基于贪婪和进化的访问控制策略挖掘算法
Greedy and Evolutionary Algorithms for Mining Relationship-Based Access Control Policies
摘要：
基于身份验证的访问控制（ReBAC）提供了高级别的表现力和灵活性，可促进安全性和信息共享。我们制定ReBAC作为一个面向对象的扩展，基于属性的访问控制（ABAC），其中的关系表示使用字段，引用其他对象，和路径表达式被用来遵循对象之间的关系链。通过部分自动化根据现有访问控制策略和属性数据开发ReBAC策略，ReBAC策略挖掘算法有可能显着降低从传统访问控制系统迁移到ReBAC的成本。本文提出了两种从访问控制列表和表示为对象模型的属性数据中挖掘ReBAC策略的算法：一种是基于统计学的贪心算法，另一种是基于语法的进化算法。对四个样本策略和两个大型案例研究的算法评估表明了它们的有效性。
英文摘要：
Relationship-based access control (ReBAC) provides a high level of expressiveness and flexibility that promotes security and information sharing. We formulate ReBAC as an object-oriented extension of attribute-based access control (ABAC) in which relationships are expressed using fields that refer to other objects, and path expressions are used to follow chains of relationships between objects. ReBAC policy mining algorithms have potential to significantly reduce the cost of migration from legacy access control systems to ReBAC, by partially automating the development of a ReBAC policy from an existing access control policy and attribute data. This paper presents two algorithms for mining ReBAC policies from access control lists (ACLs) and attribute data represented as an object model: a greedy algorithm guided by heuristics, and a grammar-based evolutionary algorithm. An evaluation of the algorithms on four sample policies and two large case studies demonstrates their effectiveness.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
