# Enhancing Healthcare Security: A Unified RBAC and ABAC Risk-Aware Access Control Approach
## 5 Results and Analysis
### Experimental Results  
A total of 43 simulations were performed across diverse scenarios. The simulations were selected based on the matching results obtained from 27 designed users, in conjunction with four dynamic attributes: (1) current time, (2) user location, (3) user action, and (4) accessed resource. The user data that are used to build simulations consists of various profiles within a healthcare system, each identified by a unique User ID and assigned specific roles, access levels, working periods, risky operations, registered offices, and office types. For User IDs 1 to 9, the roles include doctors with normal, advanced, or premium access levels. These users work typically from 9:00 to 18:00, and they have no risky operations recorded for most cases, though a few have histories of three or five risky operations. They are registered in Office 1 and work in standard office environments. User IDs 10 to 18 are nurses with normal, advanced, or premium access levels. Their working hours are from 10:00 to 19:00, with similar patterns of risky operations as the doctors. They are assigned to Reception 1 and work in reception areas. User IDs 19 to 21 are admins with premium access, working all day in Office 2, with similar patterns of risky operations as the doctors and nurses. This profile is unique as it combines high-level access with an office-type setting. The inclusion of multiple administrator users in this simulation reflects realistic operational practices in large healthcare institutions, where administrative roles are often distributed across shifts, departments, or responsibility areas. From a Risk-Based Access Control perspective, modeling multiple admins enables a thorough evaluation of the system's ability to adapt to varying access requests from users with similar privileges but different contextual conditions. This enhances the robustness and generalizability of the model under diverse real-world scenarios. User IDs 22 to 27 represent external roles such as police officers and social workers. Although the number of these users may seem relatively high compared to nurses and doctors, this was intentional to enable the simulation of a wide range of contextual scenarios and exception-handling cases involving auxiliary roles. These users help evaluate the system's response to diverse and potentially high-risk access patterns, ensuring that the model effectively manages users with conditional access requirements and varied operational contexts. Based on this data, Table 8 displays all simulations conducted to verify the effectiveness of the implemented model, incorporating previously mentioned designed users' data with dynamic attributes and corresponding detailed descriptions. Each final access decision is color-coded. Red signifies FP, orange signifies FN, green denotes TP, and blue denotes TN outcomes. The scenarios presented in Table 8 simulate various real-world situations, considering factors like user role, access level, time of access, location, action, and resource sensitivity. The model's decision for each scenario is then compared to the expected outcome, as reflected in the confusion matrix. The scenarios presented showcase the model's ability to dynamically assess user access requests based on a combination of RBAC, ABAC, and risk-aware elements. The confusion matrix provides a quantitative measure of the model's accuracy in granting or denying access to highlight its strengths and potential areas for improvement.