RAGent: 基于检索的访问控制策略生成
RAGent: Retrieval-based Access Control Policy Generation
AI总结：
针对手动生成访问控制策略效率低、易出错及现有自动化框架可靠性不足的问题，提出基于检索增强生成的RAGent框架，可识别需求并生成含复杂组件的策略，结合验证-细化机制提升性能，同时发布三个标注数据集。
摘要：
从组织的高层需求规范中手动生成访问控制策略面临着重大挑战。管理员需要耗费大量精力梳理包含这类规范的多份文档，并将其中的访问需求转化为访问控制策略。此外，这些规范的复杂性与模糊性常导致系统管理员在转化过程中出错，进而引发数据泄露。然而，目前旨在辅助管理员完成这一流程的自动化策略生成框架因缺乏领域适配性等局限，可靠性不足。因此，为提升访问控制策略生成的可靠性，我们提出了RAGent，这是一种基于语言模型的新型检索式访问控制策略生成框架。RAGent从高层需求规范中识别访问需求的平均F1值达到87.9%，为当前最优水平。随后，RAGent通过检索增强生成技术，将识别出的访问需求转化为访问控制策略，该步骤的F1值为77.9%。与现有框架不同，RAGent生成的策略除主体、动作和资源外，还包含用途、条件等复杂组成部分。此外，RAGent可自动验证生成的策略，并通过一种新型的验证-细化机制对策略进行迭代优化，使整个流程的可靠性进一步提升3%，F1值达到80.6%。我们还推出了三个带标注的数据集，用于未来访问控制策略生成框架的开发，解决了该领域数据稀缺的问题。
英文摘要：
Manually generating access control policies from an organization's high-level requirement specifications poses significant challenges. It requires laborious efforts to sift through multiple documents containing such specifications and translate their access requirements into access control policies. Also, the complexities and ambiguities of these specifications often result in errors by system administrators during the translation process, leading to data breaches. However, the automated policy generation frameworks designed to help administrators in this process are unreliable due to limitations, such as the lack of domain adaptation. Therefore, to improve the reliability of access control policy generation, we propose RAGent, a novel retrieval-based access control policy generation framework based on language models. RAGent identifies access requirements from high-level requirement specifications with an average state-of-the-art F1 score of 87.9%. Through retrieval augmented generation, RAGent then translates the identified access requirements into access control policies with an F1 score of 77.9%. Unlike existing frameworks, RAGent generates policies with complex components like purposes and conditions, in addition to subjects, actions, and resources. Moreover, RAGent automatically verifies the generated policies and iteratively refines them through a novel verification-refinement mechanism, further improving the reliability of the process by 3%, reaching the F1 score of 80.6%. We also introduce three annotated datasets for developing access control policy generation frameworks in the future, addressing the data scarcity of the domain.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
