Automatic Top-Down Role Engineering Framework Using Natural Language Processing Techniques

Abstract : A challenging problem in managing large networks is the complexity of security administration. Role Based Access Control (RBAC) is the most well-known access control model in diverse enterprises of all sizes because of its ease of administration as well as economic benefits it provides. Deploying such system requires identifying a complete set of roles which are correct and efficient. This process, called role engineering, has been identified as one of the most expensive tasks in migrating to RBAC. Numerous bottom-up, top-down, and hybrid role mining approaches have been proposed due to increased interest in role engineering in recent years. In this paper, we propose a new top-down role engineering approach and take the first step towards extracting access control policies from unrestricted natural language requirements documents. Most organizations have high-level requirement specifications that include a set of access control policies which describes allowable operations for the system. It is very time consuming, labor-intensive, and error-prone to manually sift through these natural language documents to identify and extract access control policies. We propose to use natural language processing techniques, more specifically Semantic Role Labeling (SRL) to automatically extract access control policies from these documents, define roles, and build an RBAC system. By successfully applying semantic role labeling to identify predicate-argument structure, and using a set of predefined rules on the extracted arguments, we were able correctly identify access control policies with a precision of 79%, recall of 88%, and F1 score of 82%.
Type de document :
Communication dans un congrès
Raja Naeem Akram; Sushil Jajodia. 9th Workshop on Information Security Theory and Practice (WISTP), Aug 2015, Heraklion, Crete, Greece. Springer, Lecture Notes in Computer Science, LNCS-9311, pp.137-152, 2015, Information Security Theory and Practice. 〈10.1007/978-3-319-24018-3_9〉
Liste complète des métadonnées

https://hal.inria.fr/hal-01442558
Contributeur : Hal Ifip <>
Soumis le : vendredi 20 janvier 2017 - 16:48:13
Dernière modification le : vendredi 20 janvier 2017 - 16:52:44
Document(s) archivé(s) le : vendredi 21 avril 2017 - 16:10:24

Fichier

978-3-319-24018-3_9_Chapter.pd...
Fichiers produits par l'(les) auteur(s)

Licence


Distributed under a Creative Commons Paternité 4.0 International License

Identifiants

Citation

Masoud Narouei, Hassan Takabi. Automatic Top-Down Role Engineering Framework Using Natural Language Processing Techniques. Raja Naeem Akram; Sushil Jajodia. 9th Workshop on Information Security Theory and Practice (WISTP), Aug 2015, Heraklion, Crete, Greece. Springer, Lecture Notes in Computer Science, LNCS-9311, pp.137-152, 2015, Information Security Theory and Practice. 〈10.1007/978-3-319-24018-3_9〉. 〈hal-01442558〉

Partager

Métriques

Consultations de la notice

175

Téléchargements de fichiers

10