{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T18:59:03Z","timestamp":1782845943622,"version":"3.54.5"},"reference-count":51,"publisher":"Association for Computing Machinery (ACM)","issue":"FSE","license":[{"start":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T00:00:00Z","timestamp":1782777600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62272382"],"award-info":[{"award-number":["62272382"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62572381"],"award-info":[{"award-number":["62572381"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Proc. ACM Softw. Eng."],"published-print":{"date-parts":[[2026,6,30]]},"abstract":"<jats:p>\n                    Modern cloud applications heavily rely on Identity and Access Management (IAM) services to enforce flexible access control over their data. However, the flexibility comes at a cost:\n                    <jats:italic toggle=\"yes\">IAM policies<\/jats:italic>\n                    are often complex and prone to misconfigurations, leading to risks of data exposure. There is an increasing need to mine a compact set of intents that describe what the policies collectively try to achieve, thereby enabling operators to better understand their policies. However, existing tools on mining access control intent have two limitations: (1) the mining process is\n                    <jats:italic toggle=\"yes\">slow<\/jats:italic>\n                    and even times out on some complex policies; (2) the mined intents are\n                    <jats:italic toggle=\"yes\">excessive<\/jats:italic>\n                    in number and thus still hard to understand. To overcome these, this paper presents\n                    <jats:italic toggle=\"yes\">AccessRefinery<\/jats:italic>\n                    , which can speed up the mining process while reducing the number of intents. The key idea for the speedup is to reduce the redundancy of the multi-round SMT solving, by preprocessing the constraints into bit-vector constraints. For intent reduction,\n                    <jats:italic toggle=\"yes\">AccessRefinery<\/jats:italic>\n                    computes a compact set of intents that can cover the mined intents, by solving a\n                    <jats:italic toggle=\"yes\">min-set-cover<\/jats:italic>\n                    problem. Experiments based on real and synthetic datasets show that\n                    <jats:italic toggle=\"yes\">AccessRefinery<\/jats:italic>\n                    achieves a \u223c10\u2013100\u202f\u00d7 speedup in intent mining, and reduces the number of intents by up to \u223c10\u202f\u00d7.\n                  <\/jats:p>","DOI":"10.1145\/3797087","type":"journal-article","created":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T17:06:14Z","timestamp":1782839174000},"page":"1312-1334","source":"Crossref","is-referenced-by-count":0,"title":["AccessRefinery: Fast Mining Concise Access Control Intents on Public Cloud"],"prefix":"10.1145","volume":"3","author":[{"ORCID":"https:\/\/orcid.org\/0009-0009-3977-5093","authenticated-orcid":false,"given":"Ning","family":"Kang","sequence":"first","affiliation":[{"name":"Xi'an Jiaotong University, Xi'an, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7721-2675","authenticated-orcid":false,"given":"Peng","family":"Zhang","sequence":"additional","affiliation":[{"name":"Xi'an Jiaotong University, Xi'an, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-9892-9244","authenticated-orcid":false,"given":"Jianyuan","family":"Zhang","sequence":"additional","affiliation":[{"name":"Xi'an Jiaotong University, Xi'an, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8776-6911","authenticated-orcid":false,"given":"Hao","family":"Li","sequence":"additional","affiliation":[{"name":"Xi'an Jiaotong University, Xi'an, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-4078-7616","authenticated-orcid":false,"given":"Dan","family":"Wang","sequence":"additional","affiliation":[{"name":"Xi'an Jiaotong University, Xi'an, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-4581-1156","authenticated-orcid":false,"given":"Zhenrong","family":"Gu","sequence":"additional","affiliation":[{"name":"Xi'an Jiaotong University, Xi'an, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0319-3242","authenticated-orcid":false,"given":"Weibo","family":"Lin","sequence":"additional","affiliation":[{"name":"Huawei Cloud, Xi'an, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-3921-9824","authenticated-orcid":false,"given":"Shibiao","family":"Jiang","sequence":"additional","affiliation":[{"name":"Huawei Cloud, Xi'an, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1220-0371","authenticated-orcid":false,"given":"Zhu","family":"He","sequence":"additional","affiliation":[{"name":"Huawei Cloud, Xi'an, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-6456-8622","authenticated-orcid":false,"given":"Xu","family":"Du","sequence":"additional","affiliation":[{"name":"Huawei Cloud, Xi'an, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-7655-3734","authenticated-orcid":false,"given":"Longfei","family":"Chen","sequence":"additional","affiliation":[{"name":"Huawei Cloud, Xi'an, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-5064-3977","authenticated-orcid":false,"given":"Jun","family":"Li","sequence":"additional","affiliation":[{"name":"Huawei Cloud, Xi'an, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8826-0362","authenticated-orcid":false,"given":"Xiaohong","family":"Guan","sequence":"additional","affiliation":[{"name":"Xi'an Jiaotong University, Xi'an, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,6,30]]},"reference":[{"key":"e_1_2_1_1_1","unstructured":"Amazon Web Services. 2020. AWS IAM Access Analyzer Samples. https:\/\/github.com\/aws-samples\/aws-iam-accessanalyzer-samples. Accessed: 2025-05-22."},{"key":"e_1_2_1_2_1","volume-title":"An introduction to binary decision diagrams. Lecture notes, available online","author":"Andersen Henrik Reif","year":"1997","unstructured":"Henrik Reif Andersen. 1997. An introduction to binary decision diagrams. Lecture notes, available online, IT University of Copenhagen 5 (1997)."},{"key":"e_1_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/3236024.3236064"},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-53288-8_9"},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.23919\/fmcad.2018.8602994"},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-99524-9_24"},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4471-4129-7"},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/3368089.3409728"},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1287\/moor.4.3.233"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-81952-0_9"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-78800-"},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1145\/1995376.1995394"},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.34727\/2024\/"},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-24605-3_37"},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-24605-3_37"},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/3597926.3598078"},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/3551349.3559530"},{"key":"e_1_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/3510003.3510233"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.scico.2007.01.015"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1016\/s1571-0661(05)82542-3"},{"key":"e_1_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1109\/icse.2005.1553562"},{"key":"e_1_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/1368088.1368096"},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-27813-9_14"},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-68279-0_4"},{"key":"e_1_2_1_25_1","volume-title":"Model checking access control policies: A case study using google cloud iam. arXiv preprint arXiv:2303.16688","author":"Gouglidis Antonios","year":"2023","unstructured":"Antonios Gouglidis, Anna Kagia, and Vincent C Hu. 2023. Model checking access control policies: A case study using google cloud iam. arXiv preprint arXiv:2303.16688 (2023)."},{"key":"e_1_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1137\/0211045"},{"key":"e_1_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1016\/0096-0551(80)90011-9"},{"key":"e_1_2_1_28_1","first-page":"735","volume-title":"14th USENIX Symposium on Networked Systems Design and Implementation (NSDI 17)","author":"Horn Alex","year":"2017","unstructured":"Alex Horn, Ali Kheradmand, and Mukul Prasad. 2017. Delta-net: Real-time network verification using atoms. In 14th USENIX Symposium on Networked Systems Design and Implementation (NSDI 17). 735-749."},{"key":"e_1_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4684-2001-2_9"},{"key":"e_1_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1109\/iccd.2000.878311"},{"key":"e_1_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/3605763.3625242"},{"key":"e_1_2_1_32_1","volume-title":"Introduction to algorithms","author":"Leiserson Charles Eric","unstructured":"Charles Eric Leiserson, Ronald L Rivest, Thomas H Cormen, and Clifford Stein. 1994. Introduction to algorithms. Vol. 3. MIT press Cambridge, MA, USA."},{"key":"e_1_2_1_33_1","first-page":"237","volume-title":"22nd USENIX Symposium on Networked Systems Design and Implementation (NSDI 25)","author":"Li Zechun","year":"2025","unstructured":"Zechun Li, Peng Zhang, Yichi Zhang, and Hongkun Yang. 2025. {NDD}: A Decision Diagram for Network Verification. In 22nd USENIX Symposium on Networked Systems Design and Implementation (NSDI 25). 237-258."},{"key":"e_1_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/3629145"},{"key":"e_1_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1109\/12.769433"},{"key":"e_1_2_1_36_1","doi-asserted-by":"publisher","unstructured":"Peng Zhang Ning Kang and Jianyuan Zhang. 2026. The FSE Artifact 2026 : AccessRefinery. https:\/\/doi.org\/10.5281\/ zenodo.19534299 10.5281\/zenodo.19534299","DOI":"10.5281\/zenodo.19534299"},{"key":"e_1_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-13188-2_11"},{"key":"e_1_2_1_38_1","unstructured":"Port Swigger. 2021. Data leak Down Under: 50 000 gov't employee records found on open S3 bucket. https: \/\/portswigger.net\/daily-swig\/data-leak-down-under-50-000-govt-employee-records-found-on-open-s3-bucket"},{"key":"e_1_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1147\/rd.32.0114"},{"key":"e_1_2_1_40_1","doi-asserted-by":"publisher","unstructured":"Yakov Rekhter Susan Hares and Tony Li. 2006. A Border Gateway Protocol 4 (BGP-4). RFC 4271. https:\/\/doi.org\/10. 17487\/rfc4217 10.17487\/rfc4217","DOI":"10.17487\/rfc4217"},{"key":"e_1_2_1_41_1","unstructured":"SC Media. 2017. Another misconfigured Amazon S3 server leaks data. https:\/\/www.scworld.com\/news\/anothermisconfigured-amazon-s3-server-leaks-data-of-50000-australian-employees"},{"key":"e_1_2_1_42_1","first-page":"6025","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Shevrin Ilia","year":"2023","unstructured":"Ilia Shevrin and Oded Margalit. 2023. Detecting Multi-Step IAM attacks in AWS environments via model checking. In 32nd USENIX Security Symposium (USENIX Security 23). 6025-6042."},{"key":"e_1_2_1_43_1","volume-title":"Equational Bit-Vector Solving via Strong Grobner Bases. arXiv preprint arXiv:2402.16314","author":"Song Jiaxin","year":"2024","unstructured":"Jiaxin Song, Hongfei Fu, and Charles Zhang. 2024. Equational Bit-Vector Solving via Strong Grobner Bases. arXiv preprint arXiv:2402.16314 (2024)."},{"key":"e_1_2_1_44_1","volume-title":"Set theory and logic","author":"Stoll Robert Roth","unstructured":"Robert Roth Stoll. 1979. Set theory and logic. Courier Corporation."},{"key":"e_1_2_1_45_1","unstructured":"The Verge. 2021. Microsoft Azure Cloud Vulnerability Is the 'Worst You Can Imagine'. https:\/\/www.theverge.com\/ 2021\/8\/27\/22644161\/microsoft-azure-database-vulnerabilty-chaosdb"},{"key":"e_1_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-81955-1_28"},{"key":"e_1_2_1_47_1","volume-title":"Cloud Leak: WSJ Parent Company Dow Jones Exposed Customer Data. https:\/\/www.upguard.com\/ breaches\/cloud-leak-dow-jones","year":"2017","unstructured":"UpGuard. 2017. Cloud Leak: WSJ Parent Company Dow Jones Exposed Customer Data. https:\/\/www.upguard.com\/ breaches\/cloud-leak-dow-jones"},{"key":"e_1_2_1_48_1","unstructured":"John Whaley. [n. d.]. JavaBDD: A Java library for Binary Decision Diagrams. https:\/\/javabdd.sourceforge.net\/. Accessed: 2025-05-27."},{"key":"e_1_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1002\/9781118627372"},{"key":"e_1_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1109\/icnp.2013.6733614"},{"key":"e_1_2_1_51_1","doi-asserted-by":"publisher","DOI":"10.1109\/sp.2006.16"}],"container-title":["Proceedings of the ACM on Software Engineering"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3797087","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,30]],"date-time":"2026-06-30T18:01:04Z","timestamp":1782842464000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3797087"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6,30]]},"references-count":51,"journal-issue":{"issue":"FSE","published-print":{"date-parts":[[2026,6,30]]}},"alternative-id":["10.1145\/3797087"],"URL":"https:\/\/doi.org\/10.1145\/3797087","relation":{},"ISSN":["2994-970X"],"issn-type":[{"value":"2994-970X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,6,30]]}}}