Towards Learning Risk Estimation Functions for Access Control∗

Summary The security of access and information flow carries with it the risk that resources will be misused – intentionally or accidentally. Static Access Control (AC) policies based on qualitative judgements are insufficient for scenarios where roles and access requirements are subtle and change frequently. We propose using quantified risk and benefit estimates in the design and management of AC policies. The first step is to build models for estimating risk and benefit. Many factors may affect risk and benefit, and the relationship among them and their impacts are usually complex and hard to determine analytically. Therefore we decided to use machine learning techniques to learn the models from AC data. Due to the sensitive and evolving nature of real AC data, we must generate synthetic data to begin demonstrating the efficacy of our approach. Given that no sets of AC data could cover all possibilities, we must also show that the models learned can be applied to data outside the training sets. We start examining these problems by first creating a parametrised simulation model, designed to capture certain properties related to the risk and benefit of information transfer, including how risk aggregates over time. We then explore how different choices of the model parameters affect our ability to predict this risk, and describe some preliminary results of transferring learning between different instantiations of the model. Motivation Access control has traditionally focused on static sets of roles, and this implies a fixed mapping from users to permissions. The JASON report [7] indicated that this approach is too rigid for modern organisations