Generation of Human Comprehensible Access Control Policies from Audit Logs
This paper presents LANTERN, a framework that leverages Large Language Models to bridge the semantic gap between complex machine-enforceable access control logs and human-comprehensible natural language policies, thereby aligning technical permissions with stakeholder intent.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine you are the manager of a massive, busy office building. You have a strict set of rules about who can enter which rooms, when they can enter, and what they can do once inside. You wrote these rules down in a perfect, logical document years ago.
But here's the problem: The building has changed.
Over time, employees have started swapping keys, security guards have made on-the-fly exceptions, and new departments have formed. The actual behavior of people in the building (who is opening which doors) no longer matches your original document. In fact, your original document is probably lost or outdated.
If you want to know the real rules of your building, you can't just ask the employees; they don't know the big picture. Instead, you have to look at the security camera logs. These logs are a massive, messy list of every single door opened, every badge swiped, and every time someone tried to enter a restricted area.
The Problem: The "Robot vs. Human" Gap
The paper introduces a tool called LANTERN to solve a specific headache:
- The Logs are a Mess: Reading millions of security camera entries is impossible for a human. It's like trying to understand a novel by reading a list of every word typed in a library for ten years.
- The "Robot" Solution is Too Hard: Computers can analyze these logs and find patterns, but they speak "Robot Language" (complex code and math symbols). If you show these rules to your non-technical managers or department heads, they will be completely lost. It's like showing a mechanic's schematic to a driver; the driver knows the car runs, but they don't understand the fuel injection system.
- The "Human" Solution is Too Slow: Trying to manually write the rules based on the logs requires a team of expensive experts to write custom computer scripts. It's slow, expensive, and prone to errors.
The Solution: LANTERN (The "Translator" and "Architect")
The authors created LANTERN, a system that acts as a bridge between the messy data and the human decision-makers. Think of LANTERN as a two-step magic translator.
Step 1: The "Code Architect" (Building the Machine)
Instead of asking a human to write a complex computer program to read the logs, LANTERN uses a super-smart AI (a Large Language Model) to write the code for you.
- The Analogy: Imagine you have a pile of Lego bricks in a weird shape. You tell the AI, "Here is a picture of my bricks." The AI instantly writes a recipe (a Python script) on how to sort and organize those specific bricks.
- Why it's cool: You don't need to know how to code. You just upload your messy log files, and LANTERN builds the tool needed to clean them up. It handles the "robot" part of the job.
Step 2: The "Storyteller" (Translating to Human)
Once the computer has found the rules (e.g., "If User is in Finance AND Time is 9 AM AND Resource is 'Budget.xlsx', then Allow"), it looks like gibberish to a human.
- The Analogy: This is where the second part of LANTERN kicks in. It takes that dry, technical rule and rewrites it as a clear, professional memo for your boss.
- The Result: Instead of seeing code, your boss reads: "Our Finance team can access budget spreadsheets during morning hours to ensure timely reporting."
How They Tested It (The "Training Camp")
The researchers didn't just guess; they built a "training camp" to test LANTERN.
- They created fake office scenarios with thousands of employees and millions of "door openings."
- They tested if LANTERN could figure out the rules from the logs. It did.
- They tested if LANTERN could explain those rules to humans. It did.
- They compared LANTERN to other methods.
- Method A (Just AI): Tried to let the AI read the whole log at once. It got overwhelmed and confused, like a student trying to read a whole encyclopedia in one sitting.
- Method B (Just Math): Used old-school math to find rules but couldn't explain them.
- Method C (LANTERN): Used the AI to build the math tool, then used the AI to explain the results. This was the winner. It was fast, accurate, and the humans actually understood the output.
Why This Matters
In the real world, companies often have "Policy Drift." This means the rules on paper are different from what is actually happening. This is dangerous because:
- Security Risks: People might have access to things they shouldn't, and no one knows.
- Compliance Nightmares: If auditors ask, "Who can see this data?", the company might not have a clear answer.
LANTERN fixes this by taking the "ground truth" (what actually happened in the logs) and turning it into a clear, human-readable policy document. It turns a chaotic pile of data into a clear set of instructions that managers can approve, understand, and trust.
The Bottom Line
LANTERN is a tool that says: "Don't worry about the messy computer logs or the complex coding. Upload your data, and we will give you a clear, plain-English explanation of who is allowed to do what in your organization."
It's like having a translator who speaks both "Computer Code" and "Human Business," ensuring that the security rules of your organization are finally understood by everyone, not just the tech wizards.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.