一种基于属性的访问控制策略自动提取方法
An Automatic Attribute Based Access Control Policy Extraction from Access Logs
摘要：
随着计算和信息技术的快速发展，传统的访问控制模型已经不足以捕捉细粒度的，表达的安全需求的新兴应用程序。基于属性的访问控制（ABAC）模型提供了一种更灵活的方法来解决复杂和动态系统的授权需求。虽然组织有兴趣采用更新的授权模型，但迁移到此类模型是一个重大挑战。许多大型企业需要向可能分布在不同和异构计算环境中的用户群授予授权。这些计算环境中的每一个可以具有其自己的访问控制模型。为整个组织手动开发单个策略框架是乏味的、昂贵的并且容易出错。在本文中，我们提出了一种方法，自动学习ABAC政策规则，从系统的访问日志，以简化政策的制定过程。该方法采用了一种基于无监督学习的算法来检测访问日志中的模式，并从这些模式中提取ABAC授权规则。此外，我们提出了两个策略改进算法，包括规则修剪和策略细化算法，以生成更高质量的挖掘策略。最后，我们实现了一个原型所提出的方法来证明其可行性。
英文摘要：
With the rapid advances in computing and information technologies, traditional access control models have become inadequate in terms of capturing fine-grained, and expressive security requirements of newly emerging applications. An attribute-based access control (ABAC) model provides a more flexible approach for addressing the authorization needs of complex and dynamic systems. While organizations are interested in employing newer authorization models, migrating to such models pose as a significant challenge. Many large-scale businesses need to grant authorization to their user populations that are potentially distributed across disparate and heterogeneous computing environments. Each of these computing environments may have its own access control model. The manual development of a single policy framework for an entire organization is tedious, costly, and error-prone. In this paper, we present a methodology for automatically learning ABAC policy rules from access logs of a system to simplify the policy development process. The proposed approach employs an unsupervised learning-based algorithm for detecting patterns in access logs and extracting ABAC authorization rules from these patterns. In addition, we present two policy improvement algorithms, including rule pruning and policy refinement algorithms to generate a higher quality mined policy. Finally, we implement a prototype of the proposed approach to demonstrate its feasibility.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
