VM Security Assessment via ML Configuration Analysis

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Virtualized computer systems in cloud computing environments are vulnerable to cyber-attacks, particularly due to default configurations that can be exploited by adversaries, and existing security measures may not be sufficient to protect against sophisticated or zero-day attacks.

Innovation Solution

A computer-implemented method using a machine learning algorithm, specifically a restricted Boltzmann machine, to determine the susceptibility of a virtual machine (VM) to security attacks by analyzing its configuration parameters and identifying associated attack characteristics, with the capability to implement protective measures to mitigate these risks.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If default VM configurations are used, then deployment speed and ease of operation are improved, but security vulnerability increases

Engineering Contradiction:

ImproveVM deployment easeVSAvoidsecurity vulnerability

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The system performs preliminary analysis of VM configurations against known attack patterns before deployment. By pre-identifying vulnerable configuration parameters and their associations with security attacks, the system can warn users or automatically adjust configurations before the VM becomes operational, thus maintaining deployment speed while reducing security vulnerabilities.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system provides feedback to users about security vulnerabilities in their VM configurations. By analyzing the association between configuration parameters and attack characteristics, the system can inform users about specific security risks and suggest remediation actions, enabling them to make informed decisions about VM deployment while maintaining operational ease.

Inventive Principle:

Principle #23Feedback

2Reliability

If existing security measures are implemented, then protection against known attacks is improved, but protection against sophisticated and zero-day attacks deteriorates

Engineering Contradiction:

Improveprotection against known attacksVSAvoidprotection against zero-day attacks

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system introduces an intermediary analysis layer between the VM configuration and potential attacks. This intermediary system uses machine learning models to analyze configuration parameters and predict susceptibility to various attack types, including zero-day attacks. This intermediary layer provides adaptive protection that can identify novel attack vectors based on configuration patterns without relying solely on known attack signatures.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Measurement precision

If comprehensive security analysis is performed on all VM configurations, then security assessment accuracy is improved, but computational complexity and processing time increase

Engineering Contradiction:

Improvesecurity assessment accuracyVSAvoidcomputational complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The system extracts and analyzes only the most critical configuration parameters that have strong associations with security attacks. By identifying and focusing on key vulnerable parameters rather than analyzing all configuration details equally, the system maintains high security assessment accuracy while reducing computational complexity and processing time.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The system transforms the security analysis problem into a parameter-based assessment model. By representing VM configurations as sets of parameters and their associations with attack characteristics, the system can efficiently evaluate security risk through parameter matching and pattern recognition rather than exhaustive analysis, thereby reducing computational complexity while maintaining assessment accuracy.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS10747886B2Attack assessment in a virtualized computing environment

Publication Date: 2020.08.18 BRITISH TELECOM PLC

AI summary

A computer implemented method to determine whether a target virtual machine (VM) in a virtualized computing environment is susceptible to a security attack, the method comprising: training a machine learning algorithm as a classifier based on a plurality of training data items, each training data item corresponding to a training VM and including a representation of parameters for a configuration of the training VM and a representation of characteristics of security attacks for the training VM; generating a data structure for storing one or more relationships between VM configuration parameters and attack characteristics, wherein the data structure is generated by sampling the trained machine learning algorithm to identify the relationships; determining a set of configuration parameters for the target VM; and identifying attack characteristics in the data structure associated with configuration parameters of the target VM as characteristics of attacks to which the target VM is susceptible.