestion in the city of Valencia, Spain, to demonstrate how the traffic flow in a typical day can be improved using our proposed solution. Experimental results show that our proposed solution, combined with frequent updating of traffic conditions on the route server, is able to achieve substantial improvements in terms of average travel speeds and travel times, both indicators of lower degrees of congestion and improved traffic fluidity. / Finally, I want to thank the Ecuatorian Republic through the "Secretaría de Educación Superior, Ciencia, Tecnología e Innovación" (SENESCYT), for granting me the scholarship to finance my studies. / Zambrano Martínez, JL. (2019). Efficient Traffic Management in Urban Environments [Tesis doctoral]. Universitat Politècnica de València. https://doi.org/10.4995/Thesis/10251/129865