@article {AitElHadj2021836,
	title = {A Log-Based Method to Detect and Resolve Efficiently Conflicts in Access Control Policies},
	journal = {Advances in Intelligent Systems and Computing},
	volume = {1383 AISC},
	year = {2021},
	note = {cited By 0},
	pages = {836-846},
	abstract = {Typically, a security audit is conducted to detect and track inappropriate activities, such as security policy misconfigurations and attacks. Practically, an audit can be done through the analysis and assessment of data in logs registering traces of queries according to predefined policies. In this paper, we present an auditing approach that detects and resolves efficiently conflicting rules of a security policy. Such efficiency translates into a reduction in the time it takes to detect and resolve conflicts. Such efficiency is a consequence of the fact that conflict detection is executed only among suspicious pairs of rules, instead of all pairs of rules. The idea of using suspicious pairs of rules has recently been applied to reduce the execution time of previous detection methods. The present study goes further by applying the idea not only for conflict detection, but also for reducing the resolution time of the detected conflicts. We present experimental results that illustrate the efficiency of the suggested method. {\textcopyright} 2021, The Author(s), under exclusive license to Springer Nature Switzerland AG.},
	keywords = {Access control, Access control policies, conflict detection, Detection methods, Efficiency, Misconfigurations, Pattern recognition, Resolution time, Security audit, Security policy, Security systems, Soft computing},
	doi = {10.1007/978-3-030-73689-7_79},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-85105891237\&doi=10.1007\%2f978-3-030-73689-7_79\&partnerID=40\&md5=f0de7beea992beee027f768bafe5cf58},
	author = {Ait El Hadj, M. and Khoumsi, A. and Benkaouz, Y. and Erradi, M.}
}
@article {Khoumsi2019343,
	title = {Automata-based bottom-up design of conflict-free security policies specified as policy expressions},
	journal = {Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)},
	volume = {11028 LNCS},
	year = {2019},
	note = {cited By 0},
	pages = {343-357},
	doi = {10.1007/978-3-030-05529-5_23},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-85059958782\&doi=10.1007\%2f978-3-030-05529-5_23\&partnerID=40\&md5=903c5a9fdf6f9a84edd470778038befc},
	author = {Khoumsi, A. and Erradi, M.}
}
@conference {ElHadj20195330,
	title = {Validation and Correction of Large Security Policies: A Clustering and Access Log Based Approach},
	booktitle = {Proceedings - 2018 IEEE International Conference on Big Data, Big Data 2018},
	year = {2019},
	note = {cited By 0},
	pages = {5330-5332},
	doi = {10.1109/BigData.2018.8622610},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-85062588205\&doi=10.1109\%2fBigData.2018.8622610\&partnerID=40\&md5=7c1e7e5b141f9f63ccf2ad00a318664f},
	author = {El Hadj, M.A. and Erradi, M. and Khoumsi, A. and Benkaouz, Y.}
}
@article {AitElHadj2018298,
	title = {Access domain-based approach for anomaly detection and resolution in XACML policies},
	journal = {Advances in Intelligent Systems and Computing},
	volume = {735},
	year = {2018},
	pages = {298-308},
	doi = {10.1007/978-3-319-76354-5_27},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-85044049486\&doi=10.1007\%2f978-3-319-76354-5_27\&partnerID=40\&md5=6c7c85cfacd3e4e948ef85d2df40ee3f},
	author = {Ait El Hadj, M. and Benkaouz, Y. and Khoumsi, A. and Erradi, M.}
}
@article {Khoumsi201851,
	title = {A formal basis for the design and analysis of firewall security policies},
	journal = {Journal of King Saud University - Computer and Information Sciences},
	volume = {30},
	number = {1},
	year = {2018},
	pages = {51-66},
	doi = {10.1016/j.jksuci.2016.11.008},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-85008234846\&doi=10.1016\%2fj.jksuci.2016.11.008\&partnerID=40\&md5=07a25a70cda473802a697eff8dbb8dec},
	author = {Khoumsi, A. and Erradi, M. and Krombi, W.}
}
@article {Khoumsi201851,
	title = {A formal basis for the design and analysis of firewall security policies},
	journal = {Journal of King Saud University - Computer and Information Sciences},
	volume = {30},
	number = {1},
	year = {2018},
	note = {cited By 0},
	pages = {51-66},
	abstract = {A firewall is the core of a well defined network security policy. This paper presents an automata-based method to study firewall security policies. We first propose a procedure that synthesizes an automaton that describes a security policy given as a table of rules. The synthesis procedure is then used to develop procedures to detect: incompleteness, anomalies and discrepancies in security policies. A method is developed to represent the automaton by a policy qualified as mixable and that has practical utilities, such as ease to determine the whitelist and the blacklist of the policy. The developed procedures have been deeply evaluated in terms of time and space complexities. Then, a real case study has been investigated. The obtained results confirm that the developed procedures have reasonable complexities and that their actual execution times are of the order of seconds. Finally, proofs of all results are provided. {\textcopyright} 2016 King Saud University},
	doi = {10.1016/j.jksuci.2016.11.008},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-85008234846\&doi=10.1016\%2fj.jksuci.2016.11.008\&partnerID=40\&md5=07a25a70cda473802a697eff8dbb8dec},
	author = {Khoumsi, A. and Erradi, M. and Krombi, W.}
}
@article {Ayache2017166,
	title = {Aspect-oriented state machines for resolving conflicts in XACML policies},
	journal = {Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)},
	volume = {10299 LNCS},
	year = {2017},
	note = {cited By 0},
	pages = {166-171},
	abstract = {Authorizationin collaborativesystemsisdefinedbyaglobal policy that represents the combination of the collaborators{\textquoteright} access policies. However, the enforcement of such a global policy may create conflicting authorization decisions. In this paper, we categorize two types of conflicts that may occur in such policies. Furthermore, to resolve these conflicts and to reach a unique decision for an access request, we present an approach that uses XACML policy combining algorithms and considers the category of the detected conflicts. The approach is implemented using aspect-oriented finite state machines. {\textcopyright} Springer International Publishing AG 2017.},
	doi = {10.1007/978-3-319-59647-1_13},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-85019731058\&doi=10.1007\%2f978-3-319-59647-1_13\&partnerID=40\&md5=917cf51c38e853e2423ad411ec1ecadb},
	author = {Ayache, M. and Erradi, M. and Freisleben, B. and Khoumsi, A.}
}
@conference {ElHadj2017548,
	title = {Clustering-based approach for anomaly detection in XACML policies},
	booktitle = {ICETE 2017 - Proceedings of the 14th International Joint Conference on e-Business and Telecommunications},
	volume = {4},
	year = {2017},
	note = {cited By 0},
	pages = {548-553},
	abstract = {The development of distributed applications arises multiple security issues such as access control. Attribute-Based Access Control has been proposed as a generic access control model, which provides more flexibility and promotes information and security sharing. eXtensible Access Control Markup Language (XACML) is the most convenient way to express ABAC policies. However, in distributed environments, XACML policies become more complex and hard to manage. In fact, an XACML policy in distributed applications may be aggregated from multiple parties and can be managed by more than one administrator. Therefore, it may contain several anomalies such as conflicts and redundancies, which may affect the performance of the policy execution. In this paper, we propose an anomaly detection method based on the decomposition of a policy into clusters before searching anomalies within each cluster. Our evaluation results demonstrate the efficiency of the suggested approach. Copyright {\textcopyright} 2017 by SCITEPRESS - Science and Technology Publications, Lda. All rights reserved.},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-85029414026\&partnerID=40\&md5=133521fca6a95f8238cfc3b777dd3534},
	author = {El Hadj, M.A. and Ayache, M. and Benkaouz, Y. and Khoumsi, A. and Erradi, M.}
}
