Attribute-based access control rules supported by biclique patterns

Technological trends demand the integration of the Attribute-based Access Control (ABAC) model in security systems, which makes possible the definition of high-granularity rules by combining attribute-values of different entities. Instead of establishing ABAC rules from scratch, an attainable solution is to generate rules automatically by detecting attribute-value patterns in the existing permissions recorded in access logs. The patterns employed in the literature are supported by frequency, so only frequent attribute-value patterns are good candidates for creating rules. However, they are not convenient when most of the attribute-values are not frequent in the security system, since it will be required a too low frequency support to cover a considerable portion of the access log. On the other hand, increasing the frequency support will leave many resources without rules when most of the resources in the system have few requesters. We propose an alternative procedure that supports ABAC rules by means of graph-patterns extracted from the topology induced by the interaction of users and resources in the log. This new pattern consists of a subset of connected bicliques that share attribute-values. Our strategy tested on two real access logs is capable of covering more resources with few requesters than the frequency-based approach, and it does not suffer rule explosion.