{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,3]],"date-time":"2026-07-03T16:34:07Z","timestamp":1783096447603,"version":"3.54.6"},"reference-count":30,"publisher":"Association for Computing Machinery (ACM)","issue":"1","license":[{"start":{"date-parts":[[2011,5,1]],"date-time":"2011-05-01T00:00:00Z","timestamp":1304208000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100006602","name":"Air Force Research Laboratory","doi-asserted-by":"publisher","award":["FA87500720028"],"award-info":[{"award-number":["FA87500720028"]}],"id":[{"id":"10.13039\/100006602","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["756998"],"award-info":[{"award-number":["756998"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000006","name":"Office of Naval Research","doi-asserted-by":"publisher","award":["N000141010155N000141010343"],"award-info":[{"award-number":["N000141010155N000141010343"]}],"id":[{"id":"10.13039\/100000006","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000183","name":"Army Research Office","doi-asserted-by":"publisher","award":["DAAD19-02-1-0389"],"award-info":[{"award-number":["DAAD19-02-1-0389"]}],"id":[{"id":"10.13039\/100000183","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Inf. Syst. Secur."],"published-print":{"date-parts":[[2011,5]]},"abstract":"<jats:p>Access-control policy misconfigurations that cause requests to be erroneously denied can result in wasted time, user frustration, and, in the context of particular applications (e.g., health care), very severe consequences. In this article we apply association rule mining to the history of accesses to predict changes to access-control policies that are likely to be consistent with users' intentions, so that these changes can be instituted in advance of misconfigurations interfering with legitimate accesses. Instituting these changes requires the consent of the appropriate administrator, of course, and so a primary contribution of our work is how to automatically determine from whom to seek consent and how to minimize the costs of doing so. We show using data from a deployed access-control system that our methods can reduce the number of accesses that would have incurred costly time-of-access delays by 43%, and can correctly predict 58% of the intended policy. These gains are achieved without impacting the total amount of time users spend interacting with the system.<\/jats:p>","DOI":"10.1145\/1952982.1952984","type":"journal-article","created":{"date-parts":[[2011,6,6]],"date-time":"2011-06-06T11:51:38Z","timestamp":1307361098000},"page":"1-28","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":61,"title":["Detecting and resolving policy misconfigurations in access-control systems"],"prefix":"10.1145","volume":"14","author":[{"given":"Lujo","family":"Bauer","sequence":"first","affiliation":[{"name":"Carnegie Mellon University, Pittsburgh, PA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Scott","family":"Garriss","sequence":"additional","affiliation":[{"name":"Google, Mountain View, CA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Michael K.","family":"Reiter","sequence":"additional","affiliation":[{"name":"University of North Carolina at Chapel Hill, NC"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2011,6,6]]},"reference":[{"key":"e_1_2_1_1_1","volume-title":"Proceedings of the 20th International Conference on Very Large Data Bases (VLDB).","author":"Agrawal R."},{"key":"e_1_2_1_2_1","volume-title":"Proceedings of the 23rd Annual Joint Conference of the IEEE Computer and Communications Societies.","author":"Al-Shaer E. S."},{"key":"e_1_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/319709.319718"},{"key":"e_1_2_1_4_1","volume-title":"Proceedings of the IEEE Symposium on Security and Privacy.","author":"Bartal Y."},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1145\/1280680.1280689"},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1007\/11556992_31"},{"key":"e_1_2_1_7_1","volume-title":"Proceedings of the 12th European Symposium on Research in Computer Security (ESORICS).","author":"Bauer L."},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.5555\/1009380.1009672"},{"key":"e_1_2_1_9_1","volume-title":"Proceedings of the 4th VLDB Workshop on Secure Data Management.","author":"Bhatti R."},{"key":"e_1_2_1_10_1","volume-title":"Proceedings of the IEEE Symposium on Security and Privacy.","author":"Blaze M."},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/1080173.1080190"},{"key":"e_1_2_1_12_1","volume-title":"Proceedings of the 3rd Annual PKI Research and Development Workshop.","author":"Goffee N. C."},{"key":"e_1_2_1_13_1","volume-title":"Proceedings of the International Conference on Dependable Systems and Networks.","author":"Hazelhurst S."},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/937527.937528"},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.5555\/882495.884431"},{"key":"e_1_2_1_16_1","volume-title":"Proceedings of the 3rd DARPA Information Survivability Conference and Exposition.","author":"Keromytis A. D."},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/775412.775435"},{"key":"e_1_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/1162678.1162681"},{"key":"e_1_2_1_19_1","volume-title":"Proceedings of the 3rd DARPA Information Survivability Conference and Exposition.","author":"Li N."},{"key":"e_1_2_1_20_1","volume-title":"Proceedings of the IEEE Symposium on Security and Privacy.","author":"Mayer A."},{"key":"e_1_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/1377836.1377840"},{"key":"e_1_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/1542207.1542224"},{"key":"e_1_2_1_23_1","volume-title":"International Cryptology Conference. Rump session.","author":"Rivest R. L."},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1109\/2.485845"},{"key":"e_1_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/1063979.1064008"},{"key":"e_1_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1145\/1266840.1266870"},{"key":"e_1_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/1102120.1102144"},{"key":"e_1_2_1_28_1","volume-title":"Proceedings of the 10th USENIX Security Symposium.","author":"Wool A.","year":"2001"},{"key":"e_1_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2006.16"},{"key":"e_1_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1007\/11538059_39"}],"container-title":["ACM Transactions on Information and System Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1952982.1952984","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1952982.1952984","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T10:59:41Z","timestamp":1750244381000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1952982.1952984"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2011,5]]},"references-count":30,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2011,5]]}},"alternative-id":["10.1145\/1952982.1952984"],"URL":"https:\/\/doi.org\/10.1145\/1952982.1952984","relation":{},"ISSN":["1094-9224","1557-7406"],"issn-type":[{"value":"1094-9224","type":"print"},{"value":"1557-7406","type":"electronic"}],"subject":[],"published":{"date-parts":[[2011,5]]},"assertion":[{"value":"2008-10-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2010-04-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2011-06-06","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}