Enhancing Vulnerability Prioritization in Cloud Computing Using Multi-View Representation Learning

• Published in: Journal of management information systems 2024-07, Vol.41 (3), p.708-743
• Main Authors: Ullman, Steven, Samtani, Sagar, Zhu, Hongyi, Lazarine, Ben, Chen, Hsinchun, Nunamaker, Jay F.
• Format: Article
• Language: English
• Subjects: asset clustering; Assets; attention mechanisms; Cloud computing; Clustering; Combinatorial analysis; Computer security; cyberinfrastructure; Cybersecurity; Decision making; Deep learning; design science; Image enhancement; Learning; multi-view representation learning; Multidimensional methods; Online vulnerability; Open source software; Remediation; Security personnel; State-of-the-art reviews; Virtual environments; Vulnerability; Web services
• ISSN: 0742-1222; 1557-928X
• DOI: 10.1080/07421222.2024.2376384

Cybersecurity is a present and growing concern that needs to be addressed with both behavioral and design-oriented research. Public cloud providers such as Amazon Web Services and federal funding agencies such as the National Science Foundation have invested billions of dollars into developing high-performance computing resources accessible to users through configurable virtual machine (VM) images. This approach offers users the flexibility of changing and updating their environment for their computational needs. Despite the substantial benefits, users often introduce thousands of vulnerabilities by installing open-source software packages and misconfiguring file systems. Given the scale of vulnerabilities, security personnel struggle to identify and prioritize vulnerable assets for remediation. In this research, we designed a novel unsupervised deep learning-based Multi-View Combinatorial-Attentive Autoencoder (MV-CAAE) to capture multi-dimensional vulnerability data and automatically identify groups of similar vulnerable compute instances to help facilitate the development of targeted remediation strategies. We rigorously evaluated the proposed MV-CAAE against state-of-the-art methods in three technical clustering experiments. Experiment results indicate that the MV-CAAE achieves V-measure scores (metric of cluster quality) 8 percent-48 percent higher than benchmark methods. We demonstrated the practical value through a comprehensive case study by clustering vulnerable VMs and gathering qualitative feedback from experienced security professionals through semi-structured interviews. The results indicated that clustering vulnerable assets can help prioritize vulnerable instances for remediation and enhance decision-making tasks. The present design-research work also contributes to our theoretical knowledge of cyber-defense.