## 2 Related Work  
### Research on Policy Engineering in ABAC  
Various methods have been proposed for ABAC policy engineering. Depending on whether minimizing the number of mining rules is considered an optimized objective, existing studies mainly fall into the following two categories: general policy engineering and optimized policy engineering.  
To avoid the potential risks of permitting unauthorized accesses, [PERSON] et al. [14] presented a risk based ABAC policy engineering problem that assessed the potential risk for each possible access while minimizing the total risk in the ABAC system. [PERSON] et al. [15] proposed a label based ABAC model using the method of enumeration for the construction of ABAC policies, each of which included only one user attribute and one object attribute. [PERSON] et al. [6] proposed a top-down ABAC policy engineering framework using a deep recurrent neural network, which derived authorization rules from unrestricted natural language documents. [PERSON] et al. [16] presented a novel method for ABAC policy mining to construct positive and negative authorization rules. [PERSON] et al. [17] proposed a hybrid approach for policy engineering in ABAC, which first used a top-down approach and then used a bottom-up approach to construct authorization rules. Although existing approaches are capable of constructing ABAC policies, the number of attribute-value pairs in any constructed rule is also critical. The time needed for access decisions increases with an increasing number of attribute-value pairs included in any rule. To improve the efficiency of the mining process, [PERSON] et al. [18] regarded the number of attributes included in any rule as a weight and presented a constrained policy mining algorithm in ABAC that constructed a set of authorization rules from an access control matrix, such that the weight of each rule was less than a specified value, and the sum of the total weights of the rules was minimized.  
To discover an optimal set of ABAC rules from conventional access modes, [PERSON] et al. [19] presented an ABAC policy mining algorithm that included environmental attributes that used the Gini impurity to form an ABAC policy while minimizing the number of rules. [PERSON] et al. [20] showed that the policy-mining problem is equivalent to identifying a set of functional dependencies in relational databases. The authors first proposed an ABAC policy mining algorithm called ABAC-FDM. Although this algorithm identified all the potential rules, the complexity of the algorithm was exponential. As an alternative, the authors next proposed another more efficient mining algorithm called ABAC-SRM, which discovered a suitable and minimal set of rules from candidate rules. To obtain a minimal set of ABAC rules in multi-cloud collaborations, [PERSON] et al. [21] defined a cross-domain rule-mining problem called CDRMP that was proven to be NP hard and provided a heuristic solution. They also defined a cross-domain rule-mining problem with access relaxations under dynamic collaborations [22] called \(\beta\)-CDRMP and DCDRMP and presented the heuristic solutions for mining minimal sets of authorization rules. Besides mining positive rules in the cross domain, [PERSON] et al. [23] considered the mining of negative rules from a given set of multi-cloud access requests, thereby defining a novel problem called CDRMP-H, and presented a solution to further reduce the number of mining rules, including the positive and the negative.