{"type":"ScholarlyArticle","title":"Using Constraint Programming and Graph Representation Learning for Generating Interpretable Cloud Security Policies","authors":[{"name":"Mikhail Kazdagli","slug":"mikhail-kazdagli","given":"Mikhail","family":"Kazdagli","affiliation":"The University of Texas at Austin"},{"name":"Mohit Tiwari","slug":"mohit-tiwari","given":"Mohit","family":"Tiwari","affiliation":"The University of Texas at Austin"},{"name":"Akshat Kumar","slug":"akshat-kumar","given":"Akshat","family":"Kumar","affiliation":"Singapore Management University"}],"abstract":"Modern software systems rely on mining insights from business sensitive data stored in public clouds. A data breach usually incurs significant (monetary) loss for a commercial organization. Conceptually, cloud security heavily relies on Identity Access Management (IAM) policies that IT admins need to properly configure and periodically update. Security negligence and human errors often lead to misconfiguring IAM policies which may open a backdoor for attackers. To address these challenges, first, we develop a novel framework that encodes generating optimal IAM policies using constraint programming (CP). We identify reducing dormant permissions of cloud users as an optimality criterion, which intuitively implies minimizing unnecessary datastore access permissions. Second, to make IAM policies interpretable, we use graph representation learning applied to historical access patterns of users to augment our CP model with similarity constraints: similar users should be grouped together and share common IAM policies. Third, we describe multiple attack models and show that our optimized IAM policies significantly reduce the impact of security attacks using real data from 8 commercial organizations, and synthetic instances.","doi":"10.24963/ijcai.2022/257","url":"https://ijcai.org/proceedings/2022/257","pdf":"https://ijcai.org/proceedings/2022/0257.pdf","markdown":"https://ijcai.org/proceedings/2022/257.md","bibtex":"https://ijcai.org/proceedings/2022/bibtex/257","volume":{"slug":"2022","title":"Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2022","url":"https://ijcai.org/proceedings/2022/","year":2022,"location":"Vienna","dates":"23-29 July 2022","editors":"Luc De Raedt","isbn":"978-1-956792-00-3","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2022"},"section":"Constraint Satisfaction and Optimization","track":"Main Track","number":257,"pages":{"first":1850,"last":1858},"keywords":["Constraint Satisfaction and Optimization: Constraints and Machine Learning","Constraint Satisfaction and Optimization: Applications","Multidisciplinary Topics and Applications: Security and Privacy","Constraint Satisfaction and Optimization: Modeling","Constraint Satisfaction and Optimization: Constraint Programming"],"videos":[{"label":"Video #1","url":"https://slideslive.com/38986895","length_sec":82,"provider":"slideslive"},{"label":"Video #2","url":"https://slideslive.com/38985038","length_sec":358,"provider":"slideslive"}],"references":[{"position":1,"raw":"[Axelsson, 1999] Stefan Axelsson. The base-rate fallacy and its im- plications for the difficulty of intrusion detection. In CCS, 1999.","title":"The base-rate fallacy and its implications for the difficulty of intrusion detection","authors":"Stefan Axelsson, Axelsson","year":"1999","venue":"CCS","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Ben-Ameur and Neto, 2006] Walid Ben-Ameur and José Neto. A constraint generation algorithm for large scale linear programs using multiple-points separation. Mathematical Programming, 2006.","title":"A constraint generation algorithm for large scale linear programs using multiple-points separation","authors":"Ben-Ameur Neto, ; Walid Ben-Ameur, José Neto","year":"2006","venue":"Mathematical Programming","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Canali et al., 2012] Davide Canali, Andrea Lanzi, Davide Balzarotti, Christopher Kruegel, Mihai Christodorescu, and En- gin Kirda. A quantitative study of accuracy in system call-based malware detection. In ISSTA 2012, 2012.","title":"A quantitative study of accuracy in system call-based malware detection","authors":"Davide Canali, Andrea Lanzi, Davide Balzarotti, Christopher Kruegel, Mihai Christodorescu, Engin Kirda","year":"2012","venue":"ISSTA 2012","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Demme et al., 2013] John Demme, Matthew Maycock, Jared Schmitz, Adrian Tang, Adam Waksman, Simha Sethumadhavan, and Salvatore Stolfo. On the feasibility of online malware detec- tion with performance counters. In ISCA, 2013.","title":"On the feasibility of online malware detection with performance counters","authors":"John Demme, Matthew Maycock, Jared Schmitz, Adrian Tang, Adam Waksman, Simha Sethumadhavan, Salvatore Stolfo","year":"2013","venue":"ISCA","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Hamilton et al., 2017] Will Hamilton, Zhitao Ying, and Jure Leskovec. Inductive representation learning on large graphs. In NeurIPS, volume 30, pages 1025-1035, 2017.","title":"Inductive representation learning on large graphs","authors":"Hamilton","year":"2017","venue":"NeurIPS","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Handley et al., 2001] Mark Handley, Vern Paxson, and Christian Kreibich. Network intrusion detection: Evasion, traffic normal- ization, and end-to-end protocol semantics. In USENIX, 2001.","title":"Network intrusion detection: Evasion, traffic normalization, and end-to-end protocol semantics","authors":"Mark Handley, Vern Paxson, Christian Kreibich","year":"2001","venue":"USENIX","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Hassan et al., 2019] Wajih Ul Hassan, Shengjian Guo, Ding Li, Zhengzhang Chen, Kangkook Jee, Zhichun Li, and Adam Bates. Nodoze: Combatting threat alert fatigue with automated prove- nance triage. In NDSS, 2019.","title":"Nodoze: Combatting threat alert fatigue with automated provenance triage","authors":"Shengjian Wajih Ul Hassan, Ding Guo, Zhengzhang Li, Kangkook Chen, Zhichun Jee, Adam Li, Bates","year":"2019","venue":"NDSS","doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Hoffmann, 2015] Jörg Hoffmann. Simulated penetration testing: From \"dijkstra\" to \"turing test++\". In ICAPS, pages 364-372, 2015.","title":"Simulated penetration testing: From \"dijkstra\" to \"turing test++","authors":"Jörg Hoffmann, Hoffmann","year":"2015","venue":"ICAPS","doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Huang et al., 2017] Cheng Huang, Shuang Hao, Luca Invernizzi, Jiayong Liu, Yong Fang, Christopher Kruegel, and Giovanni Vi- gna. Gossip: Automatically identifying malicious domains from mailing list discussions. In AsiaCCS, 2017.","title":"Gossip: Automatically identifying malicious domains from mailing list discussions","authors":"Cheng Huang, Shuang Hao, Luca Invernizzi, Jiayong Liu, Yong Fang, Christopher Kruegel, Giovanni Vigna","year":"2017","venue":"AsiaCCS","doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[IAM, 2021] AWS IAM. Policies and permissions in iam. https://docs.aws.amazon.com/IAM/latest/UserGuide/ access policies.html, 2021. Accessed: 2022-05-29.","title":"AWS IAM. Policies and permissions in iam","authors":"Iam","year":"2021","venue":null,"doi":null,"url":"https://docs.aws.amazon.com/IAM/latest/UserGuide/accesspolicies.html","internal_url":null},{"position":11,"raw":"[IBM, 2021] IBM. Cp optimizer user's manual. https: //www.ibm.com/docs/en/SSSA5P 12.8.0/ilog.odms.studio. help/pdf/usrcpoptimizer.pdf, 2021. Accessed: 2022-05-29.","title":"IBM. Cp optimizer user's manual","authors":null,"year":"2021","venue":null,"doi":null,"url":"https://www.ibm.com/docs/en/SSSA5P12.8.0/ilog.odms.studio.help/pdf/usrcpoptimizer.pdf","internal_url":null},{"position":12,"raw":"[Kazdagli et al., 2016] Mikhail Kazdagli, Vijay Janapa Reddi, and Mohit Tiwari. Quantifying and improving the efficiency of hardware-based mobile malware detectors. In MICRO, 2016.","title":"Quantifying and improving the efficiency of hardware-based mobile malware detectors","authors":"Mikhail Kazdagli, Vijay Janapa Reddi, Mohit Tiwari","year":"2016","venue":"MICRO","doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Kipf and Welling, 2017] Thomas N. Kipf and Max Welling. Semi- supervised classification with graph convolutional networks. In ICLR, 2017.","title":"Semisupervised classification with graph convolutional networks","authors":"Thomas N Kipf, Max Welling","year":"2017","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Kuenzli, 2020] Stephen Kuenzli. Why are good aws security poli- cies so difficult? https://www.k9security.io/posts/2020/06/why- are-good-aws-security-policies-so-difficult, 2020. Accessed: 2022-05-29.","title":"Why are good aws security policies so difficult","authors":"Stephen Kuenzli","year":"2022","venue":null,"doi":null,"url":"https://www.k9security.io/posts/2020/06/why-are-good-aws-security-policies-so-difficult,2020","internal_url":null},{"position":15,"raw":"[Lei et al., 2019] Qi Lei, Lingfei Wu, Pin-Yu Chen, Alex Dimakis, Inderjit S. Dhillon, and Michael J Witbrock. Discrete adversar- ial attacks and submodular optimization with applications to text classification. In MLSys, pages 146-165, 2019.","title":"Discrete adversarial attacks and submodular optimization with applications to text classification","authors":"Lei","year":"2019","venue":"MLSys","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Liu et al., 2021] Ninghao Liu, Mengnan Du, Ruocheng Guo, Huan Liu, and Xia Hu. Adversarial attacks and defenses: An interpre- tation perspective. SIGKDD Explor. Newsl., 2021.","title":"Adversarial attacks and defenses: An interpretation perspective","authors":"Liu","year":"2021","venue":"SIGKDD Explor. Newsl","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Marks, 2021a] Gene Marks. 533 million facebook users' phone numbers and personal data have been leaked online. https://www.businessinsider.com/stolen-data-of-533-million- facebook-users-leaked-online-2021-4, 2021. Accessed: 2022- 05-29.","title":"Gene Marks. 533 million facebook users' phone numbers and personal data have been leaked online","authors":"Marks","year":"2021","venue":null,"doi":null,"url":"https://www.businessinsider.com/stolen-data-of-533-million-facebook-users-leaked-online-2021-4","internal_url":null},{"position":18,"raw":"[Marks, 2021b] Gene Marks. A linkedin 'breach' exposes 92% of users. https://www.forbes.com/sites/quickerbettertech/2021/ 07/05/a-linkedin-breach-exposes-92-of-usersand-other-small- business-tech-news, 2021. Accessed: 2022-05-29.","title":"Gene Marks. A linkedin 'breach' exposes 92% of users","authors":"Marks","year":"2021","venue":null,"doi":null,"url":"https://www.forbes.com/sites/quickerbettertech/2021/07/05/a-linkedin-breach-exposes-92-of-usersand-other-small-business-tech-news,2021","internal_url":null},{"position":19,"raw":"[Mirsky et al., 2018] Yisroel Mirsky, Tomer Doitshman, Yuval Elovici, and Asaf Shabtai. Kitsune: An ensemble of autoencoders for online network intrusion detection. In NDSS, 2018.","title":"Kitsune: An ensemble of autoencoders for online network intrusion detection","authors":"Yisroel Mirsky, Tomer Doitshman, Yuval Elovici, Asaf Shabtai","year":"2018","venue":"NDSS","doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Nemhauser et al., 1978] G L Nemhauser, L A Wolsey, and M L Fisher. An analysis of approximations for maximizing submodu- lar set functions-I. Mathematical Programming, 1978.","title":"An analysis of approximations for maximizing submodular set functions-I","authors":"G L Nemhauser, L A Wolsey, M L Fisher","year":"1978","venue":"Mathematical Programming","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Oprea et al., 2018] Alina Oprea, Zhou Li, Robin Norris, and Kevin Bowers. Made: Security analytics for enterprise threat detection. In ACSAC, 2018.","title":"Made: Security analytics for enterprise threat detection","authors":"Alina Oprea, Zhou Li, Robin Norris, Kevin Bowers","year":"2018","venue":"ACSAC","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Rossi et al., 2006] Francesca Rossi, Peter van Beek, and Toby Walsh. Handbook of Constraint Programming. Elsevier Science Inc., 2006.","title":"Handbook of Constraint Programming","authors":"Francesca Rossi, Peter Van Beek, Toby Walsh","year":"2006","venue":null,"doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Saltzer and Schroeder, 1975] J.H. Saltzer and M.D. Schroeder. The protection of information in computer systems. Proceedings of the IEEE, 1975.","title":"The protection of information in computer systems","authors":"J H Saltzer, M D Schroeder","year":"1975","venue":"Proceedings of the IEEE","doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Sarraute et al., 2012] Carlos Sarraute, Olivier Buffet, and Jörg Hoffmann. Pomdps make better hackers: Accounting for un- certainty in penetration testing. In AAAI, 2012.","title":"Pomdps make better hackers: Accounting for uncertainty in penetration testing","authors":"Carlos Sarraute, Olivier Buffet, Jörg Hoffmann","year":"2012","venue":"AAAI","doi":null,"url":null,"internal_url":null},{"position":25,"raw":"[Satopaa et al., 2011] Ville Satopaa, Jeannie R. Albrecht, David E. Irwin, and Barath Raghavan. Finding a \"kneedle\" in a haystack: Detecting knee points in system behavior. In IEEE ICDCS, 2011.","title":"Finding a \"kneedle\" in a haystack: Detecting knee points in system behavior","authors":"Ville Satopaa, Jeannie R Albrecht, David E Irwin, Barath Raghavan","year":"2011","venue":"IEEE ICDCS","doi":null,"url":null,"internal_url":null},{"position":26,"raw":"[Schlichtkrull et al., 2018] Michael Schlichtkrull, Thomas N. Kipf, Peter Bloem, Rianne van den Berg, Ivan Titov, and Max Welling. Modeling relational data with graph convolutional networks. In Aldo Gangemi, Roberto Navigli, Maria-Esther Vidal, Pascal Hit- zler, Raphaël Troncy, Laura Hollink, Anna Tordai, and Mehwish Alam, editors, The Semantic Web, 2018.","title":"Modeling relational data with graph convolutional networks","authors":"Michael Schlichtkrull, Thomas N Kipf, Peter Bloem, Rianne Van Den, Ivan Berg, Max Titov, Welling","year":"2018","venue":"The Semantic Web","doi":null,"url":null,"internal_url":null},{"position":27,"raw":"[Scroxton, 2020] Alex Scroxton. Leaky aws s3 bucket once again at centre of data breach. https://www.computerweekly.com/ news/252491842/Leaky-AWS-S3-bucket-once-again-at-centre- of-data-breach, 2020. Accessed: 2022-05-29.","title":"Leaky aws s3 bucket once again at centre of data breach","authors":"Alex Scroxton","year":"2020","venue":null,"doi":null,"url":"https://www.computerweekly.com/news/252491842/Leaky-AWS-S3-bucket-once-again-at-centre-of-data-breach","internal_url":null},{"position":28,"raw":"[Security, 2021] Aqua Security. Cloud configuration risks ex- posed. https://www.aquasec.com/news/cloud-misconfigurations- on-the-rise-2021-cloud-security-report, 2021. Accessed: 2022- 05-29.","title":"Aqua Security. Cloud configuration risks exposed","authors":null,"year":"2021","venue":null,"doi":null,"url":"https://www.aquasec.com/news/cloud-misconfigurations-on-the-rise-2021-cloud-security-report,2021","internal_url":null},{"position":29,"raw":"[Shmaryahu et al., 2018] Dorin Shmaryahu, Guy Shani, Jörg Hoff- mann, and Marcel Steinmetz. Simulated penetration testing as contingent planning. In ICAPS, pages 241-249, 2018.","title":"Simulated penetration testing as contingent planning","authors":"Dorin Shmaryahu, Guy Shani, Jörg Hoffmann, Marcel Steinmetz","year":"2018","venue":"ICAPS","doi":null,"url":null,"internal_url":null},{"position":30,"raw":"[Sommer and Paxson, 2010] Robin Sommer and Vern Paxson. Out- side the closed world: On using machine learning for network intrusion detection. In IEEE S&P, 2010.","title":"Outside the closed world: On using machine learning for network intrusion detection","authors":"Paxson Sommer, Robin Sommer, Vern Paxson","year":"2010","venue":"IEEE S&P","doi":null,"url":null,"internal_url":null},{"position":31,"raw":"[Verizon, 2021] Verizon. Data breach investigations report. https://www.verizon.com/business/resources/reports/2021/2021- data-breach-investigations-report.pdf? ga=2.175409509. 678363106.1639526451-2015926119.1639526451, 2021. Accessed: 2022-05-29.","title":"Verizon. Data breach investigations report","authors":null,"year":"2021","venue":null,"doi":null,"url":"https://www.verizon.com/business/resources/reports/2021/2021-data-breach-investigations-report.pdf?ga=2.175409509.678363106.1639526451-2015926119.1639526451","internal_url":null},{"position":32,"raw":"[Wang et al., 2019] Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y. Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In IEEE S&P, 2019.","title":"Neural cleanse: Identifying and mitigating backdoor attacks in neural networks","authors":"Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, Ben Y Zhao","year":"2019","venue":"IEEE S&P","doi":null,"url":null,"internal_url":null},{"position":33,"raw":"[Wu et al., 2012] Dong-Jie Wu, Ching-Hao Mao, Te-En Wei, Hahn-Ming Lee, and Kuo-Ping Wu. Droidmat: Android mal- ware detection through manifest and api calls tracing. In AsiaJ- CIS, 2012.","title":"Droidmat: Android malware detection through manifest and api calls tracing","authors":"Dong-Jie Wu, Ching-Hao Mao, Te-En Wei, Hahn-Ming Lee, Kuo-Ping Wu","year":"2012","venue":"AsiaJ-CIS","doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}