DTAME: A Interpretable and Efficient Approach for ABAC Policy Mining and Evaluation Using Decision Trees
Zejun Lan, Jianfeng Guan, Xianming Gao, Tao Feng, Kexian Liu, Jianbang Chen · 2024
Attribute-Based Access Control (ABAC) has been chosen to replace the traditional access control model due to its dynamics, flexibility and scalability recently. However, during the migration and deployment process of ABAC policies, the key issue is how to mine accurate access control policies and quickly evaluate the policies when an access request arrives. Previous approaches typically addressed these two aspects separately, and the emergence of integrated solutions has provided new insights for addressing this issue. However, despite the high accuracy of the integrated solution in policy evaluation, it still falls short in terms of interpretability and performance. Therefore, this paper proposes a decision tree based ABAC policy mining and policy evaluation (DTAME) scheme, which employs different policy mining and evaluation algorithms based on various datasets. For access control lists, we utilize decision tree algorithms to mine ABAC policies and conduct policy evaluations based on policy trees. For access control logs, we adopt a decision tree to achieve performance approximating that of XGBoost. Experimental results show that the scheme offers superior interpretability and policy evaluation performance at the expense of a certain degree of accuracy.