💻 computer science

MuSimA: A Tool with Multi-modal Input for Generating Bespoke ABAC Datasets

This paper introduces MuSimA, a freely available web-based tool that generates large-scale, bespoke synthetic Attribute-based Access Control (ABAC) datasets by supporting multi-modal user inputs, including structured JSON files and hand-drawn distribution sketches interpreted via a Large Language Model.

Original authors: Saket Jha (Indian Institute of Technology Kharagpur, India), Karthikeya S. M. Yelisetty (Indian Institute of Technology Kharagpur, India), Singabattu Sathya (Indian Institute of Technology Kharagpur

Published 2026-04-15

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Saket Jha (Indian Institute of Technology Kharagpur, India), Karthikeya S. M. Yelisetty (Indian Institute of Technology Kharagpur, India), Singabattu Sathya (Indian Institute of Technology Kharagpur, India), Shamik Sural (Indian Institute of Technology Kharagpur, India)

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a security guard trying to test a new, high-tech door lock system. You want to see if the lock works perfectly when 10,000 people try to enter, or when the weather is stormy, or when a VIP arrives.

The problem? You don't have 10,000 real people to test with. And even if you did, you can't ask a real company to let you try to break into their building just to test your lock. They won't share their real data because it's too private.

This is the exact problem the researchers at IIT Kharagpur are solving with a new tool called MuSimA.

Here is the story of MuSimA, explained simply:

1. The Problem: The "Empty Gym" of Security

In the world of computer security, there's a system called ABAC (Attribute-Based Access Control). Think of it as a super-smart bouncer at a club.

Old Bouncers (RBAC): "Are you on the VIP list? Yes? Come in."
Smart Bouncers (ABAC): "Are you a VIP? Yes. Is it after 10 PM? No. Are you wearing a red hat? Yes. Okay, you can come in."

To test if these smart bouncers are working, researchers need a massive list of fake people, fake objects (like files or doors), and fake situations (like "it's raining" or "it's Tuesday").

Until now, researchers had to build these fake lists using clunky, old tools. These tools were like stiff mannequins—they could only stand in one pose. You couldn't tell them, "Make the VIPs arrive in a bell curve (lots in the middle, few at the edges)" or "Make the rainy days happen randomly." They just gave you the same old, boring data every time.

2. The Solution: MuSimA (The "Digital Clay")

MuSimA is a new web tool that acts like digital clay. It lets researchers mold their own perfect, fake security world.

How do you tell MuSimA what you want?
You have two ways to give instructions, like talking to a very smart assistant:

The "Tech Talk" Way (JSON): You write a code file (like a recipe) saying, "I need 1,000 users, 500 files, and the users should be distributed like a bell curve."
The "Doodle" Way (Multi-Modal): This is the cool part. If you aren't good at coding, you can just draw a sketch on a piece of paper!
- Example: You draw a hill shape on a napkin to show you want a "Normal Distribution" (a bell curve).
- MuSimA uses a Large Language Model (LLM)—basically a super-smart AI that can "see"—to look at your drawing. It says, "Ah, I see a hill. You want a bell curve with a peak here and a width there." It then translates your doodle into the math code it needs to build the data.

3. How It Works: The Factory Floor

Once you give MuSimA your instructions (either the recipe or the drawing), it goes to work in five steps:

Building the Cast: It creates a cast of characters: Users (Subjects), Files (Objects), and Situations (Environment).
Giving Them Traits: It gives them attributes. Maybe User #1 has a "Red Hat" and User #2 has a "Blue Hat."
The Magic Distribution: This is the secret sauce. It assigns these traits based on the shape you wanted. If you drew a bell curve, most users get the "Red Hat," but a few get "Blue." If you drew a flat line, everyone gets an equal mix.
Writing the Rules: It invents the security rules. "If you have a Red Hat AND it's raining, you get in."
The Final Report: It spits out a zip file containing the whole fake world, ready for you to download and test your security systems.

4. Why Is This a Big Deal?

The researchers tested MuSimA to make sure it wasn't just a toy. They asked it to generate a massive dataset with 100,000 users.

The Result: The fake data matched their requested shapes almost perfectly. The "error rate" was less than 5%.
The Analogy: Imagine asking a chef to bake 100,000 cookies where 50% are chocolate, 30% are vanilla, and 20% are strawberry, arranged in a specific pattern. MuSimA baked them so perfectly that if you tasted them, you'd think they were real.

5. The "Bring Your Own Model" Twist

Usually, when you use a web tool, you have to trust the company with your data. But MuSimA is open source.

The Analogy: Most tools are like a restaurant where you must eat their food. MuSimA is like giving you the recipe and the kitchen. You can run the tool on your own computer. If you are a bank or a hospital worried about privacy, you can run MuSimA locally to generate your own fake data without ever sending your real data to the internet.

Summary

MuSimA is a tool that lets security researchers create custom-made, fake security worlds.

You can code the rules or draw them.
It uses AI to understand your drawings.
It creates massive, realistic datasets that help test if security systems are actually safe.
It's free and private (you can run it yourself).

It turns the boring, rigid task of making test data into a creative, flexible process, ensuring that the security systems protecting our digital lives are tested against the most realistic scenarios possible.

1. Problem Statement

Despite significant advancements in Attribute-based Access Control (ABAC) research, including policy mining, natural language extraction, and scalability improvements, the field suffers from a critical lack of high-quality, scalable synthetic datasets for testing.

Limitations of Real Data: Organizations rarely share real access control logs due to privacy concerns. The few available public datasets (e.g., Amazon Kaggle, Amazon UCI) are fixed in size, lack environmental attributes (a key differentiator of ABAC), and often lack clear rule sets.
Limitations of Existing Tools:
- Xu & Stoller's datasets: Limited to minor pre-determined variations and cannot generate domain-specific distributions.
- ConGRASS: Uses Conditional Tabular GANs but is strictly bound by the attribute dimensionality of the original training datasets.
- ABAC Lab: Focuses on policy mining with fixed parameters and does not support user-specified attribute distributions or environmental attributes.
The Gap: There is no existing tool that allows researchers to generate large-scale, bespoke ABAC datasets with customizable attribute value distributions (e.g., Normal, Poisson, Uniform) and support for environmental attributes.

2. Methodology: MuSimA

MuSimA (Multi-Modal Simulator for ABAC Systems) is a web-based tool designed to generate synthetic ABAC datasets based on user-defined specifications. It employs a modular architecture with a unique multi-modal input capability.

A. Input Mechanisms

MuSimA accepts specifications in two formats:

Structured JSON Input: Users provide a configuration file (input.json) defining:
- Entity Counts: Number of Subjects ( $S$ ), Objects ( $O$ ), and Environmental entities ( $E$ ).
- Attribute Definitions: Counts and possible values for attributes associated with each entity type.
- Distribution Specifications: Probability distributions (Uniform, Truncated Normal, Poisson) for attribute values, including parameters like mean ( $\mu$ ), variance ( $\sigma^2$ ), and rate ( $\lambda$ ).
- Policy Rules: Desired counts for permit and deny rules.
Multi-Modal (Hand-Drawn) Input: Users can upload sketches of desired distributions.
- LLM Integration: A Large Language Model (specifically Google's Gemini) analyzes the hand-drawn images to extract distribution parameters.
- Iterative Refinement: The system uses an iterative loop where the LLM compares the original sketch with a generated approximation. If the approximation deviates (e.g., the curve drops to zero at the edges while the sketch remains high), the LLM refines the parameters (e.g., increasing $\sigma$ ) until a close match is achieved.
- Security: Input images are sanitized via MIME type checks to prevent prompt injection.

B. Data Generation Process

Once parameters are defined, MuSimA executes a five-stage generation pipeline:

Entity & Attribute Generation: Creates unique identifiers for subjects, objects, environments, and their respective attributes.
Attribute Value Generation: Defines the set of possible values ( $V_a$ ) for each attribute.
Entity-Attribute Assignment: Assigns values to entities based on the specified distributions:
- Normal: Samples from a truncated normal distribution and bins the result to discrete values.
- Poisson: Calculates probabilities for discrete values, normalizes them, and samples accordingly.
- Uniform: Randomly selects values with equal probability.
Policy Generation: Constructs permit ( $\Pi^+$ ) and deny ( $\Pi^-$ ) rules based on attribute-value pairs. It enforces deny-overrides semantics (a deny rule overrides a permit rule).
Access Control Matrix (ACM) Generation: Evaluates every tuple $(s, o, e)$ against the policy rules to determine access decisions (1 for permit, 0 for deny).

C. Output Formats

The tool generates a downloadable Zip file containing:

output.json: Structured data including entity sets, attribute definitions, value mappings, and policy rules.
ACM.txt: The full Access Control Matrix.
access_data.txt: Flattened data suitable for machine learning training.
Distribution Attestation: Visual reports comparing expected vs. actual distributions to verify generation accuracy.

3. Key Contributions

First Multi-Modal ABAC Generator: Introduces a tool that accepts both structured JSON and hand-drawn distribution sketches, lowering the barrier to entry for non-technical researchers.
LLM-Driven Parameter Extraction: Pioneers the use of LLMs to translate visual sketches into precise statistical parameters (mean, variance, lambda) with an iterative refinement mechanism.
Support for Environmental Attributes: Unlike previous tools, MuSimA explicitly supports environmental conditions (e.g., time, location), a critical component of modern ABAC systems.
Scalability and Flexibility: Capable of generating datasets with arbitrary scales (e.g., 100,000+ subjects) and complex, user-defined distributions.
Open Source & Privacy: The tool is open-source and modular, allowing organizations to run it locally to avoid privacy concerns associated with cloud-based data generation.

4. Experimental Results

The authors validated MuSimA using a large-scale configuration: 100,000 subjects, 2,500 objects, 1,000 environmental entities, and 50 authorization rules.

Accuracy Metrics: The system measured the error between expected and actual attribute value counts.
- Subject Attributes: Mean error of 3.25%.
- Object Attributes: Mean error of 5.45%.
- Environment Attributes: Mean error of 5.30%.
- Overall Mean Error: 4.66%.
Distribution Performance:
- Uniform distributions showed the lowest errors.
- Complex or highly skewed distributions (e.g., specific Poisson cases) showed slightly higher errors but remained within acceptable limits.
Visual Validation: Graphs comparing "Expected" vs. "Actual" counts confirmed that the generated data closely follows the input distribution specifications.

5. Significance and Future Directions

Research Impact: MuSimA fills a critical gap in the ABAC research ecosystem by providing a reliable, customizable source of synthetic data. This enables rigorous testing of policy mining algorithms, scalability studies, and security analysis at the Policy Information Point (PIP), Decision Point (PDP), and Enforcement Point (PEP).
Future Work:
- Correlated Attributes: Future versions aim to model correlations between attributes (currently, attributes are generated independently) to better mimic real-world scenarios.
- Log Analysis: Integrating real access logs to learn realistic patterns automatically.
- Advanced Policies: Adding support for time/location-based conditions, role hierarchies, and separation-of-duty constraints.
- Benchmarking: Comparing MuSimA-generated datasets against real-world datasets (like Amazon UCI) to further validate realism.

In conclusion, MuSimA represents a significant step forward in ABAC research infrastructure, offering a flexible, accurate, and accessible tool for generating bespoke datasets that overcome the limitations of existing static or simulation-based approaches.