  With the rapid advances in computing and information technologies,
traditional access control models have become inadequate in terms of capturing
fine-grained, and expressive security requirements of newly emerging
applications. An attribute-based access control (ABAC) model provides a more
flexible approach for addressing the authorization needs of complex and dynamic
systems. While organizations are interested in employing newer authorization
models, migrating to such models pose as a significant challenge. Many
large-scale businesses need to grant authorization to their user populations
that are potentially distributed across disparate and heterogeneous computing
environments. Each of these computing environments may have its own access
control model. The manual development of a single policy framework for an
entire organization is tedious, costly, and error-prone.
  In this paper, we present a methodology for automatically learning ABAC
policy rules from access logs of a system to simplify the policy development
process. The proposed approach employs an unsupervised learning-based algorithm
for detecting patterns in access logs and extracting ABAC authorization rules
from these patterns. In addition, we present two policy improvement algorithms,
including rule pruning and policy refinement algorithms to generate a higher
quality mined policy. Finally, we implement a prototype of the proposed
approach to demonstrate its feasibility.
