Automatic generation of AppArmor security policies based on large language models

SHA Yitian; LIU Shaojun; QIAN Xin; WU Yue; CHEN Peng; LIU Xing

doi:10.11959/j.issn.2096-109x.2024046

您当前的位置：

首页 >

文章列表页 >

Automatic generation of AppArmor security policies based on large language models

Papers | 更新时间：2024-08-14

- Automatic generation of AppArmor security policies based on large language models
- Chinese Journal of Network and Information Security Vol. 10, Issue 3, Pages: 143-155(2024)
- 作者机构：
  
  1.国网江苏省电力有限公司南京供电分公司，江苏南京 210016
  2.南京南瑞信息通信科技有限公司，江苏南京 210016
- 作者简介：
- 基金信息：
  
  State Grid Jiangsu Electric Power Co., Ltd. Science and Technology Project(J2023110)
- DOI：10.11959/j.issn.2096-109x.2024046
  CLC： TP309.1
- Received：18 April 2024，
  
  Revised：2024-06-10，
  
  Published：25 June 2024
- 稿件说明：
移动端阅览
沙倚天, 刘少君, 钱欣, 等. 基于大语言模型的AppArmor安全策略自动生成方法[J]. 网络与信息安全学报, 2024, 10(3): 143-155.

SHA Y T, LIU S J, QIAN X, et al. Automatic generation of AppArmor security policies based on large language models[J]. Chinese Journal of Network and Information Security, 2024, 10(3): 143-155.
沙倚天, 刘少君, 钱欣, 等. 基于大语言模型的AppArmor安全策略自动生成方法[J]. 网络与信息安全学报, 2024, 10(3): 143-155. DOI： 10.11959/j.issn.2096-109x.2024046.

SHA Y T, LIU S J, QIAN X, et al. Automatic generation of AppArmor security policies based on large language models[J]. Chinese Journal of Network and Information Security, 2024, 10(3): 143-155. DOI： 10.11959/j.issn.2096-109x.2024046.

摘要

在计算机信息系统的整体安全性中，操作系统安全扮演着至关重要的角色，而操作系统安全的基石是信息系统的安全。目前，已经有SELinux、AppArmor等基于强制访问控制机制的安全方法被提出，来增强操作系统的安全性。然而，这类安全方法在实际应用中存在的主要问题，例如安全策略配置的复杂性和对专业知识的高度依赖，使安全策略的生成变得困难，并且防护粒度相对较粗。因此，对AppArmor的安全策略的生成过程进行进一步的优化，并提出了一种基于大语言模型（large language model，LLM）的访问控制策略自动生成方法。该方法对目标应用程序进行静态分析，获取部分安全策略规则；并全面运行应用程序，以获得最大代码覆盖率的相关日志；最后结合日志信息和静态分析结果以及少样本学习，运用大模型为应用自动生成安全策略，减少了对安全专家的依赖，从而显著降低了人工成本以及减少了人为配置安全策略的主观性和复杂性。通过将所提方法生成的AppArmor安全策略与默认策略进行对比，对策略的正确性、完整性和精简性进行了评估。实验结果显示，所提方法生成的策略既完整又精简，并且不会影响应用程序的正常运行。这表明了所提方法在简化安全策略生成过程和提高策略质量方面的有效性。

Abstract

Operating system (OS) security has been considered as a critical layer within the comprehensive security framework of computer information systems. Mandatory access control (MAC) mechanisms such as SELinux and AppArmor have been employed to strengthen OS security. However

significant challenges have been encountered in the application of MAC in practice

primarily involving the complexity of security policy configuration

which has demanded specialized expertise and often resulted in coarse-grained protection measures. Aimed at enhancing the process of generating security policies for AppArmor

an automated access control policy generation method was proposed based on large language models (LLM). The process began with a static analysis of the target application to extract preliminary security policy rules. Subsequently

the application was extensively executed to gather logs that achieved maximum code coverage. Large models

in conjunction with the gathered log information

static analysis outcomes

and few-shot learning

were utilized to autonomously generate security policies for applications. This approach significantly reduced the dependence on security experts

lowered manual labor costs

and diminished the subjectivity and complexity associated with manual security policy configurations. The efficacy of this methodology was demonstrated through a comparative analysis between the AppArmor security policies generated by this framework and the default policies

focusing on the policies’ correctness

completeness

and succinctness. The experimental findings reveal that the generated policies are not only comprehensive and succinct but also do not impede the normal operation of the application. These results underscore the effectiveness of the proposed method in streamlining the security policy generation process and enhancing the quality of the policies.

关键词

Keywords

references

HAN Z , CHENG L , ZHANG Y , et al . Operating system security policy hardening via capability dependency graphs [C ] // Proceedings of Information Security Practice and Experience: 11th International Conference (ISPEC 2015 ), Beijing, China : Springer , 2015 : 3 - 17 .

LACHMUND S . Auto-generating access control policies for applications by static analysis with user input recognition [C ] // Proceedings of the 2010 ICSE Workshop on Software Engineering for Secure Systems . New York : ACM , 2010 : 8 - 14 .

CENTONZE P , FLYNN R J , PISTOIA M . Combining static and dynamic analysis for automatic identification of precise access-control policies [C ] // Proceedings of the Twenty-Third Annual Computer Security Applications Conference (ACSAC 2007) . Piscataway : IEEE Press , 2007 : 292 - 303 .

RAUTER T , HÖLLER A , KAJTAZOVIC N , et al . Towards an automated generation of application confinement policies with binary analysis [C ] // Proceedings of the 2015 International Symposium on Networks, Computers and Communications (ISNCC) . Piscataway : IEEE Press , 2015 : 1 - 6 .

SCHREUDERS Z C , PAYNE C , MCGILL T . Techniques for automating policy specification for application-oriented access controls [C ] // Proceedings of the 2011 Sixth International Conference on Availability, Reliability and Security . Piscataway : IEEE Press , 2011 : 266 - 271 .

SANDERS M W , YUE C . Minimizing privilege assignment errors in cloud services [C ] // Proceedings of the Eighth ACM Conference on Data and Application Security and Privacy . New York : ACM , 2018 : 2 - 12 .

SANDERS M W , YUE C . Mining least privilege attribute based access control policies [C ] // Proceedings of the 35th Annual Computer Security Applications Conference . New York : ACM , 2019 : 404 - 416 .

WANG R W , ENCK W , REEVES D , et al . EASEAndroid: automatic policy analysis and refinement for security enhanced android via large-scale semi-supervised learning [C ] // Proceedings of the 24th USENIX Conference on Security Symposium . New York : ACM , 2015 : 351 - 366 .

NADKARNI A , ENCK W , JHA S , et al . Policy by example: an approach for security policy specification [EB ] . arXiv Preprint arXiv: 1707.03967 , 2017 .

WANG R W , AZAB A M , ENCK W , et al . SPOKE: scalable knowledge collection and attack surface analysis of access control policy for security enhanced android [C ] // Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security . New York : ACM , 2017 : 612 - 624 .

马铭鑫 , 史国振 , 王亚琼 , 等 . 适用于分布式系统的多级安全访问控制策略 [J ] . 网络与信息安全学报 , 2017 , 3 ( 8 ): 32 - 38 .

MA M X , SHI G Z , WANG Y Q , et al . Multilevel secure access control policy for distributed systems [J ] . Chinese Journal of Network and Information Security , 3 ( 8 ): 32 - 38 . 2017.

VASWANI A , SHAZEER N , PARMAR N , et al . Attention is all you need [EB ] . arXiv Preprint aiXiv: 1706 . 03762 , 2017 .

HALLYN S E , MORGAN A G . Linux capabilities: making them work [J ] . Linux Symposium , 2008 , 1 : 8 .

WANG F , SHOSHITAISHVILI Y . Angr - the next generation of binary analysis [C ] // Proceedings of the 2017 IEEE Cybersecurity Development (SecDev) . Piscataway : IEEE Press , 2017 : 8 - 9 .

PETERSEN R , VUELAPLUMA S L . Linux: manual de referencia [M ] . Madrid : McGraw-Hill , 2001 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Automated vulnerability discovery method for 5G core network protocol

Multi-feature fusion malware detection method based on attention and gating mechanisms

Classified risk assessment method of Android application based on multi-factor clustering selection

Analysis of DoS attacks on Docker inter-component stdio copy

Android malware detection method based on deep neural network

Related Author

Zhi XUE

Yijun WANG

Libo CHEN

Zhilong ZHANG

Peixiang WU

Jianbiao ZHANG

Zhongyuan CHEN

Zhi YANG

Related Institution

Zhejiang University NGICS Platform

School of Cyber Science and Technology, Zhejiang University

School of Cyber Engineering, Xidian University

Ant Financial Services Group

College of Cryptogram Engineering,Information Engineering University

⁰