基于GNN双源学习的访问控制关系预测方法

单棣斌; 杜学绘; 王文娟; 刘敖迪; 王娜

doi:10.11959/j.issn.2096-109x.2022062

您当前的位置：

首页 >

文章列表页 >

基于GNN双源学习的访问控制关系预测方法

专题：大数据与人工智能安全 | 更新时间：2024-06-03

- 基于GNN双源学习的访问控制关系预测方法
- Access control relationship prediction method based on GNN dual source learning
- 网络与信息安全学报 2022年8卷第5期页码：40-55
- 作者机构：
- 作者简介：
  
  [ "单棣斌（1982- ），男，河北邯郸人，信息工程大学讲师，主要研究方向为大数据安全、信任安全、图神经网络" ]
  [ "杜学绘（1968- ），女，河南新乡人，博士，信息工程大学教授、博士生导师，主要研究方向为信息系统安全、大数据和区块链安全" ]
  [ "王文娟（1981- ），女，河南鹤壁人，博士，信息工程大学教授，主要研究方向为云计算安全、入侵防御" ]
  [ "刘敖迪（1992- ），男，黑龙江伊春人，博士，信息工程大学讲师，主要研究方向为大数据安全" ]
  [ "王娜（1980- ），女，山西临汾人，博士，信息工程大学副教授，主要研究方向为信息系统安全、大数据和区块链安全" ]
- 基金信息：
  
  国家重点研发计划;The National Key R＆D Program of China(2018YFB0803603);国家重点研发计划;The National Key R＆D Program of China(2016YFB0501904);国家自然科学基金;The National Natural Science Foundation of China(62102449);河南省重点研发与推广专项;The Key Research and Development and Promotion Program of Henan Province(222102210069)
- DOI：10.11959/j.issn.2096-109x.2022062
  中图分类号： TP309
- 网络首发：2022-10，
  
  纸质出版：2022-10-15
- 稿件说明：
移动端阅览
单棣斌, 杜学绘, 王文娟, 等. 基于GNN双源学习的访问控制关系预测方法[J]. 网络与信息安全学报, 2022,8(5):40-55.

Dibin SHAN, Xuehui DU, Wenjuan WANG, et al. Access control relationship prediction method based on GNN dual source learning[J]. Chinese Journal of Network and Information Security, 2022, 8(5): 40-55.
单棣斌, 杜学绘, 王文娟, 等. 基于GNN双源学习的访问控制关系预测方法[J]. 网络与信息安全学报, 2022,8(5):40-55. DOI： 10.11959/j.issn.2096-109x.2022062.

Dibin SHAN, Xuehui DU, Wenjuan WANG, et al. Access control relationship prediction method based on GNN dual source learning[J]. Chinese Journal of Network and Information Security, 2022, 8(5): 40-55. DOI： 10.11959/j.issn.2096-109x.2022062.

摘要

随着大数据技术的迅速发展和广泛应用，用户越权访问成为制约大数据资源安全共享、受控访问的主要问题之一。基于关系的访问控制（ReBAC，relation-based access control）模型利用实体之间关系制定访问控制规则，增强了策略的逻辑表达能力，实现了动态访问控制，但仍然面临着实体关系数据缺失、规则的关系路径复杂等问题。为克服这些问题，提出了一种基于GNN双源学习的边预测模型——LPMDLG，将大数据实体关系预测问题转化为有向多重图的边预测问题。提出了基于有向包围子图的拓扑结构学习方法和有向双半径节点标记算法，通过有向包围子图提取、子图节点标记计算和拓扑结构特征学习3个环节，从实体关系图中学习节点与子图的拓扑结构特征；提出了基于有向邻居子图的节点嵌入特征学习方法，融入了注意力系数、关系类型等要素，通过有向邻居子图提取、节点嵌入特征学习等环节，学习其节点嵌入特征；设计了双源融合的评分网络，将拓扑结构与节点嵌入联合计算边的得分，从而获得实体关系图的边预测结果。边预测实验结果表明，相较于 R-GCN、SEAL、GraIL、TACT 等基线模型，所提模型在AUC-PR、MRR和Hits@N等评价指标下均获得更优的预测结果；消融实验结果说明所提模型的双源学习模式优于单一模式的边预测效果；规则匹配实验结果验证了所提模型实现了对部分实体的自动授权和对规则的关系路径的压缩。所提模型有效提升了边预测的效果，能够满足大数据访问控制关系预测需求。

Abstract

With the rapid development and wide application of big data technology

users’ unauthorized access to resources becomes one of the main problems that restrict the secure sharing and controlled access to big data resources.The ReBAC (Relationship-Based Access Control) model uses the relationship between entities to formulate access control rules

which enhances the logical expression of policies and realizes dynamic access control.However

It still faces the problems of missing entity relationship data and complex relationship paths of rules.To overcome these problems

a link prediction model LPMDLG based on GNN dual-source learning was proposed to transform the big data entity-relationship prediction problem into a link prediction problem with directed multiple graphs.A topology learning method based on directed enclosing subgraphs was designed in this modeled.And a directed dual-radius node labeling algorithm was proposed to learn the topological structure features of nodes and subgraphs from entity relationship graphs through three segments

including directed enclosing subgraph extraction

subgraph node labeling calculation and topological structure feature learning.A node embedding feature learning method based on directed neighbor subgraph was proposed

which incorporated elements such as attention coefficients and relationship types

and learned its node embedding features through the sessions of directed neighbor subgraph extraction and node embedding feature learning.A two-source fusion scoring network was designed to jointly calculate the edge scores by topology and node embedding to obtain the link prediction results of entity-relationship graphs.The experiment results of link prediction show that the proposed model obtains better prediction results under the evaluation metrics of AUC-PR

MRR and Hits@N compared with the baseline models such as R-GCN

SEAL

GraIL and TACT.The ablation experiment results illustrate that the model’s dual-source learning scheme outperforms the link prediction effect of a single scheme.The rule matching experiment results verify that the model achieves automatic authorization of some entities and compression of the relational path of rules.The model effectively improves the effect of link prediction and it can meet the demand of big data access control relationship prediction.

关键词

Keywords

references

李昊 , 张敏 , 冯登国 , 等 . 大数据访问控制研究 [J ] . 计算机学报 , 2017 , 40 ( 1 ): 72 - 91 .

LI H , ZHANG M , FENG D G , et al . Research on access control of big data [J ] . Chinese Journal of Computers , 2017 , 40 ( 1 ): 72 - 91 .

FONG P W L , . Relationship-based access control:protection model and policy language [C ] // Proceedings of the First ACM Conference on Data and Application Security and Privacy . 2011 : 191 - 202 .

AHMED T , SANDHU R , PARK J . Classifying and comparing attribute-based and relationship-based access control [C ] // Proceedings of the Seventh ACM on Conference on Data and Application Security and Privacy . 2017 : 59 - 70 .

BOGAERTS J , DECAT M , LAGAISSE B , et al . Entity-based access control:supporting more expressive access control policies [C ] // Proceedings of the 31st Annual Computer Security Applications Conference . 2015 : 291 - 300 .

CHAKRABORTY S , SANDHU R . On Feasibility of attributeaware relationship-based access control policy mining [C ] // IFIP International Federation for Information Processing 2021 . 2021 : 393 - 405 .

CHAKRABORTY S , SANDHU R . Formal analysis of ReBAC policy mining feasibility [C ] // Proceedings of the Eleventh ACM Conference on Data and Application Security and Privacy(CODASPY '21) . 2021 : 197 - 207 .

HU V C , FERRAIOLO D , KUHN R , et al . Guide to Attribute based access control (ABAC) definition and considerations:NIST Special Publication 800-162 [S ] . 2019 : 1 - 37 .

BUI T , STOLLER S D , LI J J . Greedy and evolutionary algorithms for mining relationship-based access control policies [J ] . Computers ＆Security , 2019 , 80 : 317 - 333 .

BUI T , STOLLER S D . A decision tree learning approach for mining relationship-based access control policies [C ] // Proceedings of the 25th ACM Symposium on Access Control Models and Technologies . 2020 : 167 - 178 .

BUI T , STOLLER S D , LI J . Mining relationship-based access control policies from incomplete and noisy data [M ] // Foundations and Practice of Security . Switzerland , 2019 : 267 - 284 .

BUI T , STOLLER S D . Learning attribute-based and relationship-based access control policies with unknown values [C ] // Information Systems Security - 16th International Conference(ICISS) . 2020 : 23 - 44 .

IYER P , MASOUMZADEH A . Active learning of relationship-based access control policies [C ] // Proceedings of the 25th ACM Symposium on Access Control Models and Technologies . 2020 : 155 - 166 .

ZHANG M . Graph neural networks:link prediction [M ] // Graph Neural Networks : Foundations,Frontiers,and Applications.Singapore,Springer , 2021 : 195 - 224 .

SCHLICHTKRULL M , KIPF T N , BLOEM P , et al . Modeling relational data with graph convolutional networks [C ] // The Semantic Web . 2018 : 593 - 607 .

ZHANG M , CHEN Y . Link prediction based on graph neural networks [C ] // Proceedings of 32nd Conference on Neural Information Processing Systems (NIPS 2018) . 2018 : 1 - 11 .

TERU K K , DENIS E , HAMILTON W L . Inductive relation prediction by subgraph reasoning [C ] // Proceedings of the 37th International Conference on Machine Learning(ICML) . 2020 : 1 - 10 .

CHEN J , HE H , WU F , et al . Topology-aware correlations between relations for inductive link prediction in knowledge graphs [C ] // Proceedings of 35th AAAI Conference on Artificial Intelligence.ELECTR NETWORK . 2021 : 6271 - 6278 .

KIPF T N , WELLING M . Variational graph auto-encoders [C ] // Bayesian Deep Learning Workshop (NIPS 2016) . 2016 : 1 - 3 .

YOU J , YING R , LESKOVEC J . Position-aware graph neural networks [C ] // Proceedings of 36th International Conference on Machine Learning (ICML) . 2019 : 7134 - 7143 .

CHAMI I , YING R , RÉ C , , et al . Hyperbolic graph convolutional neural networks [J ] . Advances in Neural Information Processing Systems , 2019 , 32 : 4869 - 4880 .

LI P , WANG Y B , WANG H W , et al . Distance encoding:design provably more powerful neural networks for graph representation learning [J ] . arXiv:2009.00142 , 2020 .

LIBEN-NOWELL D , KLEINBERG J . The link prediction problem for social networks [J ] . Journal of the American Society for Information Science and Technology , 2007 , 58 ( 7 ): 1019 - 1031 .

ADAMIC L A , ADAR E . Friends and neighbors on the Web [J ] . Social Networks , 2003 , 25 ( 3 ): 211 - 230 .

SHIBATA N , KAJIKAWA Y , SAKATA I . Link prediction in citation networks [J ] . Journal of the American Society for Information Science and Technology , 2012 , 63 ( 1 ): 78 - 85 .

STANFIELD Z , COŞKUN M , KOYUTÜRK M . Drug response prediction as a link prediction problem [J ] . Scientific Reports , 2017 ,7:40321.

NICKEL M , MURPHY K , TRESP V , et al . A review of relational machine learning for knowledge graphs [J ] . Proceedings of the IEEE , 2016 , 104 ( 1 ): 11 - 33 .

CRAMPTON J , SELLWOOD J . Path conditions and principal matching:A new approach to access control [C ] // Proceedings of the 19th ACM Symposium on Access Control Models and Technologies (SACMAT’14) . 2014 : 187 - 198 .

PACI F , SQUICCIARINI A , ZANNONE N . Survey on access control for community-centered collaborative systems [J ] . ACM Computing Surveys , 2019 , 51 ( 1 ): 1 - 38 .

ASIM Y , MALIK A K . A survey on access control techniques for social networks [M ] // Information Diffusion Management and Knowledge Sharing . IGI Global , 2020 : 319 - 342 .

BRIN S , PAGE L . Reprint of:the anatomy of a large-scale hypertextual Web search engine [J ] . Computer Networks , 2012 , 56 ( 18 ): 3825 - 3833 .

OU M D , CUI P , PEI J , et al . Asymmetric transitivity preserving graph embedding [C ] // Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining(KDD’16) . 2016 : 1105 - 1114 .

PEROZZI B , AL-RFOU R ,, SKIENA S . Deepwalk:online learning of social representations [C ] // Proceedings of the 20th ACM SIGKDD International Conference on Knowledge Discovery and Data mining(KDD'14) . 2014 : 701 - 710 .

RIBEIRO L , SAVERESE P , FIGUEIREDO D R . Struc2vec:learning node representations from structural identity [C ] // The ACM SIGKDD International Conference on Knowledge Discovery and Data Mining . 2017 : 385 - 394 .

ZHANG M H , CHEN Y X . Inductive matrix completion based on graph neural networks [J ] . arXiv:1904.12058 , 2019 .

ZHANG M , LI P , XIA Y , et al . Labeling trick:a theory of using graph neural networks for multi-node representation learning [C ] // 35th Conference on Neural Information Processing Systems (NeurIPS 2021) . 2022 : 9061 - 9073 .

BANG-JENSEN J , GUTIN G . Digraphs theory,algorithms and applications (second edition) [M ] . London : Springer-Verlag , 2007 .

VELIČKOVIĆ P , CUCURULL G , CASANOVA A , et al . Graph attention networks [J ] . arXiv:1710.10903 , 2017 .

TOUTANOVA K , CHEN D J . Observed versus latent features for knowledge base and text inference [C ] // Proceedings of the 3rd Workshop on Continuous Vector Space Models and their Compositionality(CVSC) . 2015 :57.

DETTMERS T , MINERVINI P , STENETORP P , et al . Convolutional 2D knowledge graph embeddings [C ] // Proceedings of the AAAI Conference on Artificial Intelligence . 2018 : 1811 - 1818 .

XIONG W , HOANG T , WANG W Y . DeepPath:a reinforcement learning method for knowledge graph reasoning [C ] // Proceedings of the 2017 Conference on Empirical Methods in Natural Language Processing(EMNLP) . 2017 : 564 - 573 .

浏览量

446

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于图Transformer的门级硬件木马检测方法

基于代码相似性的软件漏洞检测研究进展

基于数据增强的多视图对比学习图异常检测

基于多查询的社交网络关键节点挖掘算法

基于场景感知的访问控制模型