.png){kind=icon}
返回
Bi-objective Optimization in Role Mining
.png){kind=icon}
OA
AI
DOI：10.1145/3697833.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Role mining is a technique that is used to derive a role-based authorization policy from an existing policy. Given a set of users U, a set of permissions P, and a user-permission authorization relation UPA subset of U x P, a role mining algorithm seeks to compute a set of roles R, a user-role authorization relation UA subset of U x R, and a permission-role authorization relation PA subset of R x P, such that the composition of UA and PA is close (in some appropriate sense) to UPA. Role mining is therefore a core problem in the specification of role-based authorization policies. Role mining is known to be hard in general and exact solutions are often impossible to obtain, so there exists an extensive literature on variants of the role mining problem that seek to find approximate solutions and algorithms that use heuristics to find reasonable solutions efficiently. In this article, we first introduce the Generalized Noise Role Mining problem (GNRM)-a generalization of the MINNOISE ROLE MINING problem-which we believe has considerable practical relevance. In particular, GNRM can produce security-aware or availability-aware solutions. Extending the work of Fomin et al., we show that GNRM is fixed parameter tractable, with parameter r + k, where r is the number of roles in the solution and k is the number of discrepancies between UPA and the relation defined by the composition of UA and PA. We further introduce a bi-objective optimization variant of GNRM, where we wish to minimize both r and k subject to upper bounds r <= r and k <= k, where r and k are constants. We show that the Pareto front of this bi-objective optimization problem (BO-GNRM) can be computed in fixed-parameter tractable time with parameter r + k. From a practical perspective, a solution to BO-GNRM gives security managers the opportunity to identify a mined policy offering the best tradeoff between the number of policy discrepancies and the number of roles. We then report the results of our experimental work using the integer programming solver Gurobi to solve instances of BO-GNRM. Our key findings are that (a) we obtained strong support that Gurobi's performance is fixed-parameter tractable, and (b) our results suggest that our techniques may be useful for role mining in practice, based on our experiments in the context of three well-known real-world authorization policies. We observed that, in many cases, our solver is capable of obtaining optimal solutions when the values of either k or r are small.
Keyword:
Role mining
generalized noise role mining
fixed-parameter tractability
期刊
A
IF:
2.8
论文数:
292
被引数:
770
机构
引用论文
Demographic and Breeding Performance of a New Kelp GullLarus dominicanusColony in Patagonia, Argentina巴塔哥尼亚阿根廷地区一个新的海鸥属Larus dominicanus种群的种群统计与繁殖表现.png)
Ardeola
OAAI
ArdeolaIF0
OAAI分享收藏Further photographic record of Asiatic Brush-tailed Porcupine Atherurus macrourus Linnaeus, 1758 (Mammalia: Rodentia: Hystricidae) from Manas National Park, Assam, India来自印度阿萨姆邦马纳斯国家公园的亚洲刺尾豪猪Atherurus macrourus Linnaeus, 1758（哺乳纲：啮齿目：豪猪科）的进一步照片记录OAAI
OAAI分享收藏First photographic record of the Asiatic Brush-tailed Porcupine Atherurus macrourus (Linnaeus, 1758) (Mammalia: Rodentia: Hystricidae) from the Barak Valley region of Assam, India首次记录亚洲刷尾豪猪 Atherurus macrourus (Linnaeus, 1758) (哺乳纲：啮齿目：豪猪科) 在印度阿萨姆邦巴拉克河谷地区的照片资料OAAI
OAAI分享收藏
查看更多内容