Xenia Mountrouidou

Senior Security Researcher

Cyber adAPT

Xenia Mountrouidou is a Senior Security Researcher at Cyber adAPT with versatile experience in academia and industry. She has over 10 years of research experience in network security, machine learning, and data analytics for computer networks. She enjoys researching novel intrusion detection techniques, finding interesting patterns with machine learning algorithms, and writing Python scripts to automate boring tasks. Her research interests revolve around network security, Internet of Things, intrusion detection, and machine learning.

She has authored scholarly papers in the areas of network security and machine learning. She has presented her work at academic and industry conferences such as USENIX Security, IEEE Big Data, BSides Security, and Interop.

Download my resumé .

Interests

Machine Learning for Security
Intrusion Detection Systems
Network Security
IoT Security
Data Science

Education

PhD in Computer Science

North Carolina State University
M.S. in Computer Engineering

University of Patras
B.S. in Computer Science

University of Crete

Skills

Network Security

Machine Learning

Python

Experience

Senior Security Researcher

Cyber adAPT

August 2022 – Present Texas

Responsibilities include:

Spearhead research on intrusion detection techniques using machine learning
Develop and implement LLM fine-tuning methods for malicious activity detection
Lead a team of security researchers

Senior Consultant

Network to Code

May 2020 – August 2022 New York

Developed a Shodan Security plugin for IoT CVE tracking
Designed and implemented KPI metrics for automation utilizing Telegraf, Influx, and GrafanaDevelop software for network automation workflows
Implemented CI/CD pipelines for automated testing and deployment of security toolsCreate CI/CD pipelines

Assistant Professor of Computer Science

College of Charleston

August 2016 – May 2020 Charleston

Directed the Cybersecurity X Lab, focusing on IoT security, adversarial data analytics, and machine learning for intrusion detection
Developed behavioral models for IoT intrusion detection and created quantitative metrics for IoT security evaluation
Implemented a forecasting Markov model for predicting adversarial behavior
Integrated IDS (Snort) with SDN controllers to enhance DDoS attack detection and prevention
Applied machine learning algorithms to improve intrusion detection accuracy by up to 88%

Certifications

Cisco Certified DevNet Associate

Cisco Jul 2023 – Jul 2020

Cisco Certified DevNet Specialist - Core

Cisco Jul 2021 – Jul 2024

Red Hat Delivery Specialist - Automation

Red Hat Aug 2020 – Aug 2022

Projects

Decoding cybersecurity data with ML and AI

The goal of this project is to invent creative ways of deciphering cybersecurity data with ML and AI. First, exploratory data analysis is used with traditional Python libraries and Generative AI models to get insights on black box data, visualize it and tell its story. Then several traditional ML techniques for feature engineering are used to derive useful data characteristics for detecting malicious behavior. Finally, ML classification and language models are fine tuned using the generated features for detection of anomalies in network traffic.

IoT Security Metrics

We cannot improve what we cannot measure (Kelvin). How does one quantify the absence of an adversary, a fault, or a weakness in a system? How can we define objective, repeatable, and reproducible metrics that evaluate the security of a network? This task is more complex at a time that the face of networking is changing by interconnecting devices such as webcameras, locks, and lights. These exciting and difficult questions are part of my work in quantitative security evaluation. I analyze data, create predictive models, and stream telemetry with modern open source tools.

Featured Publications

Thomas Setzler, Xenia Mountrouidou

January, 2021 In IEEE CCNC 2021

IoT Metrics and Automation for Security Evaluation

Internet of Things (IoT) devices are ubiquitous, with web cameras, smart refrigerators, and digital assistants appearing in homes, offices, and public spaces. However, these devices are lacking in security measures due to their low time to market and insufficient funding for security research and development. In order to improve the security of IoTs, we have defined novel security metrics based on generic IoT characteristics. Furthermore, we have developed automation for experimentation with IoT devices that results to repeatable and reproducible calculations of security metrics within a realistic IoT testbed. Our results demonstrate that repeatable IoT security measurements are feasible with automation. They prove quantitatively intuitive hypotheses. For example, an large number of inbound / outbound network connections contributes to higher probability of compromise or measuring password strength leads to a robust estimation of IoT security.

Casey Wilson, Xenia Mountrouidou, Anna Little

January, 2021 In IEEE Cyberhunt 2019

Worth the wait? Time window feature optimization for intrusion detection

Time as a variable for generating features has been widely overlooked in Intrusion Detection System (IDS) research. Computer and network attacks are time series, where time is an important factor that may affect feature generation, and as a result, classification. Nevertheless, there has been little exploration on how to calibrate time for IDSs and attack classification techniques. In this paper we explore time windows as a technique for generating more effective and descriptive features for attack classification. We suggest a framework for feature generation and selection that uses Recursive Feature Elimination (RFE) and time window exploration. Our initial results when applying this framework indicate that there is up to 47% improvement of F1 scores in attack classification when attack features are generated over a variety of time windows, compared to a single, global time window. We find that features calculated over longer lengths of time may be more useful for detecting attacks than over shorter lengths of time. Our methods seem to be most effective at detecting DDoS attacks, particularly those that occur over medium or long durations of time.