# ADLBiLSTM: A Semantic Generation Algorithm for Multi-Grammar Network Access Control Policies
## 4 Experiments
### Semantic Generation for ACLs
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Dataset** & **Model** & \(P\) (\%) & \(R\) (\%) & \(F1\) (\%) \\ \hline \multirow{4}{*}{cisco\_standard\_ACL} & Baseline & 74.96 & 76.15 & 75.53 \\ \cline{2-5}  & Baseline + DL-BiLSTM & 99.99 & 99.99 & 99.99 \\ \cline{2-5}  & Baseline + Self-attention & 99.9 & 99.9 & 99.9 \\ \cline{2-5}  & Ours & 100 & 100 & 100 \\ \hline \multirow{4}{*}{huawei\_standard\_ACL} & Baseline & 62.37 & 75.47 & 68.24 \\ \cline{2-5}  & Baseline + DL-BiLSTM & 100 & 100 & 100 \\ \cline{2-5}  & Baseline + Self-attention & 86.59 & 86.59 & 86.59 \\ \cline{2-5}  & Ours & 100 & 100 & 100 \\ \hline \multirow{4}{*}{ruijie\_standard\_ACL} & Baseline & 74.44 & 75.58 & 75.0 \\ \cline{2-5}  & Baseline + DL-BiLSTM & 99.99 & 99.99 & 99.99 \\ \cline{1-1} \cline{2-5}  & Baseline + Self-attention & 99.42 & 99.42 & 99.42 \\ \cline{1-1} \cline{2-5}  & Ours & 100 & 100 & 100 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: The model’s semantic generation results for the standard ACL. To further validate the role of the self-attention mechanism and double-layer BiLSTM in semantic generation, we generated a confusion matrix using the experimental results of Huawei's extended ACL as an example to verify the impact of these two layers of the network. As shown in Figure 4, adding BiLSTM and the self-attention mechanism to the baseline improved the model's ability to extract features from security policies. By comparing Figure 4a-c, it can be seen that \"dest_host_ip\" and \"dest_host_ip_mask\" were difficult to generate as labels. The reason is that the data for these two labels were in the form of IP addresses and very similar. Therefore, the baseline often generated these two labels as \"obj_network_mask\" and \"obj_network_netadd\". These two labels also corresponded to data in the form of IP addresses, but they represented different meanings in the security policy. The correct labels represented the address and mask of the destination host, while the incorrectly generated labels represented the address and mask of the source host. When we added a self-attention layer and an additional BiLSTM layer to the baseline, although the accuracy of other semantic generations improved, there were still errors in generating these two labels. However, our model, which combined the double-layer BiLSTM and the self-attention mechanism, achieved a 100% accuracy rate when generating these two labels, as shown in Figure 4d. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Dataset** & **Model** & _P (\%)_ & _R (\%)_ & _F1 (\%)_ \\ \hline \multirow{4}{*}{cisco\_extend\_ACL} & Baseline & 34.92 & 45.99 & 39.48 \\ \cline{2-5}  & Baseline + DL-BiLSTM & 99.8 & 99.8 & 99.8 \\ \cline{2-5}  & Baseline + Self-attention & 91.51 & 91.31 & 91.31 \\ \cline{2-5}  & Ours & 99.74 & 99.74 & 99.74 \\ \hline \multirow{4}{*}{huawei\_extend\_ACL} & Baseline & 40.31 & 45.65 & 42.53 \\ \cline{2-5}  & Baseline + DL-BiLSTM & 97.68 & 97.68 & 97.68 \\ \cline{2-5}  & Baseline + Self-attention & 91.41 & 89.75 & 86.26 \\ \cline{2-5}  & Ours & 100 & 100 & 100 \\ \hline \multirow{4}{*}{ruijie\_extend\_ACL} & Baseline & 52.58 & 58.96 & 55.56 \\ \cline{2-5}  & Baseline + DL-BiLSTM & 98.99 & 98.89 & 98.93 \\ \cline{2-5}  & Baseline + Self-attention & 95.3 & 95.24 & 95.14 \\ \cline{2-5}  & Ours & 100 & 100 & 100 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: The model’s semantic generation results for the extended ACL. Figure 3: The number of correct security policy semantics generated by four models.