A clustering-based access control policy anomaly detection method

Abstract

The present invention discloses an access control policy anomaly detection method based on clustering idea. First, the system initializes the rule set and memory matrix; secondly, any rule pair is selected from the initialized rule set, and the similarity of the rule pair and the trust attribute difference of the rule pair are calculated; thirdly, the system clusters the rule set using the idea of ​​partitioning clustering algorithm, and divides the rules with similarity into the same cluster; then, the system determines whether all the rules in the rule set have been divided into clusters. If there are rules that do not belong to any cluster, a new cluster containing the rule is created to ensure that all rules are divided; finally, in combination with the abnormal policy classification method, different types of abnormal policies are detected and classified. The present invention combines the idea of ​​clustering algorithm and the trust attribute in the rule, takes the rule similarity as the clustering index, and can efficiently detect abnormal access control policies.

Description

Technical Field

[0001] The present invention relates to the technical field of attribute access control and policy anomaly detection, and in particular to an access control policy anomaly detection method based on clustering idea. Background Art

[0002] In the current increasingly complex IoT environment, IoT systems in different domains are isolated, which makes IoT data often have cross-domain and heterogeneous characteristics. How to ensure the secure interaction of IoT data between different security domains, how to ensure the access security of cross-domain systems, and how to efficiently detect abnormal strategies are the main problems facing IoT security.

[0003] The access control model assists decision makers in protecting the system security through the access control policies set by decision makers, ensuring that authorized users can obtain the required information resources while preventing unauthorized users from accessing. However, these access control policies are relatively complex to configure, and often require professional system administrators to perform complicated operations to ensure the smooth operation of the access control system. In addition, due to improper policy configuration or malicious attacks, abnormal policies are easily hidden in the massive policy set, threatening system security. At present, the anomaly detection methods for access control policies mainly focus on mathematical theory derivation and tree structure.

[0004] The access control policy anomaly detection method based on the mathematical knowledge of matrix theory uses the transformation matrix to reflect the linear correlation between the meta-policy and the complex policy, and also reflects the relationship between the elements in the meta-policy set. It combines the knowledge of matrix theory to abstract the policy, and can construct a matrix description method for complex policies, and detect anomalies of the policy based on the transformation matrix. However, this type of method requires a lot of space to store the transformation matrix when constructing complex policies, and the calculation process takes up a lot of storage resources. The core part of the access control policy anomaly detection method based on the tree structure is the rule dimension cutting, which can divide the rules without anomalies into different nodes, and the rules that may have anomalies into the same node, and use this to detect abnormal policies. However, the detection accuracy of the abnormal policy based on the tree structure is not high. It can only judge the rules that may have anomalies by the number of rules in the leaf node. At the same time, it cannot identify different types of abnormal policies, which has certain limitations.

[0005] In the Internet of Things environment, short detection time, low time and space complexity, and strong scalability are the design goals of access control policy anomaly detection methods. However, the existing access control policy anomaly detection methods are difficult to meet the requirements, will occupy a large amount of computing resources, and cannot be directly applied to the Internet of Things environment. Summary of the invention

[0006] The purpose of the present invention is to provide an access control policy anomaly detection method based on clustering idea to solve the above-mentioned problems. By combining the idea of ​​partitioning clustering algorithm and the difference of rule trust attributes, efficient detection of abnormal policies is achieved. In addition, the present invention utilizes abnormal policy classification method to detect and classify different types of abnormal policies. At the same time, the method reduces the computational complexity and saves computing resources of the Internet of Things environment while accurately detecting abnormal policies.

[0007] The technical solution adopted by the present invention to achieve the above-mentioned purpose is:

[0008] A method for detecting anomalies in access control policies based on clustering ideas, the method comprising the following steps:

[0009] (1) System initialization, generating the rule set SP and the memory matrix Clustered[n];

[0010] (2) Calculate the similarity S of any pair of rules in the rule set R ;

[0011] (3) Rule clustering: using clustering ideas and differences in trust attributes in rules, the rule set is divided into different clusters and the cluster set C is output;

[0012] (4) Abnormal strategy classification: combining rule-based abnormality classification methods to classify different types of abnormal strategies;

[0013] Preferably, the rule set SP = {R1, R2, ..., R n}, the memory matrix Clustered[i] is used to identify the rule R i Whether the cluster has been divided into existing clusters.

[0014] Preferably, any two rules R in step (2) i and R j The similarity measure is calculated as follows:

[0015]

[0016] The symbols S, O, and E are used to represent the access subject, resource object, and environment category; x = {W S ,W O ,W E} is used to indicate the relative importance of each attribute category in the similarity calculation process, and

[0017] Further, S. x (R i ,R j ) is used to represent the rule r iand rule r j The specific calculation method of the similarity score of each category based on the common attribute attr is as follows:

[0018]

[0019] Among them, the two rules r i and r j The similarity value of each category is obtained by the common attribute similarity value and the corresponding importance Multiply and sum the result; attr x ∈{ATTR x (R i )∩ATTR x (R j )} refers to the attribute attr x There are two rules R i and R j Common attributes under category x, ATTR x (R i ) refers to rule R i The set of attributes for category x in .

[0020] Furthermore, the two rules R i and R j The attribute similarity value of category x The calculation method is as follows:

[0021]

[0022] in, It refers to the rule R i and R j The number of common attributes under category x, It means rule R i and R j The number of different attributes under category x.

[0023] Preferably, step (3) specifically comprises the following steps:

[0024] (31) Select a rule pair (R1, R2) from the initialized rule set SP, and calculate the similarity value of the rule pair (R1, R2) according to the rule similarity calculation method given in step (2);

[0025] (32) Compare the differences in the trust attributes of the rule pair (R1, R2) and represent them as dif(R1, R2);

[0026] (33) Determine whether the similarity value of the rule pair (R1, R2) calculated in step (31) is greater than the threshold value threshold, and whether the difference dif(R1, R2) of the trust value attribute is 0. If the similarity value of the rule pair (R1, R2) does not exceed the threshold value threshold, it is considered that the rule pair is not similar; if the similarity value of the rule pair (R1, R2) exceeds the threshold value threshold, then introduce the difference dif(R1, R2) of the trust attribute. If dif(R1, R2) is 0 at the same time, it is considered that the rule pair (R1, R2) is similar, otherwise, the rule pair (R1, R2) is not similar;

[0027] (34) If the rule pair (R1, R2) is similar, determine whether rule R2 is the first similar rule of rule R1. If so, create a new cluster containing the rule pair (R1, R2) and find the next pair of rules from the rule set SP; if not, add rule R2 to the existing cluster and find the next pair of rules from the rule set SP; if the rule pair (R1, R2) is not similar, directly find the next pair of rules from the rule set SP;

[0028] (35) Repeat steps (31) to (34), continuously searching for unclustered rule pairs in the rule set SP, and clustering the rule pairs until no new unclustered rule pairs can be found in the rule set SP;

[0029] (36) Determine whether all rules in the rule set SP have been divided into clusters. If there is a rule R i If it does not exist in any cluster, create a new inclusion rule R i of clusters.

[0030] Preferably, the abnormal strategy classification in step (4) is based on the study of rule abnormality types by Khoumsi et al.:

[0031] 1) Non-conflicting exception: During the access control process, when an access request matches two or more rules at the same time, and these rules have the same operation decision X a , it means that a non-conflict exception has occurred, which is also called a redundant exception.

[0032] 2) Conflict anomaly: During the access control process, when an access request matches two or more rules at the same time, and these rules have different operation decisions X a, it means that a conflict exception has occurred. Conflict exceptions are generally divided into partial permission conflicts and formal conflicts. When two or more rules matched by an access request have contradictory operation decisions, a formal conflict is considered to have occurred; when two or more rules matched by an access request have mixed operation decisions, a partial permission conflict is considered to have occurred, such as when the operation decision is allow read and allow read,write Similar rules have some permission conflicts.

[0033] Furthermore, the present invention detects the above two types of anomalies respectively:

[0034] 1) Detecting Redundancy Anomalies

[0035] For cluster C k Any two rules R i and R j , if they have a containment relationship, that is or And their operation decisions are the same, that is, X a (R i )=Y b (R j ), then these two rules are detected as redundant anomalies, defined as follows:

[0036]

[0037] 2) Detect conflict anomalies

[0038] For cluster C k Any two rules R i and R j , if they have a compatible relationship, that is And their operation decisions are different, that is, X a (R i )≠Y b (R j ), then these two rules are detected as conflicting anomalies, defined as follows:

[0039]

[0040] Beneficial effects: Compared with the prior art, the present invention has the following beneficial effects: The present invention combines the idea of ​​partitioning clustering algorithm and the difference of rule trust attributes to realize efficient detection of abnormal strategies. In addition, the present invention utilizes the abnormal strategy classification method to detect and classify different types of abnormal strategies. At the same time, the method reduces the computational complexity while accurately detecting abnormal strategies, saving computing resources in the IoT environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1It is a flow chart of the present invention.

[0042] Figure 2 This is a flow chart of rule clustering.

[0043] Figure 3 Flowchart for classification of exception strategies. DETAILED DESCRIPTION

[0044] The present invention will be further described below in conjunction with the accompanying drawings. Figure 1 As shown, the present invention comprises the following steps:

[0045] Step 1, system initialization: First initialize the rule set SP and memory matrix Clustered[n], where SP = {R1, R2, ..., R n}, Clustered[i] is used to identify rule R i Whether to be divided into existing clusters, initially set to false;

[0046] Step 2, similarity calculation: select a rule pair (R1, R2) from the initialized rule set SP, and calculate the similarity value of the rule pair (R1, R2) according to the rule similarity calculation formula. The detailed steps of the algorithm are as follows:

[0047] In the attribute access control policy, any two rules R i and R j The similarity measure is calculated as follows:

[0048]

[0049] The symbols S, O, and E are used to represent the access subject, resource object, and environment category; x = {W S ,W O ,W E} is used to indicate the relative importance of each attribute category in the similarity calculation process, and

[0050] And, S x (R i ,R j ) is used to represent the rule r i and rule r j The specific calculation method of the similarity score of each category based on the common attribute attr is as follows:

[0051]

[0052] Among them, the two rules r i and r j The similarity value of each category is obtained by the common attribute similarity value and the corresponding importance Multiply and sum the result; attr x ∈{ATTR x (R i )∩ATTR x (R j )} refers to the attribute attr x There are two rules R i and R j Common attributes under category x, ATTR x (R i ) refers to rule R i The set of attributes for category x in .

[0053] And, the two rules R i and R j The attribute similarity value of category x The calculation method is as follows:

[0054]

[0055] in, It refers to the rule R i and R j The number of common attributes under category x, It means rule R i and R j The number of different attributes under category x.

[0056] Step 3, rule clustering: In the process of the present invention, the rules are divided and clustered, including the following steps:

[0057] (1) Select a rule pair (R1, R2) from the initialized rule set SP, and calculate the similarity value of the rule pair (R1, R2) according to the rule similarity calculation method given in step (2);

[0058] (2) Compare the differences in the trust attributes of the rule pair (R1, R2) and represent them as dif(R1, R2);

[0059] (3) Determine whether the similarity value of the rule pair (R1, R2) calculated in step (31) is greater than a threshold value threshold, and whether the difference dif(R1, R2) of the trust value attribute is 0. If the similarity value of the rule pair (R1, R2) does not exceed the threshold value threshold, it is considered that the rule pair is not similar; if the similarity value of the rule pair (R1, R2) exceeds the threshold value threshold, the difference dif(R1, R2) of the trust attribute is introduced. If dif(R1, R2) is 0 at the same time, it is considered that the rule pair (R1, R2) is similar; otherwise, the rule pair (R1, R2) is not similar;

[0060] (4) If the rule pair (R1, R2) is similar, determine whether rule R2 is the first similar rule of rule R1. If so, create a new cluster containing the rule pair (R1, R2) and search for the next pair of rules from the rule set SP. If not, add rule R2 to the existing cluster and search for the next pair of rules from the rule set SP. If the rule pair (R1, R2) is not similar, search for the next pair of rules directly from the rule set SP.

[0061] (5) Repeat (1)-(4), continuously searching for unclustered rule pairs in the rule set SP, and clustering the rule pairs until no new unclustered rule pairs can be found in the rule set SP;

[0062] (6) Determine whether all rules in the rule set SP have been divided into clusters. If there is a rule R i If it does not exist in any cluster, create a new inclusion rule R i of clusters.

[0063] The rule clustering process is as follows Figure 2 shown.

[0064] Step 4, anomaly strategy classification: The anomaly strategy classification is based on the study of rule anomaly types by Khoumsi et al.

[0065] Exceptions to rules are generally divided into two categories:

[0066] 1) Non-conflicting exception: During the access control process, when an access request matches two or more rules at the same time, and these rules have the same operation decision X a , it means that a non-conflict exception has occurred, which is also called a redundant exception.

[0067] 2) Conflict anomaly: During the access control process, when an access request matches two or more rules at the same time, and these rules have different operation decisions X a , it means that a conflict exception has occurred. Conflict exceptions are generally divided into partial permission conflicts and formal conflicts. When two or more rules matched by an access request have contradictory operation decisions, a formal conflict is considered to have occurred; when two or more rules matched by an access request have mixed operation decisions, a partial permission conflict is considered to have occurred, such as when the operation decision is allow read and allow read,write Similar rules have some permission conflicts.

[0068] Furthermore, the present invention detects the above two types of anomalies respectively:

[0069] 1) Detecting Redundancy Anomalies

[0070] For cluster C k Any two rules R i and R j , if they have a containment relationship, that is or And their operation decisions are the same, that is, X a (R i )=Y b (R j ), then these two rules are detected as redundant anomalies, defined as follows:

[0071]

[0072] 2) Detect conflict anomalies

[0073] For cluster C k Any two rules R i and R j , if they have a compatible relationship, that is And their operation decisions are different, that is, X a (R i )≠Y b (R j ), then these two rules are detected as conflicting anomalies, defined as follows:

[0074]

[0075] Furthermore, conflict anomalies are subdivided into two types of anomalies: formal conflicts and partial authority conflicts.

[0076] (a) Conflict of Form

[0077] Form conflict Based on the definition of conflict exception, restrictions on operation decisions are added, that is, for cluster C k Any two rules R i and R j In addition to satisfying the definition of conflict anomaly, it must also satisfy a=b and X≠Y (that is, for the same operation, one rule gives permission and the other rule gives rejection), which is defined as follows:

[0078]

[0079] (b) Partial authority conflicts

[0080] Partial permission conflicts are based on the definition of conflict exceptions, and also add restrictions on operation decisions, that is, for cluster C k Any two rules R i and R jIn addition to meeting the definition of conflict anomaly, a≠b and X=Y must also be met (i.e. two rules allow / deny different operations at the same time), which is defined as follows:

[0081]

[0082] The abnormal strategy classification process is as follows Figure 3 shown.

[0083] The technical means disclosed in the present invention are not limited to the technical means disclosed in the above technical means, but also include technical solutions composed of equivalent replacements of the above technical features. Matters not covered in the present invention belong to the common knowledge of those skilled in the art.

Claims

1. A method for detecting anomalies in access control policies based on clustering, characterized in that: The following steps are involved: (1) System initialization, generating the rule set SP and the memory matrix Clustered[n]; (2) Calculate the similarity S of any pair of rules in the rule set R ; (3) Rule clustering: using clustering ideas and differences in trust attributes in rules, the rule set is divided into different clusters and the cluster set C is output; (4) Abnormal strategy classification: Combined with the rule-based abnormality classification method, different types of abnormal strategies are classified; Step (3) specifically includes the following steps: (31) Select a rule pair (R1, R2) from the initialized rule set SP, and calculate the similarity value of the rule pair (R1, R2) according to the rule similarity calculation method given in step (2); (32) Compare the differences in the trust attributes of the rule pair (R1, R2) and represent them as dif(R1, R2); (33) Determine whether the similarity value of the rule pair (R1, R2) calculated in step (31) is greater than the threshold value threshold, and whether the difference dif(R1, R2) of the trust value attribute is 0. If the similarity value of the rule pair (R1, R2) does not exceed the threshold value threshold, it is considered that the rule pair is not similar; if the similarity value of the rule pair (R1, R2) exceeds the threshold value threshold, then introduce the difference dif(R1, R2) of the trust attribute. If dif(R1, R2) is 0 at the same time, it is considered that the rule pair (R1, R2) is similar, otherwise, the rule pair (R1, R2) is not similar; (34) If the rule pair (R1, R2) is similar, determine whether rule R2 is the first similar rule of rule R1. If so, create a new cluster containing the rule pair (R1, R2) and find the next pair of rules from the rule set SP; if not, add rule R2 to the existing cluster and find the next pair of rules from the rule set SP; if the rule pair (R1, R2) is not similar, directly find the next pair of rules from the rule set SP; (35) Repeat steps (31) to (34), continuously searching for unclustered rule pairs in the rule set SP, and clustering the rule pairs until no new unclustered rule pairs can be found in the rule set SP; (36) Determine whether all rules in the rule set SP have been divided into clusters. If there is a rule R i If it does not exist in any cluster, create a new inclusion rule R i of clusters.

2. According to the access control policy anomaly detection method based on clustering idea in claim 1, it is characterized in that: The rule set SP = {R1, R2, ..., R n }, the memory matrix Clustered[i] is used to identify the rule R i Whether the cluster has been divided into existing clusters.

3. According to the access control policy anomaly detection method based on clustering idea in claim 1, it is characterized in that: Any two rules R in step (2) i and R j The similarity measure is calculated as follows: The symbols S, O, and E are used to represent the access subject, resource object, and environment category; x = {W S ,W O ,W E } is used to indicate the relative importance of each attribute category in the similarity calculation process, and Further, S. x (R i ,R j ) is used to represent the rule r i and rule r j The specific calculation method of the similarity score of each category based on the common attribute attr is as follows: Among them, the two rules r i and r j The similarity value of each category is obtained by the common attribute similarity value and the corresponding importance Multiply and sum the result; attr x ∈{ATTR x (R i )∩ATTR x (R j )} refers to the attribute attr x There are two rules R i and R j Common attributes under category x, ATTR x (R i ) refers to rule R i The attribute set of category x in ; Furthermore, the two rules R i and R j The attribute similarity value of category x The calculation method is as follows: in, It refers to the rule R i and R j The number of common attributes under category x, It means rule R i and R j The number of different attributes under category x.

4. According to the access control policy anomaly detection method based on clustering idea as described in claim 1, it is characterized in that: The abnormal strategy classification in step (4) is based on Khoumsi's study of rule abnormality types: (1) Non-conflicting exception: During the access control process, when an access request matches two or more rules at the same time, and these rules have the same operation decision X a When , it means that a non-conflicting exception has occurred, which is also called a redundant exception; (2) Conflict anomaly: During the access control process, when an access request matches two or more rules at the same time, and these rules have different operation decisions X a , it means that a conflict exception has occurred; conflict exceptions are divided into partial permission conflicts and formal conflicts. When two or more rules matched by an access request have contradictory operation decisions, a formal conflict is considered to have occurred; when two or more rules matched by an access request have mixed operation decisions, a partial permission conflict is considered to have occurred; Furthermore, the above two types of anomalies are detected separately: (1) Detecting Redundant Anomalies For cluster C k Any two rules R i and R j , if they have a containment relationship, that is or And their operation decisions are the same, that is, X a (R i )=Y b (R j ), then these two rules are detected as redundant anomalies, defined as follows: (2) Detecting conflict anomalies For cluster C k Any two rules R i and R j , if they have a compatible relationship, that is And their operation decisions are different, that is, X a (R i )≠Y b (R j ), then these two rules are detected as conflicting anomalies, defined as follows:

Images