Download PDF - Center for Secure Information Systems

Steven Noel, PhD
SENIOR-LEVEL RESEARCH SCIENTIST
Delivering Leading Advancements in Cyber Security
Proven success driving groundbreaking advances in cyber security through scientific research and
product development. Track record of delivering:


Patented Cauldron technology for cyber attack vulnerability modeling, analysis, and visualization.
Transitioned funded research projects into commercial tool deployed in wide range of customer
environments.

Long history of leading cutting-edge research projects for the defense and intelligence communities.

Sponsors include DHS, AFRL, AFOSR, NRO, FAA, NSA, DISA, DARPA, OSD.
Education
University of Louisiana (Lafayette, LA)
• PhD in Computer Science (3.94 GPA), 2000. Dissertation: Data Mining and Visualization of Reference
Associations: Higher Order Citation Analysis.
• MS in Computer Science (4.0 GPA), Thesis: Wavelet Transforms for Radar Proximity Fuzing, 1998.
University of Houston – Clear Lake (Houston, TX)
• BS in Electro-Optics (cum laude, 3.89 GPA, ranked #1 in program), 1989.
Alvin Community College (Alvin, TX)
• AAS in Computer Systems (summa cum laude), 1983.
• AAS in Computer Science (cum laude), 1984.
Experience
The MITRE Corporation – Not-for-profit national technology resource (McLean, VA)
Lead Cyber Security Engineer, 2013 to Present
Perform security engineering, security architecture, and information systems security research within a
Federally Funded Research and Development Center (FFRDC). Full life-cycle analysis, design, test, and
implementation of cyber security solutions, policies, and systems. Apply advanced principles, understand
customer missions and challenges. Research Project Highlights:




Mission-Oriented Resilient Clouds (DARPA): Develop cyber adversary models, apply to missionassurance scenarios in cloud networks.
Big Data Analytics for Network Attack Mapping (MITRE Innovation Program): Merge network
relationships and events (topology, firewall policies, host configurations, vulnerabilities, attack
patterns, intrusion alerts, logs, etc.) to map vulnerability/attack paths.
Analyzing Mission Impact of Cyber Actions (DASD and M&SCO): Develop cyber models and discretetime event simulations characterizing attacker impact on DoD missions.
Modeling and Simulation in Support of Defensive Cyber Course of Action Analysis (RDA-TF):
Requirements analysis for modeling and simulation informing cyber defense courses of action.
Steven Noel, PhD
Center for Secure Information Systems, George Mason University – Academic research center (Fairfax, VA)
Associate Director, 2001 to 2013
Led multi-disciplinary teams conducting advanced research in cyber security. Particular focus on multi-step
attack vulnerability analysis (attack graphs) for optimal network hardening, situational awareness, and
attack response. Experience with advanced algorithms and tools for data analytics, machine learning, and
classification. Transitioned research capabilities to commercial sector. Research Project Highlights:







DHS project Metrics Suite for Enterprise-Level Attack Graph Analysis (one year, $750K) developing a suite
of enterprise network security metrics based on attack graph analysis, with innovative visualizations
for tracking multiple metrics over time.
AFOSR project Mapping Attack Paths in Black-Box Networks through Passive Vulnerability Inference (three
years, $800K) researched stealthy techniques for mapping attack graphs through adversary networks.
DHS project Enhanced Topological Vulnerability Analysis and Visualization (three years, $1.2M) developed
attack graph analysis and visualization technology, licensed for commercialization.
FAA projects Topological Analysis of Network Attack Vulnerability (two years, $600K) and Streamlined
Management of Data for Cauldron Network Modeling (one year, $150K) applied attack graph analysis to
enterprise networks, with GIS mapping.
NRO project Methods and Tools for Network Attack Prevention, Detection, and Response (two years, $500K)
developed attack graph analysis tools and vulnerability database for enterprise network.
DISA project Advanced Telecommunication Protocol and Network Security (2 years, $300K) investigated
advanced methods of network attack prevention under various telecommunication protocols.
NSA project Topological Vulnerability Analysis (five years, $4.8M) performed basic and applied research
in attack graph modeling of multi-step vulnerability paths through networks, cyber security ontology,
anomaly intrusion detection via association mining and clustering.
George Washington University – Academic research laboratory (Washington, DC)
Associate Director of Research, 2001


Instrumental in formation of new Digital Media Laboratory.
Navy project Wavelets and Neural Networks for Intelligent Signal Processing ($40K) investigated wavelet
features for detecting singularities in noisy non-stationary signals.
Naval Surface Warfare Center Dahlgren Division – DoD research laboratory (Dahlgren, VA)
 Computer Engineer, 1997–1998
o Led R&D effort for digital signal processor for radar proximity fuze
 Secured $750K in project funding
 Developed pattern recognition and signal processing techniques leading to
significantly improved target detection
o Managed project for multi-spectral infrared fuze with digital signal processor
 Secured $500K in project funding
 Led R&D in detector materials and signal processing techniques
 Physicist, 1990–1996
o Performed research and analysis for submarine-launched ballistic missiles
 Tested software for simulating high-altitude electromagnetic pulse effects
 Developed catalog of stars for in-flight stellar sightings by missile guidance system
 Investigated optimal targeting via genetic algorithms
 Developed interactive 3-D graphics model of submarine
o Evaluated video recorders for surface-to-air missile low-light-level television
 Defined criteria for test/evaluation of video recorders from competing vendors
 Conducted tests with live and synthetic video signals
 Applied evaluation criteria, selected products for Navy procurement
Steven Noel, PhD
Patents







Minimum-Cost Network Hardening (US Patent 7,555,778): Generates optimal recommendations for
hardening networks based on multi-step vulnerability paths.
Attack Graph Aggregation (US Patent 7,627,900): Transforms complex network attack graphs into
high-level summaries for visual analysis.
Intrusion Event Correlator (US Patent 7,735,141): Constructs multi-step attack scenarios (e.g.,
advanced persistent threats) from isolated intrusion events.
Network Attack Modeling, Analysis, and Response (US Patent 7,904,962): System for predicting
network vulnerability attack paths, hardening the network, and responding to attacks.
Intrusion Event Correlation System (US Patent 8,181,252): System for correlating intrusion events
using attack graph distances.
k-Zero Day Safety (US Patent 8,918,884): Determines level of network safety against unknown (zeroday) attacks.
Methods and Systems for Determining Hardening Strategies (US 13/924,11): Provides hardening
solutions for constrained interdependencies among network configuration elements. (Pending)
Selected Publications
(50+ total publications, ~1900 citations, h-index=19, i10-index=30)
S. Noel, E. Harley, K. Tam, G. Gyor, “Big-Data Architecture for Cyber Attack Graphs: Representing Security
Relationships in NoSQL Graph Databases,” IEEE International Conference on Technologies for Homeland
Security (IEEE HST), 2015.
S. Noel, S. Jajodia, “Metrics Suite for Network Attack Graph Analytics,” 9th Annual Cyber and Information
Security Research Conference (CISRC), Oak Ridge National Laboratory, 2014.
J. Jenkins, C. Sweet, J. Sweet, S. Noel, H. Szu, “Authentication, Privacy, Security can Exploit Brainwave by
Biomarker,” Independent Component Analyses, Compressive Sampling, Wavelets, Neural Net, Biosystems,
and Nanoengineering XII, SPIE - The International Society for Optical Engineering, 2014.
S. Noel, “Metrics Suite for Network Attack Graphs,” 65th Meeting of IFIP Working Group 10.4 on
Dependable Computing and Fault Tolerance, 2014.
L. Wang, S. Jajodia, A. Singhal, P. Cheng, S. Noel, “k-Zero Day Safety: A Network Security Metric for
Measuring the Risk of Unknown Vulnerabilities,” Transactions on Dependable and Secure Computing, 2013.
M. Albanese, S. Jajodia, S. Noel, “Time-Efficient and Cost-Effective Network Hardening Using Attack
Graphs,” 42nd Annual IEEE/IFIP International Conference on Dependable Systems and Networks, 2012.
S. Jajodia, S. Noel, P. Kalapa, M. Albanese, John Williams, “Cauldron: Mission-Centric Cyber Situational
Awareness with Defense in Depth,” 30th Military Communications Conference (MILCOM), 2011.
S. Noel, S. Jajodia, L. Wang, A. Singhal, “Measuring Security Risk of Networks Using Attack Graphs,”
International Journal of Next-Generation Computing, 2010.
S. Noel, S. Jajodia, “Proactive Intrusion Prevention and Response via Attack Graphs,” in Practical Intrusion
Analysis: Prevention and Detection for the Twenty-First Century, Addison-Wesley Professional, 2009.
S. Noel, M. Elder, S. Jajodia, P. Kalapa, S. O’Hare, K. Prole, “Advances in Topological Vulnerability
Analysis,” Cybersecurity Applications & Technology Conference for Homeland Security (CATCH), 2009.
S. O’Hare, S. Noel, K. Prole, “A Graph-Theoretic Visualization Approach to Network Risk Analysis,”
Workshop on Visualization for Computer Security (VizSec), 2008.
S. Noel, S. Jajodia, “Optimal IDS Sensor Placement and Alert Prioritization Using Attack Graphs,” Journal of
Network and Systems Management, 2008.
S. Jajodia, S. Noel, “Topological Vulnerability Analysis: A Powerful New Approach for Network Attack
Prevention, Detection, and Response,” in Algorithms, Architectures, and Information Systems Security, World
Scientific Press, 2007.
L. Wang, S. Noel, S. Jajodia, “Minimum-Cost Network Hardening Using Attack Graphs,” Computer
Communications, 2006.
S. Jajodia, S. Noel, B. O’Berry, “Topological Analysis of Network Attack Vulnerability,” in Managing Cyber
Threats: Issues, Approaches, and Challenges, Springer, 2005.
S. Noel, S. Jajodia, “Understanding Complex Network Attack Graphs through Clustered Adjacency
Matrices,” 21st Annual Computer Security Applications Conference (ACSAC), 2005.
S. Noel, “Secure Information Infrastructure Protection through Topological Vulnerability Analysis,” 84th
Annual Meeting of the Transportation Research Board of the National Academies, 2005.
S. Noel, E. Robertson, S. Jajodia, “Correlating Intrusion Events and Building Attack Scenarios through
Attack Graph Distances,” 20th Annual Computer Security Applications Conference (ACSAC), 2004.
S. Noel, S. Jajodia, “Managing Attack Graph Complexity through Visual Hierarchical Aggregation,” ACM
CCS Workshop on Visualization and Data Mining for Computer Security, 2004.
S. Noel, C.-H. Chu, V. Raghavan, “Co-Citation Count versus Correlation for Influence Network
Visualization,” Information Visualization, 2(3), 2003.
H. Szu, S. Noel, S.-B. Yim, J.Willey, J. Landa, “Multimedia Authenticity Protection with Independent
Component Watermarking and Digital Bacteria Vaccination,” Neural Networks, 2003.
S. Noel, S. Jajodia, B. O’Berry, M. Jacobs, “Efficient Minimum-Cost Network Hardening via Exploit
Dependency Graphs,” 19th Annual Computer Security Applications Conference (ACSAC), 2003.
S. Jajodia, S. Noel, B. O’Berry, “Topological Analysis of Network Attack Vulnerability,” in Managing Cyber
Threats: Issues, Approaches and Challenges, Kluwer Academic Publisher, 2003.
S. Noel, V. Raghavan, C.-H. Chu, “Document Clustering, Visualization, and Retrieval via Link Mining,” in
Clustering and Information Retrieval, Kluwer Academic Publisher, 2002.
S. Noel, D. Wijesekera, C. Youman, “Modern Intrusion Detection, Data Mining, and Degrees of Attack
Guilt,” in Applications of Data Mining in Computer Security, Kluwer Academic Publisher, 2002.
R. Ritchey, B. O’Berry, S. Noel “Representing TCP/IP Connectivity for Topological Analysis of Network
Security,” 18th Annual Computer Security Applications Conference (ACSAC), 2002.
S. Noel, “Architecture for Topological Vulnerability Analysis,” Annual Weapons Control Technology
Symposium, The Johns Hopkins University Applied Physics Laboratory, 2002.
S. Noel, C.-H. Chu, V. Raghavan, “Visualization of Document Co- Citation Counts,” 6th International
Conference on Information Visualization, 2002.
S. Noel, B. O’Berry, C. Hutchinson, S. Jajodia, L. Keuthan, A. Nguyen, “Combinatorial Analysis of Network
Security,” 16th International Symposium on Aerospace/Defense Sensing, Simulation, and Controls, 2002.
S. Noel, V. Raghavan, C.-H. Chu, “Visualizing Association Mining Results through Hierarchical Clusters,”
IEEE International Conference on Data Mining, 2001.
S. Noel, H. Szu, “Proximity Sensing with Wavelet-Generated Video,” Journal of Electronic Imaging, 7(4),
October 1998.