Automated inference of access control policies For web applications

Ha Thanh Le, Cu D. Nguyen, Lionel Briand, Benjamin Hourte

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

Abstract

In this paper, we present a novel, semi-automated approach to infer access control policies automatically for web-based applications. Our goal is to support the validation of implemented access control policies, even when they have not been clearly specified or documented. We use role-based access control as a reference model. Built on top of a suite of security tools, our approach automatically exercises a system under test and builds access spaces for a set of known users and roles. Then, we apply a machine learning technique to infer access rules. Inconsistent rules are then analysed and fed back to the process for further testing and improvement. Finally, the inferred rules can be validated based on prespecified rules if they exist. Otherwise, the inferred rules are presented to human experts for validation and for detecting access control issues. We have evaluated our approach on two applications; one is open source while the other is a proprietary system built by our industry partner. The obtained results are very promising in terms of the quality of inferred rules and the access control vulnerabilities it helped detect.

Original languageEnglish
Title of host publicationSACMAT 2015 - Proceedings of the 20th ACM Symposium on Access Control Models and Technologies
PublisherAssociation for Computing Machinery
Pages27-37
Number of pages11
ISBN (Electronic)9781450335560
DOIs
Publication statusPublished - 1 Jun 2015
Externally publishedYes
Event20th ACM Symposium on Access Control Models and Technologies, SACMAT 2015 - Vienna, Austria
Duration: 1 Jun 20153 Jun 2015

Publication series

NameProceedings of ACM Symposium on Access Control Models and Technologies, SACMAT
Volume2015-June

Conference

Conference20th ACM Symposium on Access Control Models and Technologies, SACMAT 2015
Country/TerritoryAustria
CityVienna
Period1/06/153/06/15

Keywords

  • Access control policies
  • Inference
  • Machine learning

Fingerprint

Dive into the research topics of 'Automated inference of access control policies For web applications'. Together they form a unique fingerprint.

Cite this