Work

An Explainable Method for Automatic Extraction of Natural Language Access Control Policy Key Components

Year: 2025

Type: article

Abstract: Access control schemes and models are essential tools for system administrators to protect the integrity of the information. However, they are frequently articulated in natural language, which is a powerful form that guarantees flexibility and expressiveness; however, their inherent ambiguity and unstructured nature pose significant challenges for automated enforcement and rigorous analysis. In this study, we evaluated several transformer-based models for the automated extraction of key components of Natural Language Access Control Policy (NLACP). To this end, we relied on a labeled dataset comprising software requirements specifications from different sectors, such as healthcare and conference management systems. We then conducted a fine-tuning phase, where the BERT model demonstrated optimal performance in extracting entities within a 3-entity paradigm, achieving an F-Measure value of 0.89. ModernBERT proved to be the most promising model in the more complex 5-entity extraction task, with a maximum F-Measure score of 0.84. Furthermore, we introduce an explainability step using layer-wise integrated gradients to gain insight into the decision-making process of these deep models, ensuring that the extracted policy components are both accurate and interpretable.

Source: Applied Sciences

DOI: 10.3390/app152211854

Authors: Luca Petrillo, Fabio Martinelli, Antonella Santone, Francesco Mercaldo

Institutions: IMT School for Advanced Studies Lucca, Institute of Informatics and Telematics, National Research Council, Institute for High Performance Computing and Networking, University of Molise

Language: English

Topic: Access Control and Trust

Subfield: Sociology and Political Science

Field: Social Sciences

Domain: Social Sciences

Open Access status: gold

Estimated APC paid: $2,896

Funder: Istituto Nazionale per l'Assicurazione Contro Gli Infortuni sul Lavoro