# Enhancing Healthcare Security: A Unified RBAC and ABAC Risk-Aware Access Control Approach
## 5 Results and Analysis
### Experimental Results
\begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline
**Scenario** & **User ID** & \begin{tabular}{c} **Current** \\ **Time** \\ \end{tabular} & \begin{tabular}{c} **Current** \\ **Location** \\ \end{tabular} & \begin{tabular}{c} **Current** \\ **Action** \\ \end{tabular} & \begin{tabular}{c} **Resource** \\ **Sensitivity** \\ \end{tabular} & \
\begin{tabular}{c} **Access** \\ **Decision** \\ \end{tabular} &
\begin{tabular}{c} **Confusion** \\ **Matrix** \\ \end{tabular} \\ \hline
1 & 1 & 11:00 & Office 1 & Read & Internal & Permit & TP \\ \hline
2 & 1 & 19:00 & Reception 2 & Read & Internal & Permit & TP \\ \hline
3 & 1 & 10:00 & Office 1 & Write & Confidential & Deny & TN \\ \hline
4 & 2 & 10:00 & Reception 2 & Read & Internal & Permit & TP \\ \hline
5 & 2 & 10:00 & Office 1 & Write & Internal & Permit & TP \\ \hline
6 & 3 & 10:00 & Office 1 & Read & Internal & Deny & TN \\ \hline
7 & 4 & 12:00 & Office 2 & Read & Confidential & Permit & TP \\ \hline
8 & 4 & 12:00 & Office 1 & Read & Restricted & Deny & TN \\ \hline
9 & 5 & 21:00 & Office 2 & Read & Confidential & Permit & TP \\ \hline
10 & 5 & 11:00 & Office 1 & Write & Confidential & Deny & TN \\ \hline
11 & 7 & 11:00 & Office 1 & Write & Restricted & Permit & TP \\ \hline
12 & 7 & 11:00 & Reception 1 & Read & Restricted & Permit & TP \\ \hline
13 & 8 & 15:00 & Office 1 & Write & Internal & Deny & TN \\ \hline
14 & 8 & 15:00 & Reception 1 & Read & Confidential & Permit & TP \\ \hline
15 & 9 & 15:00 & Office 1 & Read & Restricted & Deny & TN \\ \hline
16 & 10 & 10:00 & Reception 1 & Read & Internal & Permit & TP \\ \hline
17 & 10 & 19:00 & Office 2 & Read & Internal & Permit & TP \\ \hline
18 & 10 & 10:00 & Reception 1 & Write & Confidential & Deny & TN \\ \hline
19 & 11 & 10:00 & Office 2 & Read & Internal & Permit & TP \\ \hline
20 & 11 & 10:00 & Reception 1 & Write & Internal & Deny & FN \\ \hline
21 & 11 & 10:00 & Reception 2 & Write & Internal & Deny & TN \\ \hline
22 & 12 & 10:00 & Reception 1 & Read & Internal & Deny & TN \\ \hline
23 & 13 & 12:00 & Reception 2 & Read & Confidential & Permit & TP \\ \hline
24 & 13 & 12:00 & Reception 1 & Read & Internal & Permit & TP \\ \hline
25 & 14 & 21:00 & Reception 2 & Read & Confidential & Deny & TN \\ \hline
26 & 14 & 11:00 & Reception 1 & Write & Confidential & Deny & TN \\ \hline
27 & 15 & 10:00 & Reception 1 & Read & Confidential & Deny & TN \\ \hline
28 & 16 & 11:00 & Reception 1 & Write & Restricted & Permit & TP \\ \hline
29 & 16 & 11:00 & Office 1 & Read & Restricted & Permit & TP \\ \hline
30 & 17 & 15:00 & Reception 1 & Write & Internal & Deny & TN \\ \hline
31 & 17 & 15:00 & Office 2 & Read & Confidential & Deny & FN \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Scenario details with access decisions and a confusion matrix. To compute the TP, FP, FN, and TN values, we utilized the defined XACML access control policies defined in Table 7 as the ground truth against which the decisions of the PDP were evaluated. Each access request--generated for different roles (admin, doctor, nurse, social worker, police officer) under various risk levels and operation types (read, write, delete)--was checked for compliance with the corresponding access policy. A request correctly permitted by the PDP in accordance with the policy was counted as a TP, whereas a request wrongly permitted when it should have been denied was considered an FP. Similarly, a request correctly denied (matching a policy restriction) was classified as a TN, while an incorrectly denied request that should have been allowed under the policy was considered an FN. For example, if a doctor with 'normal' privilege requested to read internal medical records at a negligible risk level and the PDP permitted this action (which aligns with the policy), this counted as a TP. Conversely, if the PDP allowed a nurse to delete records--an action explicitly forbidden by policy--this was marked as an FP.