Automating role-based provisioning by learning from examples

ABSTRACT

Role-based provisioning has been adopted as a standard component in leading Identity Management products due to its low administration cost. However, the cost of adjusting existing roles to entitlements from newly deployed applications is usually very high. In this paper, a learning-based approach to automate the provisioning process is proposed and its effectiveness is verified by real provisioning data. Specific learning issues related to provisioning are identified and relevant solutions are presented.

REFERENCES

• 1: Beyond Roles: A Practical Approach to Enterprise User Provisioning. Technical report, Hitachi ID System, INC.
• 2: Mohammad A. Al-Kahtani , Ravi Sandhu, Rule-Based RBAC with Negative Authorization, Proceedings of the 20th Annual Computer Security Applications Conference, p.405-415, December 06-10, 2004 [doi>10.1109/CSAC.2004.32]
• 3: M. R. Boutell, J. Luo, X. Shen, and C. M. Brown. Learning multi-label scene classification. Pattern Recognition, 37(9):1757--1771, 2004.
• 4: Leo Breiman, Bagging predictors, Machine Learning, v.24 n.2, p.123-140, Aug. 1996 [doi>10.1023/A:1018054314350]
• 5: C.-C. Chang and C.-J. Lin. LIBSVM: a library for support vector machines. National Taiwan University, version 2.86 edition, April 2008.
• 6: Amanda Clare , Ross D. King, Knowledge Discovery in Multi-label Phenotype Data, Proceedings of the 5th European Conference on Principles of Data Mining and Knowledge Discovery, p.42-53, September 03-05, 2001
• 7: Alina Ene , William Horne , Nikola Milosavljevic , Prasad Rao , Robert Schreiber , Robert E. Tarjan, Fast exact and heuristic methods for role minimization problems, Proceedings of the 13th ACM symposium on Access control models and technologies, June 11-13, 2008, Estes Park, CO, USA [doi>10.1145/1377836.1377838]
• 8: R.-E. Fan and C.-J. Lin. A study on threshold selection for multi-label classification. Department of Computer Science, National Taiwan University, 2007.
• 9: Martin Kuhlmann , Dalia Shohat , Gerhard Schimpf, Role mining - revealing business roles for security administration using data mining technology, Proceedings of the eighth ACM symposium on Access control models and technologies, June 02-03, 2003, Como, Italy [doi>10.1145/775412.775435]
• 10: Ian Molloy , Hong Chen , Tiancheng Li , Qihua Wang , Ninghui Li , Elisa Bertino , Seraphin Calo , Jorge Lobo, Mining roles with semantic meanings, Proceedings of the 13th ACM symposium on Access control models and technologies, June 11-13, 2008, Estes Park, CO, USA [doi>10.1145/1377836.1377840]
• 11: E. Perkins and P. Carpenter. Magic Quadrant for User Provisioning, Aug 2008. Gartner RAS Core Research Note G00159740.
• 12: R Development Core Team. R: a language and environment for statistical computing. R Foundation for Statistical Computing, Vienna, Austria, 2005. ISBN 3-900051-07-0. Available at http://www.R-project.org.
• 13: S. Sheng and S. L. Osborn. A classifier-based approach to user-role assignment for web applications. In Secure Data Management, volume 3178 of LNCS, pages 163--171. Springer, 2004.
• 14: Ioannis Tsochantaridis , Thomas Hofmann , Thorsten Joachims , Yasemin Altun, Support vector machine learning for interdependent and structured output spaces, Proceedings of the twenty-first international conference on Machine learning, p.104, July 04-08, 2004, Banff, Alberta, Canada [doi>10.1145/1015330.1015341]
• 15: Jaideep Vaidya , Vijayalakshmi Atluri , Qi Guo , Nabil Adam, Migrating to optimal RBAC with minimal perturbation, Proceedings of the 13th ACM symposium on Access control models and technologies, June 11-13, 2008, Estes Park, CO, USA [doi>10.1145/1377836.1377839]
• 16: Hua-Liang Wei , Stephen A. Billings, Feature Subset Selection and Ranking for Data Dimensionality Reduction, IEEE Transactions on Pattern Analysis and Machine Intelligence, v.29 n.1, p.162-166, January 2007 [doi>10.1109/TPAMI.2007.11]
• 17: Ian H. Witten , Eibe Frank, Data Mining: Practical Machine Learning Tools and Techniques, Second Edition (Morgan Kaufmann Series in Data Management Systems), Morgan Kaufmann Publishers Inc., San Francisco, CA, 2005
• 18: R. J. Witty. Suntrust implements role-based provisioning to a successful conclusion. Technical Report G00132894, Gartner RAS Core Research, Jan 12 2006.

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General
          Subjects: Security and protection (e.g., firewalls)

Additional Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Access controls

General Terms:
Management, Security, Standardization

Keywords:
access control, classification, provisioning, role