Access Control Policy Generation from User Stories Using Machine Learning - Data and Applications Security and Privacy XXXV Access content directly
Conference Papers Year : 2021

Access Control Policy Generation from User Stories Using Machine Learning

John Heaps
  • Function : Author
  • PersonId : 1135153
Ram Krishnan
  • Function : Author
  • PersonId : 1010017
Yufei Huang
  • Function : Author
  • PersonId : 1135154
Jianwei Niu
  • Function : Author
  • PersonId : 1135155
Ravi Sandhu
  • Function : Author
  • PersonId : 978076

Abstract

Agile software development methodology involves developing code incrementally and iteratively from a set of evolving user stories. Since software developers use user stories to write code, these user stories are better representations of the actual code than that of the high-level product documentation. In this paper, we develop an automated approach using machine learning to generate access control information from a set of user stories that describe the behavior of the software product in question. This is an initial step to automatically produce access control specifications and perform automated security review of a system with minimal human involvement. Our approach takes a set of user stories as input to a transformers-based deep learning model, which classifies if each user story contains access control information. It then identifies the actors, data objects, and operations the user story contains in a named entity recognition task. Finally, it determines the type of access between the identified actors, data objects, and operations through a classification prediction. This information can then be used to construct access control documentation and information useful to stakeholders for assistance during access control engineering, development, and review.
Fichier principal
Vignette du fichier
513274_1_En_10_Chapter.pdf (748.83 Ko) Télécharger le fichier
Origin : Files produced by the author(s)

Dates and versions

hal-03677037 , version 1 (24-05-2022)

Licence

Attribution

Identifiers

Cite

John Heaps, Ram Krishnan, Yufei Huang, Jianwei Niu, Ravi Sandhu. Access Control Policy Generation from User Stories Using Machine Learning. 35th IFIP Annual Conference on Data and Applications Security and Privacy (DBSec), Jul 2021, Calgary, AB, Canada. pp.171-188, ⟨10.1007/978-3-030-81242-3_10⟩. ⟨hal-03677037⟩
9 View
13 Download

Altmetric

Share

Gmail Facebook X LinkedIn More