Name
Abstract | ||
|---|---|---|
In this paper, we present a novel, semi-automated approach to infer access control policies automatically for web-based applications. Our goal is to support the validation of implemented access control policies, even when they have not been clearly specified or documented. We use role-based access control as a reference model. Built on top of a suite of security tools, our approach automatically exercises a system under test and builds access spaces for a set of known users and roles. Then, we apply a machine learning technique to infer access rules. Inconsistent rules are then analysed and fed back to the process for further testing and improvement. Finally, the inferred rules can be validated based on pre-specified rules if they exist. Otherwise, the inferred rules are presented to human experts for validation and for detecting access control issues. We have evaluated our approach on two applications; one is open source while the other is a proprietary system built by our industry partner. The obtained results are very promising in terms of the quality of inferred rules and the access control vulnerabilities it helped detect. |
Year | DOI | Venue |
|---|---|---|
2015 | 10.1145/2752952.2752969 | Proceedings of the 20th ACM Symposium on Access Control Models and Technologies |
Keywords | Field | DocType |
access control policies,inference,machine learning,restructuring, reverse engineering, and reengineering | System under test,Data mining,Reference model,Suite,Computer security,Computer science,Inference,Role-based access control,Access control,Web application,Database,Vulnerability | Conference |
Citations | PageRank | References |
3 | 0.37 | 16 |
Authors | ||
4 | ||
Name | Order | Citations | PageRank |
|---|---|---|---|
| Ha-Thanh Le | 1 | 7 | 3.07 |
| Cu Duy Nguyen | 2 | 45 | 2.62 |
| Lionel C. Briand | 3 | 8795 | 481.98 |
| Benjamin Hourte | 4 | 3 | 0.37 |