Both of those will provide information on how many threads are running of one service or user.
ps aux | awk '{print $11}' | sort | uniq -c | sort -nk1 | tail -n5
ps aux | awk '{print $1}' | sort | uniq -c | sort -nk1 | tail -n5
(D)DoS
======
netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
Reff:
(D)DoS Deflate installation
http://deflate.medialayer.com/