# PAMMELA: Policy Administration Methodology using Machine Learning

arXiv: https://arxiv.org/abs/2111.07060 · HTML: https://mlsanity.com/paper/2111.07060/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 5 of its 34 references that are in the map.
- First posted on arXiv 13 Nov 2021.

## Builds on (most cited first, 5 of 5)

- [Mining Attribute-Based Access Control Policies from Logs](https://mlsanity.com/paper/1403.5715/) (2014)
- [An Automatic Attribute Based Access Control Policy Extraction from Access Logs](https://mlsanity.com/paper/2003.07270/) (2020)
- [Adaptive ABAC Policy Learning: A Reinforcement Learning Approach](https://mlsanity.com/paper/2105.08587/) (2021)
- [FLAP -- A Federated Learning Framework for Attribute-based Access Control Policies](https://mlsanity.com/paper/2010.09767/) (2020)
- [Distributed Attribute-Based Access Control System Using a Permissioned Blockchain](https://mlsanity.com/paper/2006.04384/) (2020)

## Built on by (most cited first, 1 of 1)

- [Machine Learning in Access Control: A Taxonomy and Survey](https://mlsanity.com/paper/2207.01739/) (2022)

## Abstract (arXiv)

In recent years, Attribute-Based Access Control (ABAC) has become quite popular and effective for enforcing access control in dynamic and collaborative environments. Implementation of ABAC requires the creation of a set of attribute-based rules which cumulatively form a policy. Designing an ABAC policy ab initio demands a substantial amount of effort from the system administrator. Moreover, organizational changes may necessitate the inclusion of new rules in an already deployed policy. In such a case, re-mining the entire ABAC policy will require a considerable amount of time and administrative effort. Instead, it is better to incrementally augment the policy. Keeping these aspects of reducing administrative overhead in mind, in this paper, we propose PAMMELA, a Policy Administration Methodology using Machine Learning to help system administrators in creating new ABAC policies as well as augmenting existing ones. PAMMELA can generate a new policy for an organization by learning the rules of a policy currently enforced in a similar organization. For policy augmentation, PAMMELA can infer new rules based on the knowledge gathered from the existing rules. Experimental results show that our proposed approach provides a reasonably good performance in terms of the various machine learning evaluation metrics as well as execution time.