Rhiannon Weaver is a statistician with over 8 years of experience analyzing large data sets for a Federally Funded Research and Development Center. She has extensive experience analyzing billion-record data sets and building statistical methods for analysis at scale. She has strong programming skills in R, Python, C/C++ and has published several journal articles and conference papers. She received her Ph.D in Statistics from Carnegie Mellon University in 2012.

1. Rhiannon Weaver
Research and Analytic Interests
Bayesian analysis, large data sets, operational and visual anomaly detection, graph
analysis, simulation studies, Markov Chain Monte Carlo methods, scalable and practi-
cal implementation of proof-of-concept methods, data visualization, generalized linear
models, sparse categorical data, item frequency analysis.
Contact 3361 37th St. Ext, Beaver Falls, PA, 15010
Phone: 412-215-3097
rhiannon.weaver.77@gmail.com
Highlights Statistician with over 8 years of experience as a unique leader in research and opera-
tional analysis at a Federally Funded Research and Development Center.
Extensive experience analyzing billion-record data sets, including learning custom tool
suites for queries and summarization, as well as building, transitioning and evaluating
statistical methods for analysis at scale.
Superior communications skills applied to journal papers and customer reports, as well
as presentations and training courses for non-statistical audiences.
Programming and scripting skills in R, Python and C/C++.
Passion for applying data analysis to both work projects and outside interests.
Employment
09/2006–present Member of the Technical Staff (Sr. member 2012-present) for Network Security Analysis
CERT
Pittsburgh, PA
09/2000–09/2006 Teaching Assistant/Instructor
Statistics Department, Carnegie Mellon University
Pittsburgh, PA
Education Ph.D., Statistics, May 2012
Carnegie Mellon University
Pittsburgh, PA
Thesis: Behavioral Modeling of Botnet Populations Viewed Through Internet Protocol
Address Space
Advisor: Joseph Kadane
Committee: Prof. Brian Junker, Prof. Howard Seltman, and Dr. Markus DeShon
M.S., Statistics, Spring 2002
Carnegie Mellon Univeristy
Pittsburgh, PA
B.S., Computer Science and B.S. Mathematics (honors), Spring, 2000
The Pennsylvania State University
University Park, PA
1

2. Honors Thesis: New Congruences for the Partition Function
Advisor: Ken Ono
Awarded the 2000 Schreyer Honors College Dean’s Award for Research or Creative
Achievement
Work Experience: CERT
Customer-Focused Strategic and Operational Analysis
– Consistently deliver thorough data analysis reports to support acquisitions and infrastructure/architecture
decision-making for monitoring networks at enterprise scale (billions of records per day) eg: eval-
uation of commercial analytic tools, capacity planning.
– Timely delivering of analysis and visualization of high profile incidents at the enterprise scale.
– Hands on implementation and documentation of proof-of-concept analytic code, eg: robust outlier
detection using C, Shannon entropy using python, network flow characterization using python and
internally developed command-line Unix tools (SiLK).
Cross-Team Statistical Consulting and Research Support
– Recipient of 2013 SEI Director’s Office Award for Excellence for bringing statistical thinking and
rigor to the entire CERT Co-ordination Center’s operations and applied research efforts.
– “Behind the scenes” reviewer for journal submissions, research reports, and intern projects across
the CERT/CC team.
– Produced a Bayesian analysis and visualization of historical data for perpetrators of espionage that
was a key contribution for extending research initiatives between CERT’s Insider Threat team and
their customer.
– Mentoring of incoming Human Factors scientist Jennifer Cowley and other work with the Science
of Cyber Security (SOCS) team (2012-2013) led in part to the team’s hiring two new statisticians
in 2013-2015 to keep up with consulting and research requests.
– Innovative use of our Network Flow data analysis toolkit (SiLK) applied to malware meta-data
has facilitated analyses that were previously intractable with traditional database solutions due to
scale, and has led to operational insights as well as engineering efforts to make the tools more
robust.
Individual Research, Training and Outreach
– Author of technical reports and journal/conference articles regarding anomaly detection methods,
statistical modeling of thousands of assets, and mark-recapture models using Markov Chain Monte
Carlo methods to estimate sizes of phishing, malware and botnet populations based on incomplete
observation through watch lists.
– As Co-chair (2012) and Chair (2013), spearheaded effort to add a poster session to the CERT
FloCon conference on Analysis of NetFlow data, and to provide review and feedback for presenters
in terms of audience, clarity and scientific impact.
– Invited to give training sessions on Analysis of Anti-Abuse data at the Message, Mobile and Malware
Anti-Abuse Working Group (M3AAWG) meetings in February and October 2013.
Publications
Journal Papers
R. Weaver. Visualizing and Modeling the Scanning Behavior of the Conficker Botnet in the Presence of
User and Network Activity. IEEE Transactions on Information Forensics and Security, 10(5):1039–1051,
May 2015.
2

3. R. Weaver. Parameters, predictions and evidence in computational modeling: a statistical view informed
by ACT-R. Cognitive Science, 32(8):1349–1375, 2008.
R. Weaver. New congruences for the partition function. The Ramanujan Journal, 5(1):53–63, 2001.
Conference Papers
R. Weaver. A probabilistic population study of the Conficker-C botnet. In PAM 2010, LNCS 6032, pages
181–190. Springer-Verlag Berlin Heidelberg, April 2010.
R. Weaver and M. Collins. Fishing for phishes: applying capture-recapture methods to estimate phishing
populations. In Proceedings of the APWG eCrime Researcher Summit, October 2007.
M. Collins, T. Shimeall, S. Faber, J. Janies, R. Weaver, M. De Shon, and J. Kadane. Using uncleanliness
to predict future botnet addresses. In Proceedings of the 2007 Internet Measurement Conference, October
2007.
Y. Liu, K. Schmidt, J. Cohn, and R. Weaver. Human facial asymmetry for expression-invariant facial
identification. In Proceedings of the Fifth IEEE International Conference on Automatic Face and Gesture
Recognition (FG’02), May 2002.
Unrefereed Conference Papers and Presentations
E. Wright, R. Weaver, and A. Ritter. Linking Social Media Reports to Network Indicators of DoS Attacks.
In FloCon 2015, 2015. Poster Presentation.
R. Weaver, C. Nunnery, G. Singaraju, and B. Kang. Entropy-based measurement of IP address inflation
in the Waledac botnet. In FloCon 2011, January 2011. http://resources.sei.cmu.edu/library/
asset-view.cfm?assetid=50664.
R. Weaver. Beyond the Top Talkers: Empirical Correlation of Conficker-C Infected IP Space. In FloCon
2010, January 2010. http://resources.sei.cmu.edu/library/asset-view.cfm?assetid=49860.
R. Weaver. A continuous-time list capture model for Internet threats. In Proceedings of the ASA 2010
Joint Statistical Meetings, August 2010.
Technical Reports
R. Weaver. Identifying anomalous port-specific network behavior. Technical Report CMU-SEI-2010-TR-
010, Software Engineering Institute, 2010.
R. Weaver and B. Junker. Model specification for cognitive assessment of proportional reasoning. Tech-
nical Report 777, Carnegie Mellon Statistics Department, 2003.
Technical Skills
Programming Languages
C, C++, python, R
Libraries and Tools
LATEX, gcc, gdb, R Studio, R Markdown, UNIX text editing tools, SiLK tool suite for flow analysis,
GNU gsl scientific libraries, JMP, Apache Pig, SQL and R database bindings
Miscellaneous
Citizenship and Clearance: United States of America with Active TS//SCI
Hobbies and Activities: Watching/Playing ice hockey, Recreational data analysis, Cooking, Creative writ-
ing, Sewing, Science fiction
June 16, 2015
3