Stilian A. Stoev

Associate Professor, Statistics, LSA

Applied probability and statistics for stochastic processes

Stilian Stoev’s research is in the area of applied probability and statistics for stochastic processes with emphasis on extremes, heavy tails, self-similarity, and long-range dependence. His recent theoretical contributions are in the area of max-stable processes, which is the class of processes emerging as a canonical model for the dependence in the extremes. This includes the representation, characterization, ergodicity, mixing, and prediction for this class of processes. Dr. Stoev is also working on applied problems in the area of computer network traffic monitoring, analysis and modeling. A recent joint project focuses on developing efficient statistical methods and algorithms for the visualization and analysis of fast multi-gigabit network traffic streams, which can help unveil the structure of traffic flows, detect anomalies and cyber attacks in real-time. This involves advanced low-level packet capture, efficient computation and rapid communication of summary statistics using non-relational data bases. More broadly, Dr. Stoev’s research is motivated by large-scale and data intensive applied problems arising in the areas of:

  1. environmental, weather and climate extremes.
  2. insurance and finance.
  3. Internet traffic monitoring, modeling and prediction.
Hash-binned array of 10+Gbps traffic stream measured at Merit Network. Bin (i,j) corresponds to traffic intensity in bytes of the data transferred from source IPs hashed in bin i with corresponding destination IPs hashed in bin j. The picture corresponds to a 10 second aggregation period. Bright horizontal lines indicate server-type communication from one bin to many, while unusual vertical lines are indicative of distributed denial of service (DDoS) type many-to-one attacks. The data were obtained using the PF_RING module in zero-copy mode, which by-passes the OS kernel and processes all packets passing through the interface. These and related statistical summaries derived via a recently developed AMON (All packet MONintoring) framework allows for a near-instantaneous visualization and automatic detection of structural changes in the network traffic conditions.
Hash-binned array of 10+Gbps traffic stream measured at Merit Network. Bin (i,j) corresponds to traffic intensity in bytes of the data transferred from source IPs hashed in bin i with corresponding destination IPs hashed in bin j. The picture corresponds to a 10 second aggregation period. Bright horizontal lines indicate server-type communication from one bin to many, while unusual vertical lines are indicative of distributed denial of service (DDoS) type many-to-one attacks.
The data were obtained using the PF_RING module in zero-copy mode, which by-passes the OS kernel and processes all packets passing through the interface. These and related statistical summaries derived via a recently developed AMON (All packet MONintoring) framework allows for a near-instantaneous visualization and automatic detection of structural changes in the network traffic conditions.