PAMMELA: Policy Administration Methodology using Machine Learning

Abstract

In recent years, Attribute-Based Access Control (ABAC) has become quite popular and effective for enforcing access control in dynamic and collaborative environments. Implementation of ABAC requires the creation of a set of attribute-based rules which cumulatively form a policy. Designing an ABAC policy ab initio demands a substantial amount of effort from the system administrator. Moreover, organizational changes may necessitate the inclusion of new rules in an already deployed policy. In such a case, re-mining the entire ABAC policy will require a considerable amount of time and administrative effort. Instead, it is better to incrementally augment the policy. Keeping these aspects of reducing administrative overhead in mind, in this paper, we propose PAMMELA, a Policy Administration Methodology using Machine Learning to help system administrators in creating new ABAC policies as well as augmenting existing ones. PAMMELA can generate a new policy for an organization by learning the rules of a policy currently enforced in a similar organization. For policy augmentation, PAMMELA can infer new rules based on the knowledge gathered from the existing rules. Experimental results show that our proposed approach provides a reasonably good performance in terms of the various machine learning evaluation metrics as well as execution time.

Exploring the Role of Machine Learning in Enhancing Access Control Systems: A Comprehensive Review

“…Used in # of studies Percentage SVM [51], [39], [56], [65], [46], [64], [40], [59], [38], [74], [8], [75], [62], [76], [77], [37] 16 25 % RF [50], [41], [44], [26], [64], [29], [59], [60], [10], [33], [34], [13], [37], [69] 14 22 % DT [9], [42], [25], [71], [72], [49], [66], [33], [77] 9 14 % KNN [41], [45] , [46], [66], [59], [10] [8], [77], [43], [70], [73], S15, [53],…”

“…Used in # of studies Percentage ABAC [23], [24], [25], [26], [12], [27], [28], [29], [10], [30], [31], [32], [33], [34], [13], [35], [36] and MLBAC were each used in one study (2%). Some studies may have employed multiple access control models, such as [25], which utilized both ABAC and ReBAC.…”

“…Metrics like AUC, ROC, and FNR were employed in two studies each, and the remaining metrics were reported only once. It is important to note that multiple [23], [41], [44], [53], [45], [24], [42], [70], [39], [56], [46], [26], [71], [64], [40], [28], [43], [66], [10], [30], [31], [47], [62], [33], [76], [13], [37], [67] 28 45 % Accuracy [52], [53], [70], [39], [65], [12], [71], [72], [64], [40], [57], [28], [43], [66], [59], [10], [61], [38], [48], [8], [62],…”

Effective Machine Learning-based Access Control Administration through Unlearning

“…The authors in [16] use a Long-Short Term Memory (LSTM) network to extract ABAC attributes from natural language policies. PAMMELA [17] addresses the problem of administration of traditional systems powered by ML. Implementing and comparing various models for ABAC policy administration, creating new rules, and extending existing ones based on change requests.…”