Automated extraction of security policies from natural-language software documents

Abstract

Access Control Policies (ACP) specify which principals such as users have access to which resources. Ensuring the correctness and consistency of ACPs is crucial to prevent security vulnerabilities. However, in practice, ACPs are commonly written in Natural Language (NL) and buried in large documents such as requirements documents, not amenable for automated techniques to check for correctness and consistency. It is tedious to manually extract ACPs from these NL documents and validate NL functional requirements such as use cases against ACPs for detecting inconsistencies. To address these issues, we propose an approach, called Text2Policy, to automatically extract ACPs from NL software documents and resource-access information from NL scenario-based functional requirements. We conducted three evaluations on the collected ACP sentences from publicly available sources along with use cases from both open source and proprietary projects. The results show that Text2Policy effectively identifies ACP sentences with the precision of 88.7% and the recall of 89.4%, extracts ACP rules with the accuracy of 86.3%, and extracts action steps with the accuracy of 81.9%.

Improving agile requirements: the Quality User Story framework and tool

“…Finally, the Text2Pol-icy tool attempts to extract access control policies (ACP) from natural language documents to reduce the manual effort for this tedious but important security task. Using both syntactic and semantic methods, this tool achieves accuracies ranging between 80 and 90 % for ACP sentence, rule, and action extraction [55]. The generation of models from natural language requirements has also been studied; for example, Friedrich et al [17] combined and augmented several NLP tools to generate BPMN models, resulting in an accuracy of 77 % on a data set of textmodel pairs from industry and textbooks.…”

Proactive detection of inadequate diagnostic messages for software configuration errors

“…For example, Zhong et al [70] employed NLP and machine learning (ML) techniques to infer resource specifications from API documents. Xiao et al [58] used shallow parsing techniques to infer Access Control Policy (ACP) rules from natural language text in use cases. Tan et al [50] applied an NLP-and ML-based approach to test Javadoc comments against implementations.…”

“…However, to the best of our knowledge, none of the previous work analyzes software diagnostic messages caused by configuration errors nor evaluates their adequacy. Our ConfDiagDetector technique applies NLP techniques to a different problem domain by checking the semantic similarity between two sentences (Section 2.3.1), rather than extracting useful properties from natural language properties [19,43,44,58].…”

Unsupervised Alignment of Privacy Policies using Hidden Markov Models

“…Past applications of NLP have sought to parse privacy policies into machine-readable representations (Brodie et al, 2006) or extract subpolicies from larger documents (Xiao et al, 2012). Machine learning has been applied to assess certain attributes of policies (Costante et al, 2012;Ammar et al, 2012;Costante et al, 2013;Zimmeck and Bellovin, 2013).…”