Towards Automated Policy Predictions via Structured Attribute-Based Access Control

We present a new access control policy prediction algorithm that uses historical access control transactions or existing policies as input and can deal with the case of incomplete logs and/or policies, e.g., to deal with unknown users making future access requests. Looking to facilitate organisational planning and regulatory compliance we employ time-series forecasting to create predictions about future categorisation of users and resources, without pre-defining any data features deemed to be relevant but rather looking to create a more autonomous miner capable of identifying such relevance from raw data. We use a public ICU health metric data set showing that the miner can work on both logs as well as policy specifications.