## 4 Proposed Method
### Policy Mining with Visual Representation  
#### 4.1.1 Preprocessing  
First, we present the definitions of the matrix representations for _ULAV_ and _OOAV_, respectively. **Definition 1**. : (_ULIA_) _Represents the Boolean matrix form corresponding to a given ULUAV. It can be represented as follows:_  
\[\textit{ULIA}[i][j]=\left\{ \begin{array}{l}1,if\;\;\textit{user}\;\;u_{i}\; \textit{has the attribute value in the $j^{th}$column}\\ 0,\textit{otherwise}\end{array} \right.. \tag{5}\]  
**Definition 2**. : (_OOA_) _Represents the Boolean matrix form corresponding to a given OOAV. It can be represented as follows:_  
\[\textit{OOA}[i][j]=\left\{ \begin{array}{l}1,if\;\;\textit{object}\;\mathrm{ o}_{i}\;\textit{has the attribute value in the $j^{th}$column}\\ 0,\textit{otherwise}\end{array} \right.. \tag{6}\]  
To satisfy basic policy mining, we construct an extensive users-objects-operations relationship for a given set of authorizations \(A\). This relationship can be equivalently denoted as a constructed matrix \(\textit{UOP}^{A}\), which is a generalized Cartesian product of the matrix \(\textit{ULIA}^{A}\) and the matrix \(\textit{OOA}^{A}\) for the requesting users and requested objects, respectively. The rows of \(\textit{UOP}^{A}\) correspond to all the possible user-object pairs, and the columns correspond to the attribute-value pairs of the users and objects, as well as the operations in \(A\). **Example 1**. : _Given an authorization list \(A\), a matrix \(\textit{ULIA}^{A}\) of the attribute value assignments for users, and a matrix \(\textit{OOA}^{A}\) of the attribute value assignments for objects in Tables 1-3, respectively, then, the matrix \(\textit{UOP}^{A}\) can be constructed as in Table 4, where the notations _uav_ and _av_ represent the attribute values of users and objects, respectively. Figure 2: Flow chart of PEO_VR&SOD. To mine suitable authorization rules from the constructed matrix \(UOP\), we need to find the attribute-value pairs for users and objects, such that the values of their corresponding cells in one row are 1, as is the value of the operation cell. Meanwhile, there is not any row where the value of the operation cell is 0 while retaining the values of the cells as 1 for the same attribute-value pairs. The various combinations of different attribute-value pairs that meet the requirements are referred to as the ABAC authorization rules, the number of which needs to be minimum. In other words, our method involves finding the minimal set of rules from the \(UOP\) that can cover all the rows with the operation columns having values of 1. Meanwhile, the different attribute-value pairs in the set do not present in any row with the operation column containing a value of 0. To find a suitable and minimal set of rules, we present two guiding principles as follows:  
1. Principle 1: Assume that \(k_{1}\) and \(k_{2}\) are two different combinations of attribute-value pairs included in rules \(ar_{1}\) and \(ar_{2}\), respectively. If \(k_{1}\subseteq k_{2}\) (that is, the number of attribute-value pairs in \(k_{2}\) is greater than that in \(k_{1}\)), then the authorizations covered by \(k_{2}\) can also be covered by \(k_{1}\); moreover, \begin{table}
\begin{tabular}{c c c} \hline \hline
**User** & **Object** & **Operation** \\ \hline \(u_{1}\) & \(o_{1}\) & \(op_{1}\) \\ \hline \(u_{2}\) & \(o_{1}\) & \(op_{2}\) \\ \hline \(u_{3}\) & \(o_{2}\) & \(op_{1}\) \\ \hline \(u_{3}\) & \(o_{2}\) & \(op_{2}\) \\ \hline \(u_{4}\) & \(o_{2}\) & \(op_{1}\) \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Authorization list \(A\). \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Object** & \(oav_{1}\) & \(oav_{2}\) & \(oav_{3}\) \\ \hline \(o_{1}\) & 1 & 0 & 1 \\ \hline \(o_{2}\) & 0 & 1 & 1 \\ \hline \hline \end{tabular}
\end{table} 
Table 4:  
\(k_{2}\) is more restricted than \(k_{1}\). The authorizations covered by rule _ar_ increase in number as the number of attribute-value pairs in _ar_ decreases.