Mining Roles with Multiple Objectives

Abstract

With the growing adoption of Role-Based Access Control (RBAC) in commercial security and identity management products, how to facilitate the process of migrating a non-RBAC system to an RBAC system has become a problem with significant business impact. Researchers have proposed to use data mining techniques to discover roles to complement the costly top-down approaches for RBAC system construction. An important problem is how to construct RBAC systems with low complexity. In this article, we define the notion of weighted structural complexity measure and propose a role mining algorithm that mines RBAC systems with low structural complexity. Another key problem that has not been adequately addressed by existing role mining approaches is how to discover roles with semantic meanings. In this article, we study the problem in two primary settings with different information availability. When the only information is user-permission relation, we propose to discover roles whose semantic meaning is based on formal concept lattices. We argue that the theory of formal concept analysis provides a solid theoretical foundation for mining roles from a user-permission relation. When user-attribute information is also available, we propose to create roles that can be explained by expressions of user-attributes. Since an expression of attributes describes a real-world concept, the corresponding role represents a real-world concept as well. Furthermore, the algorithms we propose balance the semantic guarantee of roles with system complexity. Finally, we indicate how to create a hybrid approach combining top-down candidate roles. Our experimental results demonstrate the effectiveness of our approaches.

Evolutionary Inference of Attribute-Based Access Control Policies

“…Other non-evolutionary approaches have been proposed for mining policies from logs for less expressive access control models (e.g., RBAC [7,8]). In some cases, additional information, besides the request logs, is needed as training data [9].…”

“…We assess the complexity of a policy P with the weighted structural complexity (WSC) [8]. WSC is a weighted sums of the complexity of rule components (e U , e R , O and c)-see [5] for the details.…”

Toward Mining of Temporal Roles

“…Other role mining approaches include role mining with noisy data [12], where the input data is first cleansed to remove the noise before generating candidate roles, role mining based on weights [10] in which a certain weight is associated with each permission depending on its importance, mining roles having low structural complexity and semantic meaning [11], and Visual Role Mining (VRM) [4], which enumerates roles based on a visual analysis of the graphical representation of the user-permission assignments. Xu and Stoller [19] propose algorithms for role mining which optimize a number of policy quality metrics.…”

Mining parameterized role-based policies

“…Our algorithms aim to optimize the policy's weighted structural complexity (WSC), which is a generalization of policy size [8]. The weighted structural complexity of a core PRBAC policy is defined by…”

“…Xu and Stoller's elimination algorithm is partly inspired by Molloy et al's Hierarchical Miner algorithm for mining roles with semantic meaning based on user-attribute data [8]. Colantonio et al developed a different method for taking user-attribute data into account during role mining; their method partitions the set of users based on the values of selected attributes, and then performs role mining separately for each of the resulting sets of users [2].…”