A probabilistic approach to hybrid role mining

Abstract

Role mining algorithms address an important access control problem: configuring a role-based access control system. Given a direct assignment of users to permissions, role mining discovers a set of roles together with an assignment of users to roles. The results should closely agree with the direct assignment. Moreover, the roles should be understandable from the business perspective in that they reflect functional roles within the enterprise. This requires hybrid role mining methods that work with both direct assignments and business information from the enterprise. In this paper, we provide statistical measures to analyze the relevance of different kinds of business information for defining roles. We then present an approach that incorporates relevant business information into a probabilistic model with an associated algorithm for hybrid role mining. Experiments on actual enterprise data show that our algorithm yields roles that both explain the given user-permission assignments and are meaningful from the business perspective.

Analyzing Quality Criteria in Role-based Identity and Access Management

“…Attribute-based Role Mining such as (Frank et al, 2009) are trying to incorporate business information through attributes into role mining. They rely on the assumption that additional semantic data is available and can be taken into account.…”

“…It can be seen as one of the most advanced measures that solely relies on the components of an RBAC state. It is usable for both, individual roles and role sets, and thus allows for a good AnalyzingQualityCriteriainRole-basedIdentityandAccessManagement Attribute-based Approaches (Frank et al, 2009) (Han et al, 2012) Uses criteria: Yes No comparability of RBAC states. As a result of its popularity, several existing role mining approaches are able to consider the WSC.…”

Mining Business-Relevant RBAC States through Decomposition

“…As for the bottom-up approach, Kuhlmann et al [13] first introduced the term "role mining", trying to apply existing data mining techniques to elicit roles from existing access data. After that, several algorithms explicitly designed for role engineering were proposed [10,11,18,20,21]. Several works prove that the role mining problem is reducible to many other well-known NP-hard problems, such as clique partition, binary matrix factorization, bi-clustering, graph vertex coloring [7] to cite a few.…”

“…Only few recent works value business requirements in role mining [2,4,11,14]. Their main limitation is to propose theoretical frameworks that are difficult to apply in real cases.…”

“…However, selecting the measure that fits the needs of an organization is not trivial, and no best practices exist to define it. In [11] the authors offer a probabilistic model: to find a set of roles that approximates the role mining problem (by considering potentially exceptional user-permission assignments); and, to contextually propose roles that likely are meaningful (by taking into account the relevance of each business attribute). However, there is no guarantee that the introduced approximation is licit.…”