论文标题
使用约束编程和图形表示学习来生成可解释的云安全策略
Using Constraint Programming and Graph Representation Learning for Generating Interpretable Cloud Security Policies
论文作者
论文摘要
现代软件系统依赖于存储在公共云中的业务敏感数据的挖掘见解。数据泄露通常会给商业组织带来重大（货币）损失。从概念上讲，云安全性在很大程度上依赖于身份访问管理（IAM）策略，其策略需要正确配置和定期更新。安全疏忽和人为错误通常会导致IAM政策错误配置，这可能为攻击者打开后门。为了应对这些挑战，首先，我们开发了一个新颖的框架，该框架使用约束编程（CP）编码生成最佳IAM策略。我们将云用户的黑暗权限确定为最佳标准，这直觉上意味着最大程度地减少了不必要的数据存储访问权限。其次，为了使IAM策略可解释，我们使用应用于用户的历史访问模式的图表来增强我们的CP模型具有相似性约束：相似的用户应分组在一起并共享常见的IAM策略。第三，我们描述了多种攻击模型，并表明我们优化的IAM政策可大大减少使用来自8个商业组织和合成实例的真实数据的安全攻击的影响。
Modern software systems rely on mining insights from business sensitive data stored in public clouds. A data breach usually incurs significant (monetary) loss for a commercial organization. Conceptually, cloud security heavily relies on Identity Access Management (IAM) policies that IT admins need to properly configure and periodically update. Security negligence and human errors often lead to misconfiguring IAM policies which may open a backdoor for attackers. To address these challenges, first, we develop a novel framework that encodes generating optimal IAM policies using constraint programming (CP). We identify reducing dark permissions of cloud users as an optimality criterion, which intuitively implies minimizing unnecessary datastore access permissions. Second, to make IAM policies interpretable, we use graph representation learning applied to historical access patterns of users to augment our CP model with similarity constraints: similar users should be grouped together and share common IAM policies. Third, we describe multiple attack models and show that our optimized IAM policies significantly reduce the impact of security attacks using real data from 8 commercial organizations, and synthetic instances.
