Smart Vulnerability Assessment for Scientific Cyberinfrastructure: An Unsupervised Graph Embedding Approach
Smart Vulnerability Assessment for Scientific Cyberinfrastructure: An Unsupervised Graph Embedding Approach
复制标题
DOI：
10.1109/isi49825.2020.9280545
复制
发表时间：
2020-11
期刊：
影响因子：
--
通讯作者：
Steven Ullman;Sagar Samtani;Ben Lazarine;Hongyi Zhu;Benjamin Ampel;Mark W. Patton;Hsinchun Chen
中科院分区：
文献类型：
--
作者：
Steven Ullman;Sagar Samtani;Ben Lazarine;Hongyi Zhu;Benjamin Ampel;Mark W. Patton;Hsinchun Chen
计算技术的加速发展为跨学科团队提供了一个平台，以前所未有的速度进行创新研究。特别是先进的科学网络基础设施提供数据存储、应用程序、软件和其他资源，以促进重大科学发现的发展。这些环境的用户通常依赖于自定义开发的虚拟机（VM）映像，这些映像由各种开源应用程序组成。这些漏洞可能包括传统漏洞扫描器无法检测到的漏洞。这项研究旨在识别已安装的应用程序，它们的漏洞以及它们在科学网络基础设施中的图像之间的差异。我们提出了一种新的无监督图嵌入框架，可以捕获应用程序之间的关系，以及在相应的GitHub存储库中识别的漏洞。这种嵌入用于对具有类似应用和漏洞的图像进行聚类。我们使用Silhouette，Calinski-Harabasz和Davies-Bouldin指数评估集群质量，并通过检查选定的集群来评估应用程序漏洞。结果显示，在我们的研究测试平台中，与基因组学研究相关的图像存在高严重性外壳生成和数据验证漏洞的风险更大。
The accelerated growth of computing technologies has provided interdisciplinary teams a platform for producing innovative research at an unprecedented speed. Advanced scientific cyberinfrastructures, in particular, provide data storage, applications, software, and other resources to facilitate the development of critical scientific discoveries. Users of these environments often rely on custom developed virtual machine (VM) images that are comprised of a diverse array of open source applications. These can include vulnerabilities undetectable by conventional vulnerability scanners. This research aims to identify the installed applications, their vulnerabilities, and how they vary across images in scientific cyberinfrastructure. We propose a novel unsupervised graph embedding framework that captures relationships between applications, as well as vulnerabilities identified on corresponding GitHub repositories. This embedding is used to cluster images with similar applications and vulnerabilities. We evaluate cluster quality using Silhouette, Calinski-Harabasz, and Davies-Bouldin indices, and application vulnerabilities through inspection of selected clusters. Results reveal that images pertaining to genomics research in our research testbed are at greater risk of high-severity shell spawning and data validation vulnerabilities.