信息网络安全

信息网络安全 ›› 2022, Vol. 22 ›› Issue (11): 7-16.doi: 10.3969/j.issn.1671-1122.2022.11.002

• 技术研究 • 上一篇    下一篇

异常权限配置下的角色挖掘方案

沈卓炜1,2, 范琳丽1,2, 华童1,2, 王科翔3   

  1. 1. 东南大学网络空间安全学院，南京 211189
    2. 东南大学计算机网络和信息集成教育部重点实验室，南京211189
    3. 中国航空研究院，北京 100029
  • 收稿日期:2022-06-01 出版日期:2022-11-10 发布日期:2022-11-16
  • 作者简介:沈卓炜（1974—），男，江苏，副教授，博士，主要研究方向为分布式系统与网络安全|范琳丽（1996—），女，吉林，硕士研究生，主要研究方向为分布式系统与网络安全|华童（1998—），男，江苏，硕士研究生，主要研究方向为分布式系统与网络安全|王科翔（1991—），男，河南，工程师，硕士，主要研究方向为航空电子系统
  • 基金资助:
    国家重点研发计划(2018YFB1800602)

Role Mining Scheme with Abnormal Permission Configuration

SHEN Zhuowei1,2, FAN Linli1,2, HUA Tong1,2, WANG Kexiang3   

  1. 1. School of Cyber Science and Engineering, Southeast University, Nanjing 211189, China
    2. Key Laboratory of Computer Network and Information Integration of Ministry of Education, Southeast University, Nanjing 211189, China
    3. Chinese Aeronautical Establishment, Beijing 100029, China
  • Received:2022-06-01 Online:2022-11-10 Published:2022-11-16

RichHTML

20

PDF (PC)

140

摘要：

角色挖掘是构建RBAC系统的常用方法，但目前的角色挖掘方案在设计 时未考虑原始系统存在异常权限配置问题，导致角色挖掘的结果可能包含错误的角色 权限配置，给系统带来极大的安全风险。针对该问题，文章提出一种异常权限配置下 的角色挖掘方案。首先在用户聚类部分引入Canopy预聚类，通过预聚类提取子集交 叠数据，缩小后续谱聚类计算量；然后结合预聚类结果优化谱聚类的初始值选取，并 针对访问控制数据由布尔值表示的特点，采用杰卡德距离和汉明距离相结合的方式对 Canopy预聚类和谱聚类的距离进行度量，提高用户聚类效果；最后对异常权限配置检 测规则进行细化，利用修正后的用户聚类结果进行角色挖掘。实验结果表明，该方案 能够有效发现异常权限配置，提高角色挖掘效率。

关键词: 角色挖掘, Canopy预聚类, 谱聚类, 异常权限配置检测

Abstract:

Role mining is a common method to build RBAC system. However, the current role mining schemes don’t detect the abnormal permission configuration in the original system, so that the result of role mining may contain the wrong role permission configuration, which brings security risks to the system. To solve the above problem, role mining scheme tolerating abnormal permission configuration is proposed. First, Canopy preclustering is introduced to reduce the subsequent spectral clustering calculation in the user clustering part by extracting the subset overlapping data. Then, the initial value selection of spectral clustering was optimized by combining the preclustering results, and the distance of Canopy preclustering and spectral clustering was measured by combining Jakard distance and Hamming distance, aiming at the characteristics that access control data are represented by Boolean values, so as to improve user clustering effect. Finally, the abnormal permission configuration detection rules are refined, and the modified user clustering results are used for role mining. Experimental results show that the scheme can find abnormal permission configuration effectively and improve the efficiency of role mining.

Key words: role mining, Canopy preclustering, spectral clustering, abnormal permission configuration detection

中图分类号: