# RMMDI: A Novel Framework for Role Mining Based on the Multi-Domain Information

Authors: Wei Bai; Zhisong Pan; Shize Guo; Zhe Chen
Journal: Security and Communication Networks
 (2019)

---

## Abstract

Role-based access control (RBAC) is widely adopted in network security management, and role mining technology has been extensively used to automatically generate user roles from datasets in a bottom-up way. However, almost all role mining methods discover the user roles from existing user-permission assignments, which neglect the dependency relationships between user permissions. To extend the ability of role mining technology, this paper proposes a novel role mining framework based on multi-domain information. The framework estimates the similarity between different permissions based on the fundamental information in the physical, network, and digital domains and attaches interdependent permissions to the same role. Three simulated network scenarios with different multi-domain configurations are used to validate the effectiveness of our method. The experimental results show that the method can not only capture the interdependent relationships between permissions, but also detect user roles and permissions more reasonably.


---

## Body

## 1. Introduction

Access control is a fundamental concern in network security management. Role-based access control (RBAC) has become the dominant model for both commercial and research fields [1, 2]. The key point of RBAC is to determine proper roles to capture business needs, which is named as role engineering. There are mainly two kinds of approaches to find user roles: top-down and bottom-up. The top-down approaches always perform a deep analysis of business processes and identify user roles manually [3], while the bottom-up approaches always discover the user roles from existing datasets automatically, which are also named as role mining as they usually resort to data mining techniques [4, 5].Existing role mining approaches mainly discover a proper user-role assignment relationUA⊆USERS×ROLES and a proper role-permission assignment relation PA⊆ROLES×PERMS from an existing user-permission assignment relation UPA⊆USERS×PERMS. In the process, user-permission assignments are considered to be independent. However, considering a typical service authorization process, users are authorized by multiple policy control points, including gate machines, firewalls, or identity authentication systems. Those systems are always configured separately and may grant users with more permissions than they deserve. For example, users, who are authorized to enter certain space, may have the opportunity to use the terminals belong to other users in the same space; users can connect the server behind the firewall remotely to bypass the access control lists and access unauthorized services; users can use the assigned passwords to crack similar passwords for other unauthorized services, etc. In a word, if the interdependent relationships are not taken into consideration, users with certain roles would get extra permissions, introducing security vulnerabilities into network systems.To address the above-mentioned issues, this paper proposes a novel role mining framework named as RMMDI from the perspective of network security management. Instead of mining user roles from user-permission assignments, the framework discovers user roles from the fundamental information in multiple domains, including the physical domain, network domain, and digital domain. The framework is aimed at outputting a flat RBAC state that divides user permissions into several disjoint subsets. The user permissions in one set tend to be interdependent while the permissions in different sets tend to be independent. If a permission set is assigned to a user role, a user assigned some roles is unlikely to get extra permissions assigned to other roles. As such, potential security risks involved in the user-permission assignments process can be avoided.The rest of this paper is organized as follows. In Section2, some general works are briefly reviewed. Section 3 presents the proposed framework in detail. Section 4 shows the experimental setup and results, and Section 5 presents a comprehensive discussion. At last, Section 6 provides concluding remarks.


## 2. Related Work

### 2.1. Role Mining

RBAC has become a dominating model for access control in network security. Instead of assigning permissions to the user directly, RBAC introduces the concept of roles to make access control system more compact and comprehensive [6]. A role is defined as a collection of permissions. The key point of RBAC is to generate proper roles. In this process, the bottom-up approach named as role mining gets much more attention than the top-down approach as the latter is time-consuming and human-intensive [3].Kuhlmann et al. first proposed the concept of role mining for finding roles from user-permission assignment data [7]. Traditional role mining approaches are mainly divided into two classes based on their output [5, 8, 9]. The first class is to output a prioritized list of candidate roles, each of which is assigned a priority value. A larger priority value means the role is more important or useful. Complete Miner (CM) and Fast Miner (FM) are two typical algorithms of the first class, which identify overlapping clusters by analyzing the subset enumeration in an unsupervised way [10]. The second class is to output a complete RBAC state under a certain cost. There are also a lot of classic algorithms in the class, for example, OFFIS Role mining tool with Cluster Analysis (ORCA) [11], Hierarchical Miner (HM) [12], Graph Optimization (GO) [13], HP Role Minimization (HPr) [14], and HP Edge Minimization (HPe) [14].Besides those traditional role mining algorithms, there are also many important approaches that emerged in recent years. For example, Frank et al. proposed a probabilistic approach to improve the role mining process by taking account of the business information. The approach utilized the similarity between user-permission relations to detect exceptional assignments and wrong assignments [15]. Besides, entropy-based methods were used in this approach to analyze the impact of business knowledge on role mining [16]. Alessandro et al. presented an approach that allowed role engineers to leverage business information. In the role mining process, the access data was divided into smaller subsets from a business perspective firstly and then traditional methods can be used to discover roles with business meanings [5]. Iran et al. proposed a method based on formal concept lattices to discover roles with semantic meanings [12] as well as a method based on logistic PCA (Principal Component Analysis) to eliminate data noises [17]. Du X and Change X proposed two algorithms based on artificial intelligence, i.e., the genetic algorithm and ant colony optimization algorithm [18]. Dong et al. proposed both fast exact and heuristic methods based on biclique network cover to minimize role number or edge number [19].With regard to goodness measure, several metrics have been proposed in the literature, including minimizing the number of roles [10, 20], minimizing the number of edges [13, 14, 19], minimizing the number of user-role assignment and permission-role assignment relations [13], minimizing both the number of roles and edges [21], and minimizing the administrative cost [22]. These optimization goals can be uniformly represented by the Weighted Structural Complexity (WSC) [8, 9].Although there are a lot of effective role mining approaches, most of them neglect the relationships between user permissions. From the perspective of network security management, user permissions are not independent. A user or potential attacker may get extra permissions from the preassigned permissions, which may introduce fatal risks to network security. Hence, in the framework RMMDI, we model the interrelationships between user permissions from multi-domain configuration information and get more reasonable user roles, mitigating the vulnerabilities and strengthening network security.


### 2.2. Multi-Domain Information Modeling

Traditional network security analysis mainly concentrates on the network domain, with a few concerns on other domains. However, with the deepening of research on insider threat, an increasing number of studies have shown that the attacker will attack the network not only in digital ways, but also through the physical domain and social domain.The existing methods of joint modeling of network multi-domain information mainly define multi-domain information by using the formalized methods and then make inference based on the logical rules to judge whether the system can reach the unsafe state. Probst et al. proposed a formal model for describing scenarios that span the physical and digital domain [23, 24]. Kotenko et al. proposed a model for describing attacks that use social engineering and physical access based on the preconditions and postconditions of atomic actions [25]. Scott et al. built a security model that adds a spatial relationship between the elements in the ambient calculus [26]. Dimkov presented a security model named as Portunes graph to abstract the environment of an organization into a stratified graph, which involved the information in physical, digital, and social domain information [27]. Kammuller and Probst combined formal modeling and analysis of infrastructures of organizations with a sociological explanation to provide a framework for insider threat analysis [28].In this paper, we take possible interaction effects among multi-domain permissions into consideration, which are the basis of similar permission finding and role mining based on multiple domain information.


### 2.3. Multi-View Community Detection

The community is a universal property in many complex networks, which means that network nodes can be divided into small groups [26]. Traditional community detection methods only utilize single network information. And several multiview community detection methods have been proposed, which utilize more information and achieve better performance.Nonnegative Matrix Factorization (NMF) [29] is a classic clustering method, and several multi-view community detection methods based on NMF are proposed. Akata et al. proposed a method to jointly factorize multiple data matrices through a shared coefficient matrix [30]. Liu et al. proposed MultiNMF that regularizes the coefficient matrices learned from different views towards a common consensus for clustering [31]. He et al. extended NMF for multiview clustering by jointly factorizing the multiple matrices through coregularization [32]. Pei et al. proposed a nonnegative matrix tri-factorization (NMTF) based clustering framework with three types of graph regularization [33]. Li et al. proposed a framework based on regularized joint nonnegative matrix factorization (RJNMF) to utilize link and content information jointly to enhance the community detection accuracy [34].In the framework RMMDI, we use the Pairwise Coregularized NMF clustering algorithm proposed in [32] to merge the information from two service networks (views). Experiments show that it can get more information than from a single view and make the role mining results more reasonable.


## 2.1. Role Mining

RBAC has become a dominating model for access control in network security. Instead of assigning permissions to the user directly, RBAC introduces the concept of roles to make access control system more compact and comprehensive [6]. A role is defined as a collection of permissions. The key point of RBAC is to generate proper roles. In this process, the bottom-up approach named as role mining gets much more attention than the top-down approach as the latter is time-consuming and human-intensive [3].Kuhlmann et al. first proposed the concept of role mining for finding roles from user-permission assignment data [7]. Traditional role mining approaches are mainly divided into two classes based on their output [5, 8, 9]. The first class is to output a prioritized list of candidate roles, each of which is assigned a priority value. A larger priority value means the role is more important or useful. Complete Miner (CM) and Fast Miner (FM) are two typical algorithms of the first class, which identify overlapping clusters by analyzing the subset enumeration in an unsupervised way [10]. The second class is to output a complete RBAC state under a certain cost. There are also a lot of classic algorithms in the class, for example, OFFIS Role mining tool with Cluster Analysis (ORCA) [11], Hierarchical Miner (HM) [12], Graph Optimization (GO) [13], HP Role Minimization (HPr) [14], and HP Edge Minimization (HPe) [14].Besides those traditional role mining algorithms, there are also many important approaches that emerged in recent years. For example, Frank et al. proposed a probabilistic approach to improve the role mining process by taking account of the business information. The approach utilized the similarity between user-permission relations to detect exceptional assignments and wrong assignments [15]. Besides, entropy-based methods were used in this approach to analyze the impact of business knowledge on role mining [16]. Alessandro et al. presented an approach that allowed role engineers to leverage business information. In the role mining process, the access data was divided into smaller subsets from a business perspective firstly and then traditional methods can be used to discover roles with business meanings [5]. Iran et al. proposed a method based on formal concept lattices to discover roles with semantic meanings [12] as well as a method based on logistic PCA (Principal Component Analysis) to eliminate data noises [17]. Du X and Change X proposed two algorithms based on artificial intelligence, i.e., the genetic algorithm and ant colony optimization algorithm [18]. Dong et al. proposed both fast exact and heuristic methods based on biclique network cover to minimize role number or edge number [19].With regard to goodness measure, several metrics have been proposed in the literature, including minimizing the number of roles [10, 20], minimizing the number of edges [13, 14, 19], minimizing the number of user-role assignment and permission-role assignment relations [13], minimizing both the number of roles and edges [21], and minimizing the administrative cost [22]. These optimization goals can be uniformly represented by the Weighted Structural Complexity (WSC) [8, 9].Although there are a lot of effective role mining approaches, most of them neglect the relationships between user permissions. From the perspective of network security management, user permissions are not independent. A user or potential attacker may get extra permissions from the preassigned permissions, which may introduce fatal risks to network security. Hence, in the framework RMMDI, we model the interrelationships between user permissions from multi-domain configuration information and get more reasonable user roles, mitigating the vulnerabilities and strengthening network security.


## 2.2. Multi-Domain Information Modeling

Traditional network security analysis mainly concentrates on the network domain, with a few concerns on other domains. However, with the deepening of research on insider threat, an increasing number of studies have shown that the attacker will attack the network not only in digital ways, but also through the physical domain and social domain.The existing methods of joint modeling of network multi-domain information mainly define multi-domain information by using the formalized methods and then make inference based on the logical rules to judge whether the system can reach the unsafe state. Probst et al. proposed a formal model for describing scenarios that span the physical and digital domain [23, 24]. Kotenko et al. proposed a model for describing attacks that use social engineering and physical access based on the preconditions and postconditions of atomic actions [25]. Scott et al. built a security model that adds a spatial relationship between the elements in the ambient calculus [26]. Dimkov presented a security model named as Portunes graph to abstract the environment of an organization into a stratified graph, which involved the information in physical, digital, and social domain information [27]. Kammuller and Probst combined formal modeling and analysis of infrastructures of organizations with a sociological explanation to provide a framework for insider threat analysis [28].In this paper, we take possible interaction effects among multi-domain permissions into consideration, which are the basis of similar permission finding and role mining based on multiple domain information.


## 2.3. Multi-View Community Detection

The community is a universal property in many complex networks, which means that network nodes can be divided into small groups [26]. Traditional community detection methods only utilize single network information. And several multiview community detection methods have been proposed, which utilize more information and achieve better performance.Nonnegative Matrix Factorization (NMF) [29] is a classic clustering method, and several multi-view community detection methods based on NMF are proposed. Akata et al. proposed a method to jointly factorize multiple data matrices through a shared coefficient matrix [30]. Liu et al. proposed MultiNMF that regularizes the coefficient matrices learned from different views towards a common consensus for clustering [31]. He et al. extended NMF for multiview clustering by jointly factorizing the multiple matrices through coregularization [32]. Pei et al. proposed a nonnegative matrix tri-factorization (NMTF) based clustering framework with three types of graph regularization [33]. Li et al. proposed a framework based on regularized joint nonnegative matrix factorization (RJNMF) to utilize link and content information jointly to enhance the community detection accuracy [34].In the framework RMMDI, we use the Pairwise Coregularized NMF clustering algorithm proposed in [32] to merge the information from two service networks (views). Experiments show that it can get more information than from a single view and make the role mining results more reasonable.


## 3. Role Mining Framework Based on Multi-Domain Information

In this paper, we proposed a role mining framework based on the multi-domain information, which is named as RMMDI. The framework is aimed at dividing possible user permissions into several disjoint subsets and assigning each subset to a user role. Then users are assigned with one or more necessary roles according to the permission they deserve. The structure of RMMDI is shown in Figure1. The framework can be divided into three modules: basic information acquisition, relationship network construction, and community detection and role definition.Figure 1
Role mining framework based on multi-domain information.The basic information acquisition module obtains the necessary basic information from the target network, including multi-domain entity information and relationship information. The relationship network construction module constructs eight networks based on the obtained basic information, including the intermediate networks and ultimate networks. The community detection and role definition module detects permission communities on the ultimate networks by a multi-view community detection method and defines possible user roles.


### 3.1. Basic Information Acquisition

The basic information acquisition module is to collect network basic information, including the entities and entity relationships in the physical domain, network domain, and information domain, which are the foundation of relationship network construction.


#### 3.1.1. Entity

There are five kinds of entities involved in the framework, i.e., space, object, service, info, and user.Entity space represents specific physical space such as city, campus, building, or room, which is in the physical domain. All the space entities are represented as a setNS. Entity object is also located at the physical domain and represents network device like router, switch, or terminal. All the object entities are represented as a set NO. Entity service is in the network domain and represents network service like HTTP (Hypertext Transfer Protocol), FTP (File Transfer Protocol), and Email. All the service entities are represented as a set NV. Entity info is in the digital domain and represents the information like password, data, or digital file. All the info entities are represented as a set NI. Entity user represents network user. All the user entities are represented as a set NU.


#### 3.1.2. Relationships

There are seven kinds of relationships involved in the framework, i.e., spatial similarity relationships, containment relationships, service access relationships, local management relationships, remote management relationships, service domination relationships, and info domination relationships.Spatial similarity relationships are described by the matrixMSS∈AS×S, where A={0,1} and S=NS. MSS(i,j) is determined by(1)MSSi,j=1,ifi=jorui,j+uj,i>ε0,otherwisewhereu(i,j) is the number of users who can move from space nsi to space nsj and ε is the threshold value, ranging from 0 to 2NU.Device containment relationships are described by the matrixMOS∈AO×S, where A={0,1}, O=NO, and S=NS. MOS(i,j) is determined by the following.(2)MOSi,j=1,if  objectnoilocatesinspacensj0,otherwiseService access relationships are described by the matrixMVO∈AV×O, where A={0,1}, V=NV, and O=NO. MVO(i,j) is determined by the following.(3)MVOi,j=1,if  servicenvicanbereachbydevicenoj0,otherwiseLocal management relationships are described by the matrixMOV_L∈AO×V, where A={0,1}, O=NO, and V=NV. MOV_L(i,j) is determined by the following.(4)MOV_Li,j=1,if  devicenoicanbemanagedbyservicenvjlocally0,otherwiseRemote management relationships are described by the matrixMOV_R∈AO×V, where A={0,1}, O=NO, and V=NV. MOV_R(i,j) is determined by the following.(5)MOV_Ri,j=1,if  devicenoicanbemanagedbyservicenvjremotely0,otherwiseService domination relationships are described by the matrixMVI∈AV×I, where A={0,1}, V=NV, and I=NI. MVI(i,j) is determined by the following.(6)MVIi,j=1,if  the  password  ofservicenviisnij0,otherwiseInfo domination relationships are described by the matrixMII∈AI×I, where A={0,1} and I=NI. MII(i,j) is determined by(7)MIIi,j=1,ifnij→niiornii→nij0,otherwisewhere symbola→b indicates that information a is dominated by information b. It means there is a service v∈NV, whose password is b and from which the users can get information a.


### 3.2. Relationship Network Construction

The relationship network construction module is to construct basic relationship networks based on the obtained basic information. As shown in Figure2, there are eight networks to be constructed in total. The ultimate goal of this module is to form the Device View Service Network (DVSN), Information View Service Network (IVSN), and Multiview Service Network (MVSN). These three ultimate networks are used in community detection and role definition. Besides the three ultimate networks, there are other five networks involved in user-role mining, which are named as Local Management View Device Network (LMVDN), Remote Management View Device Network (RMVDN), Local Information View Device Network (LIVDN), Remote Information View Device Network (RIVDN), and Multiview Device Network (MVDN). The five intermediate networks are the foundation to construct ultimate networks. The meanings of intermediate networks and ultimate networks are described as follows.Figure 2
Relationship networks constructed in RMMDI.


#### 3.2.1. Intermediate Networks

The five intermediate networks are described as undirected weighted graphs, whose adjacency matrices are constructed from the seven basic relationship matrices.LMVDN. The LMVDN represents the similarity between devices from a spatial (local management) perspective, which means the devices located at similarity spaces are more similar than others. The network is represented by the adjacency matrix AOO_S, whose values represent the similarity of two devices. The matrix is determined by the following.(8)AOO_S=MOSMSSMOSTRMVDN. The RMVDN represents the similarity between devices from a remote management perspective, which means the devices that can be managed by similar management services are more similar than others. The network is represented by the adjacency matrix AOO_R, whose values represent the similarity of two devices. The matrix is determined by the following.(9)AOO_R=MO_VRMVO+MO_VRMVOTLIVDN. The LIVDN represents the similarity between devices from the perspective of local management service password, which means the devices with similar local management service password are more similar than others. The network is represented by the adjacency matrix AOO_IL, whose values represent the similarity of two devices. The matrix is determined by the following.(10)AOO_IL=MOV_LMVIMIIMOV_LMVITRIVDN. The RIVDN represents the similarity between devices from the perspective of remote management service password, which means the devices with similar remote management service password are more similar than others. The network is represented by the adjacency matrix AOO_IR, whose values represent the similarity of two devices. The matrix is determined by the following.(11)AOO_IR=MOV_RMVIMIIMOV_RMVITMVDN. The MVDN represents the similarity between devices from multiple perspectives, which merges the relationships from the local management perspective and the remote management perspective. The network is represented by the adjacency matrix AOO, whose values represent the similarity of two devices. The matrix is determined by(12)AOO=AOO_S·AOO_IL+AOO_R·AOO_IRwhere the symbol· means dot product of two matrices.


#### 3.2.2. Ultimate Networks

The three ultimate networks are also described as undirected weighted graphs, whose adjacency matrices are constructed from the seven basic relationship matrices and five intermediate networks.DVSN. The DVSN represents the similarity of service permissions from a device perspective, which means the services accessed by similar devices are more similar than others. The network is represented by the adjacency matrix AVV_D, whose values represent the similarity of two devices. The matrix is determined by (13)AVV_D∗=MVOAOOMVOT(14)AVV_D=relationFilterAVV_D∗,λwhererelationFilter(G,λ) is the function of filtering edges from the original graph, whose parameter G is the original graph and λ is the ratio of edges to be reserved.As the matrixAVV_D∗ is a fully connected matrix in which the edges with small weight have negative impacts on community results, we use a function relationFilter(G,λ) to filter the low weight edges from the network. In function relationFilter(G,λ), for any node n in the graph G, we only reserve the top λ×edgeNum(n) edges with the largest weight. If two edges have the same weight, we reserve the edge between the node n and the neighbor node with a higher degree.IVSN. The IVSN represents the similarity of service permissions from an information perspective, which means the services with a similar password are more similar than others. The network is represented by the adjacency matrix AVV_I, whose values represent the similarity of two devices. The matrix is determined by (15)AVV_I=relationFilterMVIAIIMVIT,λwhererelationFilter(G,λ) is the same edges filtering function in formula (14).MVSN. The MVSN represents the similarity of service permissions from multiple perspectives, which merges the similarity relationships from the device perspective and the information perspective. The network is represented by the adjacency matrix AVV, whose values represent the similarity of two devices. The matrix is determined by the following.(16)AVV=AVV_D+AVV_I


### 3.3. Community Discovery and User-Role Definition

After building the ultimate networks, services can be divided into community relations through multi-view clustering algorithm, where all service permissions are divided into a community divisionC={c1,c2,⋯,ck}. Then, for each ci∈C, a role can be defined correspondingly. In this way, all network service permissions can be naturally assigned to k classes, where the possible values of k can be determined through algorithms such as maximum module degree.In multiview service community discovery, we use the Pairwise Coregularized NMF clustering algorithm (PCoNMF) proposed in [32], which is based on regularized joint NMF. The objective function of service community discovery is formulated as follows.(17)J=λDAVV_D-WVV_DHVV_DTF2+λIAVV_I-WVV_IHVV_ITF2+λDIWVV_D-WVV_IF2s.t.HVV_D≥0,HVV_I≥0The hypothesis behind PCoNMF is to regularize the coefficient matrices of the different views to a common consensus, which is then used for clustering. PCoNMF also adopts alternating optimization to minimize the objective function. The optimization works as follows:(1) fix the value of WVV_D and WVV_I while minimizing J over HVV_D and HVV_I; then (2) fix the value of HVV_D and HVV_I while minimizing J over WVV_D and WVV_I. We repeat the two steps until the iteration threshold is achieved.According to [32], the update rules are as follows.(18)HVV_D←HVV_D·WVV_DTAVV_DWVV_DTWVV_DAVV_D(19)HVV_I←HVV_I·WVV_ITAVV_IWVV_ITWVV_IAVV_I(20)WVV_D←WVV_D·λDAVV_DHVV_DT+λDIWVV_IλDWVV_DHVV_DHVV_DT+λDIWVV_D(21)WVV_I←WVV_I·λIAVV_IHVV_IT+λDIWVV_DλIWVV_IHVV_IHVV_IT+λDIWVV_IHence, the permission community detection algorithm is shown as Algorithm1.Algorithm 1:Permission community detection algorithm (PCDA).
Input:nonnegative matrices AVV_D, AVV_I. number of communities k, parameters λD,λI,λDI Output:Service Community Division C={c1,c2,⋯,ck}. ( 1 )  Initialize WVV_D≥0, HVV_D≥0, WVV_I≥0, HVV_I≥0 ( 2 )  While Objective function does not converge and the Number of iterations is less than Threshold do ( 3 ) Update HVV_D according to Formula (18) ( 4 ) Update HVV_I according to Formula (19) ( 5 ) Update WVV_D according to Formula (20) ( 6 ) Update WVV_I according to Formula (21) ( 7 )  end while ( 8 )  Divide nodes to communities division C={c1,c2,⋯,ck} according to the coefficient matrix WVV_D ( 9 )  return  C={c1,c2,⋯,ck}


## 3.1. Basic Information Acquisition

The basic information acquisition module is to collect network basic information, including the entities and entity relationships in the physical domain, network domain, and information domain, which are the foundation of relationship network construction.


### 3.1.1. Entity

There are five kinds of entities involved in the framework, i.e., space, object, service, info, and user.Entity space represents specific physical space such as city, campus, building, or room, which is in the physical domain. All the space entities are represented as a setNS. Entity object is also located at the physical domain and represents network device like router, switch, or terminal. All the object entities are represented as a set NO. Entity service is in the network domain and represents network service like HTTP (Hypertext Transfer Protocol), FTP (File Transfer Protocol), and Email. All the service entities are represented as a set NV. Entity info is in the digital domain and represents the information like password, data, or digital file. All the info entities are represented as a set NI. Entity user represents network user. All the user entities are represented as a set NU.


### 3.1.2. Relationships

There are seven kinds of relationships involved in the framework, i.e., spatial similarity relationships, containment relationships, service access relationships, local management relationships, remote management relationships, service domination relationships, and info domination relationships.Spatial similarity relationships are described by the matrixMSS∈AS×S, where A={0,1} and S=NS. MSS(i,j) is determined by(1)MSSi,j=1,ifi=jorui,j+uj,i>ε0,otherwisewhereu(i,j) is the number of users who can move from space nsi to space nsj and ε is the threshold value, ranging from 0 to 2NU.Device containment relationships are described by the matrixMOS∈AO×S, where A={0,1}, O=NO, and S=NS. MOS(i,j) is determined by the following.(2)MOSi,j=1,if  objectnoilocatesinspacensj0,otherwiseService access relationships are described by the matrixMVO∈AV×O, where A={0,1}, V=NV, and O=NO. MVO(i,j) is determined by the following.(3)MVOi,j=1,if  servicenvicanbereachbydevicenoj0,otherwiseLocal management relationships are described by the matrixMOV_L∈AO×V, where A={0,1}, O=NO, and V=NV. MOV_L(i,j) is determined by the following.(4)MOV_Li,j=1,if  devicenoicanbemanagedbyservicenvjlocally0,otherwiseRemote management relationships are described by the matrixMOV_R∈AO×V, where A={0,1}, O=NO, and V=NV. MOV_R(i,j) is determined by the following.(5)MOV_Ri,j=1,if  devicenoicanbemanagedbyservicenvjremotely0,otherwiseService domination relationships are described by the matrixMVI∈AV×I, where A={0,1}, V=NV, and I=NI. MVI(i,j) is determined by the following.(6)MVIi,j=1,if  the  password  ofservicenviisnij0,otherwiseInfo domination relationships are described by the matrixMII∈AI×I, where A={0,1} and I=NI. MII(i,j) is determined by(7)MIIi,j=1,ifnij→niiornii→nij0,otherwisewhere symbola→b indicates that information a is dominated by information b. It means there is a service v∈NV, whose password is b and from which the users can get information a.


## 3.1.1. Entity

There are five kinds of entities involved in the framework, i.e., space, object, service, info, and user.Entity space represents specific physical space such as city, campus, building, or room, which is in the physical domain. All the space entities are represented as a setNS. Entity object is also located at the physical domain and represents network device like router, switch, or terminal. All the object entities are represented as a set NO. Entity service is in the network domain and represents network service like HTTP (Hypertext Transfer Protocol), FTP (File Transfer Protocol), and Email. All the service entities are represented as a set NV. Entity info is in the digital domain and represents the information like password, data, or digital file. All the info entities are represented as a set NI. Entity user represents network user. All the user entities are represented as a set NU.


## 3.1.2. Relationships

There are seven kinds of relationships involved in the framework, i.e., spatial similarity relationships, containment relationships, service access relationships, local management relationships, remote management relationships, service domination relationships, and info domination relationships.Spatial similarity relationships are described by the matrixMSS∈AS×S, where A={0,1} and S=NS. MSS(i,j) is determined by(1)MSSi,j=1,ifi=jorui,j+uj,i>ε0,otherwisewhereu(i,j) is the number of users who can move from space nsi to space nsj and ε is the threshold value, ranging from 0 to 2NU.Device containment relationships are described by the matrixMOS∈AO×S, where A={0,1}, O=NO, and S=NS. MOS(i,j) is determined by the following.(2)MOSi,j=1,if  objectnoilocatesinspacensj0,otherwiseService access relationships are described by the matrixMVO∈AV×O, where A={0,1}, V=NV, and O=NO. MVO(i,j) is determined by the following.(3)MVOi,j=1,if  servicenvicanbereachbydevicenoj0,otherwiseLocal management relationships are described by the matrixMOV_L∈AO×V, where A={0,1}, O=NO, and V=NV. MOV_L(i,j) is determined by the following.(4)MOV_Li,j=1,if  devicenoicanbemanagedbyservicenvjlocally0,otherwiseRemote management relationships are described by the matrixMOV_R∈AO×V, where A={0,1}, O=NO, and V=NV. MOV_R(i,j) is determined by the following.(5)MOV_Ri,j=1,if  devicenoicanbemanagedbyservicenvjremotely0,otherwiseService domination relationships are described by the matrixMVI∈AV×I, where A={0,1}, V=NV, and I=NI. MVI(i,j) is determined by the following.(6)MVIi,j=1,if  the  password  ofservicenviisnij0,otherwiseInfo domination relationships are described by the matrixMII∈AI×I, where A={0,1} and I=NI. MII(i,j) is determined by(7)MIIi,j=1,ifnij→niiornii→nij0,otherwisewhere symbola→b indicates that information a is dominated by information b. It means there is a service v∈NV, whose password is b and from which the users can get information a.


## 3.2. Relationship Network Construction

The relationship network construction module is to construct basic relationship networks based on the obtained basic information. As shown in Figure2, there are eight networks to be constructed in total. The ultimate goal of this module is to form the Device View Service Network (DVSN), Information View Service Network (IVSN), and Multiview Service Network (MVSN). These three ultimate networks are used in community detection and role definition. Besides the three ultimate networks, there are other five networks involved in user-role mining, which are named as Local Management View Device Network (LMVDN), Remote Management View Device Network (RMVDN), Local Information View Device Network (LIVDN), Remote Information View Device Network (RIVDN), and Multiview Device Network (MVDN). The five intermediate networks are the foundation to construct ultimate networks. The meanings of intermediate networks and ultimate networks are described as follows.Figure 2
Relationship networks constructed in RMMDI.


### 3.2.1. Intermediate Networks

The five intermediate networks are described as undirected weighted graphs, whose adjacency matrices are constructed from the seven basic relationship matrices.LMVDN. The LMVDN represents the similarity between devices from a spatial (local management) perspective, which means the devices located at similarity spaces are more similar than others. The network is represented by the adjacency matrix AOO_S, whose values represent the similarity of two devices. The matrix is determined by the following.(8)AOO_S=MOSMSSMOSTRMVDN. The RMVDN represents the similarity between devices from a remote management perspective, which means the devices that can be managed by similar management services are more similar than others. The network is represented by the adjacency matrix AOO_R, whose values represent the similarity of two devices. The matrix is determined by the following.(9)AOO_R=MO_VRMVO+MO_VRMVOTLIVDN. The LIVDN represents the similarity between devices from the perspective of local management service password, which means the devices with similar local management service password are more similar than others. The network is represented by the adjacency matrix AOO_IL, whose values represent the similarity of two devices. The matrix is determined by the following.(10)AOO_IL=MOV_LMVIMIIMOV_LMVITRIVDN. The RIVDN represents the similarity between devices from the perspective of remote management service password, which means the devices with similar remote management service password are more similar than others. The network is represented by the adjacency matrix AOO_IR, whose values represent the similarity of two devices. The matrix is determined by the following.(11)AOO_IR=MOV_RMVIMIIMOV_RMVITMVDN. The MVDN represents the similarity between devices from multiple perspectives, which merges the relationships from the local management perspective and the remote management perspective. The network is represented by the adjacency matrix AOO, whose values represent the similarity of two devices. The matrix is determined by(12)AOO=AOO_S·AOO_IL+AOO_R·AOO_IRwhere the symbol· means dot product of two matrices.


### 3.2.2. Ultimate Networks

The three ultimate networks are also described as undirected weighted graphs, whose adjacency matrices are constructed from the seven basic relationship matrices and five intermediate networks.DVSN. The DVSN represents the similarity of service permissions from a device perspective, which means the services accessed by similar devices are more similar than others. The network is represented by the adjacency matrix AVV_D, whose values represent the similarity of two devices. The matrix is determined by (13)AVV_D∗=MVOAOOMVOT(14)AVV_D=relationFilterAVV_D∗,λwhererelationFilter(G,λ) is the function of filtering edges from the original graph, whose parameter G is the original graph and λ is the ratio of edges to be reserved.As the matrixAVV_D∗ is a fully connected matrix in which the edges with small weight have negative impacts on community results, we use a function relationFilter(G,λ) to filter the low weight edges from the network. In function relationFilter(G,λ), for any node n in the graph G, we only reserve the top λ×edgeNum(n) edges with the largest weight. If two edges have the same weight, we reserve the edge between the node n and the neighbor node with a higher degree.IVSN. The IVSN represents the similarity of service permissions from an information perspective, which means the services with a similar password are more similar than others. The network is represented by the adjacency matrix AVV_I, whose values represent the similarity of two devices. The matrix is determined by (15)AVV_I=relationFilterMVIAIIMVIT,λwhererelationFilter(G,λ) is the same edges filtering function in formula (14).MVSN. The MVSN represents the similarity of service permissions from multiple perspectives, which merges the similarity relationships from the device perspective and the information perspective. The network is represented by the adjacency matrix AVV, whose values represent the similarity of two devices. The matrix is determined by the following.(16)AVV=AVV_D+AVV_I


## 3.2.1. Intermediate Networks

The five intermediate networks are described as undirected weighted graphs, whose adjacency matrices are constructed from the seven basic relationship matrices.LMVDN. The LMVDN represents the similarity between devices from a spatial (local management) perspective, which means the devices located at similarity spaces are more similar than others. The network is represented by the adjacency matrix AOO_S, whose values represent the similarity of two devices. The matrix is determined by the following.(8)AOO_S=MOSMSSMOSTRMVDN. The RMVDN represents the similarity between devices from a remote management perspective, which means the devices that can be managed by similar management services are more similar than others. The network is represented by the adjacency matrix AOO_R, whose values represent the similarity of two devices. The matrix is determined by the following.(9)AOO_R=MO_VRMVO+MO_VRMVOTLIVDN. The LIVDN represents the similarity between devices from the perspective of local management service password, which means the devices with similar local management service password are more similar than others. The network is represented by the adjacency matrix AOO_IL, whose values represent the similarity of two devices. The matrix is determined by the following.(10)AOO_IL=MOV_LMVIMIIMOV_LMVITRIVDN. The RIVDN represents the similarity between devices from the perspective of remote management service password, which means the devices with similar remote management service password are more similar than others. The network is represented by the adjacency matrix AOO_IR, whose values represent the similarity of two devices. The matrix is determined by the following.(11)AOO_IR=MOV_RMVIMIIMOV_RMVITMVDN. The MVDN represents the similarity between devices from multiple perspectives, which merges the relationships from the local management perspective and the remote management perspective. The network is represented by the adjacency matrix AOO, whose values represent the similarity of two devices. The matrix is determined by(12)AOO=AOO_S·AOO_IL+AOO_R·AOO_IRwhere the symbol· means dot product of two matrices.


## 3.2.2. Ultimate Networks

The three ultimate networks are also described as undirected weighted graphs, whose adjacency matrices are constructed from the seven basic relationship matrices and five intermediate networks.DVSN. The DVSN represents the similarity of service permissions from a device perspective, which means the services accessed by similar devices are more similar than others. The network is represented by the adjacency matrix AVV_D, whose values represent the similarity of two devices. The matrix is determined by (13)AVV_D∗=MVOAOOMVOT(14)AVV_D=relationFilterAVV_D∗,λwhererelationFilter(G,λ) is the function of filtering edges from the original graph, whose parameter G is the original graph and λ is the ratio of edges to be reserved.As the matrixAVV_D∗ is a fully connected matrix in which the edges with small weight have negative impacts on community results, we use a function relationFilter(G,λ) to filter the low weight edges from the network. In function relationFilter(G,λ), for any node n in the graph G, we only reserve the top λ×edgeNum(n) edges with the largest weight. If two edges have the same weight, we reserve the edge between the node n and the neighbor node with a higher degree.IVSN. The IVSN represents the similarity of service permissions from an information perspective, which means the services with a similar password are more similar than others. The network is represented by the adjacency matrix AVV_I, whose values represent the similarity of two devices. The matrix is determined by (15)AVV_I=relationFilterMVIAIIMVIT,λwhererelationFilter(G,λ) is the same edges filtering function in formula (14).MVSN. The MVSN represents the similarity of service permissions from multiple perspectives, which merges the similarity relationships from the device perspective and the information perspective. The network is represented by the adjacency matrix AVV, whose values represent the similarity of two devices. The matrix is determined by the following.(16)AVV=AVV_D+AVV_I


## 3.3. Community Discovery and User-Role Definition

After building the ultimate networks, services can be divided into community relations through multi-view clustering algorithm, where all service permissions are divided into a community divisionC={c1,c2,⋯,ck}. Then, for each ci∈C, a role can be defined correspondingly. In this way, all network service permissions can be naturally assigned to k classes, where the possible values of k can be determined through algorithms such as maximum module degree.In multiview service community discovery, we use the Pairwise Coregularized NMF clustering algorithm (PCoNMF) proposed in [32], which is based on regularized joint NMF. The objective function of service community discovery is formulated as follows.(17)J=λDAVV_D-WVV_DHVV_DTF2+λIAVV_I-WVV_IHVV_ITF2+λDIWVV_D-WVV_IF2s.t.HVV_D≥0,HVV_I≥0The hypothesis behind PCoNMF is to regularize the coefficient matrices of the different views to a common consensus, which is then used for clustering. PCoNMF also adopts alternating optimization to minimize the objective function. The optimization works as follows:(1) fix the value of WVV_D and WVV_I while minimizing J over HVV_D and HVV_I; then (2) fix the value of HVV_D and HVV_I while minimizing J over WVV_D and WVV_I. We repeat the two steps until the iteration threshold is achieved.According to [32], the update rules are as follows.(18)HVV_D←HVV_D·WVV_DTAVV_DWVV_DTWVV_DAVV_D(19)HVV_I←HVV_I·WVV_ITAVV_IWVV_ITWVV_IAVV_I(20)WVV_D←WVV_D·λDAVV_DHVV_DT+λDIWVV_IλDWVV_DHVV_DHVV_DT+λDIWVV_D(21)WVV_I←WVV_I·λIAVV_IHVV_IT+λDIWVV_DλIWVV_IHVV_IHVV_IT+λDIWVV_IHence, the permission community detection algorithm is shown as Algorithm1.Algorithm 1:Permission community detection algorithm (PCDA).
Input:nonnegative matrices AVV_D, AVV_I. number of communities k, parameters λD,λI,λDI Output:Service Community Division C={c1,c2,⋯,ck}. ( 1 )  Initialize WVV_D≥0, HVV_D≥0, WVV_I≥0, HVV_I≥0 ( 2 )  While Objective function does not converge and the Number of iterations is less than Threshold do ( 3 ) Update HVV_D according to Formula (18) ( 4 ) Update HVV_I according to Formula (19) ( 5 ) Update WVV_D according to Formula (20) ( 6 ) Update WVV_I according to Formula (21) ( 7 )  end while ( 8 )  Divide nodes to communities division C={c1,c2,⋯,ck} according to the coefficient matrix WVV_D ( 9 )  return  C={c1,c2,⋯,ck}


## 4. Experiments and Results

In this section, we evaluate our role mining method based on the multi-domain information of a simulated network, which is the simplification of the inner network of Corporation M.


### 4.1. Experiment Environment

We built a simulation network for experiments, including a router, a firewall, an Intrusion Prevention System (IPS), 3 switches (Switch1, Switch2, and Switch3), 6 servers (WServer, DServer, FServer, GServer, OServer, and IServer), 3 gate machines (GM1, GM2, and GM3), and 13 terminals (T1, T2, T3, …, T13). We used a HUAWEI S7706 as the core router, three HUAWEI S5700 as switches, a TOPSEC NGFW 4000-UF as the firewall, a TOPSEC IDP 3000 as IPS, and computers from Dell and HP as the servers or terminals. The router enabled 3-layer routing and the firewall were configured with bidirectional access control lists. All the servers and terminals were installed with different versions of Windows, including Windows 2003 Server, Windows XP, and Windows 7. We deployed an entrance guard system including 3 gate machines and a server (GServer). The gate machines used face recognition technology to determine whether a person can pass or not. An office automation system was deployed on the OServer, whose database was deployed on the DServer. We also deployed two websites and an FTP using IIS (Internet Information Services) on WServer, IServer, and FServer. Similarly, the websites depended on the same database deployed on DServer. The physical link relationships among devices are shown in Figure3.Figure 3
An example network.All the devices are distributed in 12 rooms in 3 buildings. 10 devices are located in building 1: terminal T1, T2, and T3 are in room 1-1; T4 and T5 are in room 1-4; T6 and T7 are in room 1-5; Switch1 is in room 1-2; and GM1 is in the hall of building 1 (room 1-3). 8 devices are located in building 2: terminals T8 and T9 are in room 2-1; T10 and T11 are in room 2-4; T12 and T13 are in room 2-5; Switch2 is in room 2-2; and GM2 is in the hall of building 2 (room 2-3). 10 devices are located in building 3: router, firewall, IPS, Switch3, and all servers are in room 3-1, and GM3 is in the hall of building 3 (room 3-2).There were 34 services in the network, including 28 management services and 6 business services. The management services were used for device management, while the business services were used for corporation business. Each device was managed by a management service. The router and switches enabled SSH service. The servers and terminals enabled the Remote Desktop Service. In addition, the gate machines enabled web-based management interfaces. The website deployed on WServer provided a web service on port 80 named as WS_W, which was used to publish public information. The FServer provided an FTP service on port 21 named as FS_F, which was used by Network Administrators to share information. The GServer provided a data transmission service on port 8080 named as GS_T, which was used to synchronize data between GM machine and GServer. The OServer provided a web service on port 80 named as OS_W, which was used to document circulation for all users. The IServer provided a web service on port 80 named as IS_W, which was used by Server Administrators to share information. The DServer provided a database service on port 1433 named as DS_D, which was used to provide underlying support for WS_W, OS_W, and IS_W.There were 33 passwords in the analysis. Each service, except for WS_W and OS_W, has a password. Besides,NULL was added to represent the empty password. All the information involved is shown in Table 1.Table 1
Device related information.
Device Location Services Password Device Location Services Password T1 R1-1 T1_M T1_M_P GM2 R2-3 G2_M G2_M_P  T2 R1-1 T2_M T2_M_P GM3 R3-2 G3_M G3_M_P  T3 R1-1 T3_M T3_M_P Switch1 R1-2 S1_M S1_M_P  T4 R1-4 T4_M T4_M_P Switch2 R2-2 S2_M S2_M_P  T5 R1-4 T5_M T5_M_P Switch3 R3-1 S3_M S3_M_P  T6 R1-5 T6_M T6_M_P Router R3-1 R_M R_M_P  T7 R1-5 T7_M T7_M_P Firewall R3-1 F_M F_M_P  T8 R2-1 T8_M T8_M_P IPS R3-1 IPS_M IPS_M_P  T9 R2-1 T9_M T9_M_P WServer R3-1 WS_W - - WS_M WS_M_P  T10 R2-4 T10_M T10_M_P DServer R3-1 DS_D DS_D_P DS_M DS_M_P  T11 R2-4 T11_M T11_M_P FServer R3-1 FS_F FS_F_P FS_M FS_M_P  T12 R2-5 T12_M T12_M_P GServer R3-1 GS_T GS_T_P GS_M GS_M_P  T13 R2-5 T13_M T13_M_P OServer R3-1 OS_W -- OS_M OS_M_P  GM1 R1-3 G1_M G1_M_P IServer R3-1 IS_W IS_W_P IS_M IS_M_PThere were 13 users involved in analysis named from User1 to User13, who used terminals T1 to T13 and knew passwords T1_M_P to T13_M_P, respectively. Using the top-down approaches, the network security administrators had gotten 5 user roles for the business information, which were named as Ordinary User, Server Administrator, Database Administrator, Network Administrator, and Security Administrator. The role-permission assignments are listed in Table2.Table 2
User role-permission assignments by top-down methods.
Roles Service Permissions Ordinary User WS_W, OS_W  Server Administrator WS_M, FS_M, GS_M, OS_M, IS_M, DS_M, IS_W  Database Administrator DS_D  Network Administrator S1_M, S2_M,S3_M, R_M, FS_F  Security Administrator F_M, IPS_M, G1_M, G2_M, G3_M, GS_T


### 4.2. Baseline Methods

To demonstrate the effectiveness of our method, we compare our approach with two groups of baselines. The first group comprises 5 clustering methods: 2 single view methods and 3 multiview methods. The second group comprises 4 traditional role mining methods: ORCA (OFFIS Role mining tool with Cluster Analysis), CM (Complete Miner), HPr (HP Role Minimization), and HPe (HP Edge Minimization)


#### 4.2.1. Clustering Methods

SP (Spectral Clustering). SP [35] is a classical single view clustering algorithm, which makes use of the eigenvalues of the data similarity matrix to perform dimensionality reduction before clustering in fewer dimensions. The similarity matrix is provided as an input, consisting of a quantitative assessment of the relative similarity of each pair of points in the dataset.SymNMF. SymNMF [36] is a clustering algorithm based on NMF, which takes a nonnegative and symmetric matrix as an input. The matrix contains pairwise similarity values of a similarity graph and is approximated by a lower rank matrix instead of the product of two lower rank matrices.PCoSpec (Pairwise Coregularized Spectral clustering) and CCoSpec (Center-wise Coregularized Spectral clustering). Two coregularization schemes are adopted in spectral clustering framework [37], PCoSpec utilizes a pairwise coregularization to enforce the eigenvectors of each pair to be similar, and CCoSpec employs the centroid-based coregularization to enforce the eigenvectors to be similar with a common center.CCoNMF (Cluster-wise Coregularized NMF clustering). CCoNMF extends NMF for multiview clustering by jointly factorizing the multiple matrices through cluster-wise coregularization [32], which enforces the cluster similarity matrices to be similar.RMSC (Robust Multiview Spectral Clustering). RMSC [38] is a multiview spectral clustering method based on Markov chain, which explicitly handles the possible noise in the transition probability matrices associated with different views.


#### 4.2.2. Mining Baseline Methods

ORCA. ORCA [11] is the first role mining algorithm, which uses the hierarchical clustering technology to discover user roles. The algorithm defines each permission as an initial cluster first, then merges the clusters, and forms a role hierarchy.Complete Miner (CM). CM [10] is another classic role mining algorithm proposed in 2006. It starts by creating an initial set of roles for the distinct user-permission sets, then computes all possible intersection sets of the initial roles, and outputs a list of candidate roles.HP Role Minimization and HP Edge Minimization. HP Role Minimization (HPr) and HP Edge Minimization (HPe) [14] are the role mining algorithms based on minimum biclique coverage. HPr tries to find a minimal set of roles that override the user-permission assignment relationship, while HPe uses a heuristic method to find the smallest number of edges of an RBAC system.


### 4.3. Experiments Setup

#### 4.3.1. Scenarios Construction

To validate our framework and method, we built 3 scenarios named as Scenario1 (S1), Scenario2 (S2), and Scenario3 (S3) based on the basic experimental environment shown in Figure3 and assigned users one or more user roles, which is shown in Table 3. We can find out that each user in S1 was assigned only 1 user role, while they were assigned 2 user roles in S2. In S3, users working in one room may be assigned different user roles, which may introduce more vulnerabilities to network security.Table 3
User-role assignments in different scenario.
Scenario OrdinaryUser ServerAdministrator Database Administrator NetworkAdministrator SecurityAdministrator S1 User1, User2,User3 User4, User5 User6, User7 User8, User9, User10,User11 User12, User13  S2 All Users User7, User8 User11, User12, User13 User4, User5 User9, User10  S3 User1, User2, User5, User6, User9, User10, User13 User4, User7 User8 User11 User12For each scenario, we first configured the gate machines and firewall according to Tables2 and 3. Spatial access control lists were added on gate machines, making users have physical access to devices they managed or used, while network access control lists were added on the firewall, making the terminals have network access to the target services.It should be noted that there were potential conflicts among multi-domain configurations on the semantic level. Take the user User4 in S1 as example. User4 was a Server Administrator and should not access service DS_M and the firewall had forbidden T4 to access service DS_D directly, but T4 was permitted to access service WS_M and there was no firewall between WServer and DServer. Thus, User4 can use T4 to log in WServer remotely first and then access service DS_D (he can get the password DS_D_P from the configuration files on WServer). This is a typical semantic conflict between the network access control lists. Similarly, as User4 had the ability to access DS_D physically by entering the room 3-1, there is another conflict between the network access control list and the spatial access control list. Those conflicts may result in extra permissions for users.Then, we extracted basic information from the network and established the necessary relationship matrices. Note that there were 16 space entities, 28 object entities, 34 service entities, 32 information entities, and 13 user entities in all the 3 scenarios. The relationship matricesMOS∈R28×16, MVI∈R34×32, MOV_L∈R28×34, and MOV_R∈R28×34 were the same in all three scenarios, where MOS0=|MOV_L|0=|MOV_R|0=28 and |MVI|0=34. The matrices MSS∈R16×16 and MVO∈R34×28 varied from scenario to scenario, depending on the configurations of gate machines or firewall. For each space pair (S1,S2), we counted the users who can move from S1 to S2 under each scenario and set the parameter ε=14 when constructing the matrix MSS. The results showed that |MSS|0=46 in S1, |MSS|0=46 in S2, and |MSS|0=42 in S3. We used the scanner NMAP to get the accessibility relationships between devices and services, establishing the matrix MVO. The results showed that |MVO|0=549 in S1, |MVO|0=566 in S2, and |MSS|0=548 in S3.Finally, we detected the user roles by RMMDI and compared the results with the two groups of baseline methods. On the one hand, we performed the role mining baseline methods based on the user-permission assignment (UPA) matrices constructed from the firewall configurations and compared the results with RMMDI. On the other hand, we studied the best parameters for each clustering method and then compared the effectiveness of RMMDI with the clustering baseline methods. Accuracy and normalized mutual information (NMI) [31–33, 36] were adopted to evaluate the community detection effectiveness of different parameters, whose values both range from 0 to 1 and a higher value means better effectiveness. We calculated the accuracy and NMI of different clustering methods with ground truth after studying the best parameters for each clustering method. In the experiments, we constructed two ground truths manually. In one ground truth, we divided 21 service permissions into 5 roles according to Table 2. In the other ground truth, we combined the roles “Database Administrator” with “Server Administrator” and classified 21 service permissions into 4 roles. For one community detection result, we compared it with the two ground truths and calculated metrics separately.


### 4.4. Result

#### 4.4.1. Role Mining Results

Firstly, we performed the baseline role mining methods based on the firewall configurations. As the firewall only conducted the network access control lists, it can only reflect the accessibility between devices and services. Since each terminal was assigned to a user, we can get the 3 different UPA matrices from it. As we wanted to find disjoint service subnets, we usedW=1,1,1,∞,∞ as the optimization objective. In order to save space, only the permission divisions are shown in Table 4. We found that the permission divisions were almost the same as those in Table 2, which meant that the role mining methods can find no errors from the top-down approach.Table 4
Role mining results of baselines on all scenarios.
Scenario Method Role Permissions S1 ORCACMHPrHPe Role1 WS_W, OS_W Role2 WS_M, FS_M, GS_M, OS_M, IS_M, DS_M, IS_W Role3 DS_D Role4 S1_M, S2_M,S3_M, R_M, FS_F Role5 F_M, IPS_M, GS_T  S2 HPr Role1 WS_W, OS_W Role2 WS_W, OS_W, WS_M, FS_M, GS_M, OS_M, IS_M, DS_M, IS_W Role3 WS_W, OS_W, DS_D Role4 WS_W, OS_W, S1_M, S2_M, S3_M, R_M, FS_F Role5 WS_W, OS_W, F_M, IPS_M, GS_T  S2 ORCACMHPe Role1 WS_W, OS_W Role2 WS_M, FS_M, GS_M, OS_M, IS_M, DS_M, IS_W Role3 WS_W, OS_W, DS_D Role4 S1_M, S2_M, S3_M, R_M, FS_F Role5 F_M, IPS_M, GS_T  S3 ORCACMHPrHPe Role1 WS_W, OS_W Role2 WS_M, FS_M, GS_M, OS_M, IS_M, DS_M, IS_W Role3 DS_D Role4 S1_M, S2_M,S3_M, R_M, FS_F Role5 F_M, IPS_M, GS_TThen, we also performed the RMMDI on all scenarios with the role numberk=5,100 times for each scenario. The majority of the results were different from the result shown in Table 2. The most frequent result (222 in 300 times) is listed as Table 5. Comparing with Table 2, we counted the number of inconsistent classification results of each service. All 18 services were classified inconsistently for 572 times in total. And the top 2 services with the most inconsistent classification times were DS_D (282 times) and GS_T (258 times).Table 5
The most common result of RMMDI when k=5.
Method Role Permissions RMMDI Role1 WS_W, OS_W Role2 WS_M, FS_M, GS_M, OS_M, IS_M, DS_M, IS_W, DS_D Role3 GS_T Role4 S1_M, S2_M,S3_M, R_M, FS_F Role5 F_M, IPS_MFinally, we changed the role numberk=4 and performed the experiments 100 times under each scenario. The most common results are shown in Table 6.Table 6
The most common result of RMMDI when k=4.
Method Role Permissions RMMDI Role1 WS_W, OS_W Role2 WS_M, FS_M, GS_M, OS_M, IS_M, DS_M, IS_W, DS_D Role3 S1_M, S2_M,S3_M, R_M, FS_F Role4 F_M, IPS_M, GS_T


#### 4.4.2. Parameter Study Results

We studied the parameters used in RMMDI as well as the baseline clustering methods. We performed a series of experiments for a series of different parameters and tried to find out the optimal parameters. The experiments were conducted under S2 with role numberk=4.We first studied the parameters used in baseline methods, includingλp_spec in PCoSpec, λc_spec_D and λc_spec_I in CCoSpec, and λrmsc in RMSC. With each parameter, we set λ=0.05 and studied 30 different values between 0.005 and 100. When λp_spec=0.15, λc_spec_D=8, λc_spec_I=1, and λrmsc=0.15, the methods had relatively better effectiveness on the dataset.Then, we studied the parameters in PCoNMF and CCoNMF. There are 3 parameters:λD, λI, and λDI. λD and λI represent the weights of view AVV_D and AVV_I, while λDI is the regularization parameter. We studied 27 different ratios of λD to λI between 10 and 0.02, as well as 10 different values of λDI between 0.1 and 10. The experiments were conducted 50 times for each pair. The results are shown in Figures 4 and 5. We found that the parameters λD and λI had little impact on both the accuracy and NMI when λD/λI<1 and 0.5<λDI<1.5, so we used λD=1, λI=3, and λDI=0.9 in the study of λ and the clustering experiments shown in Section 4.4.3.Figure 4
Evaluating the accuracy and NMI of PCoNMF and CCoNMF on varyingλD/λI.Figure 5
Evaluating the accuracy and NMI of PCoNMF and CCoNMF on varyingλDI.Finally, we studied the parameterλ used in RMMDI. We performed an experiment with a series of λ from 0.05 to 1 with step size 0.5 and observed their impacts on the clustering effectiveness (shown in Figure 6). The other parameters were set as mentioned in the previous paragraph.Figure 6
Evaluating the accuracy and NMI of RMMDI on varyingλ.
(a)
Evaluating the accuracy of RMMDI on varyingλ (b)
Evaluating the NMI of RMMDI on varyingλWe found that the curves showed a downward trend in whole, and the accuracy and NMI got greater values whenλ was around 0.3, which was used for the experiments shown in Section 4.4.3.


#### 4.4.3. Clustering Results

We also conducted experiments to compare the effectiveness of RMMDI with the clustering baseline methods. We performed all algorithms 200 times on each scenario and compared results with the ground truth shown in Table4. All the other parameters were set as the optimal values mentioned in Section 4.4.2. The results are listed in Tables 7–9, in which the results of SP and SymNMF were the larger result of 3 different inputs, AVV, AVV_D, and AVV_I. Most of those values were from the input AVV_I.Table 7
Accuracy for different methods on 3 scenarios.
Scenario SP SymNMF PCoSpec CCoSpec PCoNMF CCoNMF RMSC S1 0.9010 0.9229 0.7121 0.9057 0.9381 0.9190 0.6952  S2 0.8981 0.9276 0.6675 0.9072 0.9428 0.9365 0.5762  S3 0.9210 0.9181 0.7070 0.9035 0.9365 0.9333 0.6333Table 8
NMI for different methods on 3 scenarios.
Scenario SP SymNMF PCoSpec CCoSpec PCoNMF CCoNMF RMSC S1 0.8605 0.8571 0.5827 0.8414 0.8738 0.8579 0.6382  S2 0.8506 0.8703 0.4869 0.8497 0.8879 0.8744 0.479  S3 0.8692 0.8538 0.5958 0.8464 0.8774 0.8719 0.4890Table 9
Runtime for different methods on 3 scenarios (s).
Scenario SP SymNMF PCoSpec CCoSpec PCoNMF CCoNMF RMSC S1 0.0178 0.0109 0.1367 0.1247 0.8533 1.1568 0.0580  S2 0.0145 0.0091 0.0973 0.1108 0.8518 1.0866 0.0440  S3 0.0127 0.0085 0.0929 0.1031 0.8494 1.2394 0.0230


## 4.1. Experiment Environment

We built a simulation network for experiments, including a router, a firewall, an Intrusion Prevention System (IPS), 3 switches (Switch1, Switch2, and Switch3), 6 servers (WServer, DServer, FServer, GServer, OServer, and IServer), 3 gate machines (GM1, GM2, and GM3), and 13 terminals (T1, T2, T3, …, T13). We used a HUAWEI S7706 as the core router, three HUAWEI S5700 as switches, a TOPSEC NGFW 4000-UF as the firewall, a TOPSEC IDP 3000 as IPS, and computers from Dell and HP as the servers or terminals. The router enabled 3-layer routing and the firewall were configured with bidirectional access control lists. All the servers and terminals were installed with different versions of Windows, including Windows 2003 Server, Windows XP, and Windows 7. We deployed an entrance guard system including 3 gate machines and a server (GServer). The gate machines used face recognition technology to determine whether a person can pass or not. An office automation system was deployed on the OServer, whose database was deployed on the DServer. We also deployed two websites and an FTP using IIS (Internet Information Services) on WServer, IServer, and FServer. Similarly, the websites depended on the same database deployed on DServer. The physical link relationships among devices are shown in Figure3.Figure 3
An example network.All the devices are distributed in 12 rooms in 3 buildings. 10 devices are located in building 1: terminal T1, T2, and T3 are in room 1-1; T4 and T5 are in room 1-4; T6 and T7 are in room 1-5; Switch1 is in room 1-2; and GM1 is in the hall of building 1 (room 1-3). 8 devices are located in building 2: terminals T8 and T9 are in room 2-1; T10 and T11 are in room 2-4; T12 and T13 are in room 2-5; Switch2 is in room 2-2; and GM2 is in the hall of building 2 (room 2-3). 10 devices are located in building 3: router, firewall, IPS, Switch3, and all servers are in room 3-1, and GM3 is in the hall of building 3 (room 3-2).There were 34 services in the network, including 28 management services and 6 business services. The management services were used for device management, while the business services were used for corporation business. Each device was managed by a management service. The router and switches enabled SSH service. The servers and terminals enabled the Remote Desktop Service. In addition, the gate machines enabled web-based management interfaces. The website deployed on WServer provided a web service on port 80 named as WS_W, which was used to publish public information. The FServer provided an FTP service on port 21 named as FS_F, which was used by Network Administrators to share information. The GServer provided a data transmission service on port 8080 named as GS_T, which was used to synchronize data between GM machine and GServer. The OServer provided a web service on port 80 named as OS_W, which was used to document circulation for all users. The IServer provided a web service on port 80 named as IS_W, which was used by Server Administrators to share information. The DServer provided a database service on port 1433 named as DS_D, which was used to provide underlying support for WS_W, OS_W, and IS_W.There were 33 passwords in the analysis. Each service, except for WS_W and OS_W, has a password. Besides,NULL was added to represent the empty password. All the information involved is shown in Table 1.Table 1
Device related information.
Device Location Services Password Device Location Services Password T1 R1-1 T1_M T1_M_P GM2 R2-3 G2_M G2_M_P  T2 R1-1 T2_M T2_M_P GM3 R3-2 G3_M G3_M_P  T3 R1-1 T3_M T3_M_P Switch1 R1-2 S1_M S1_M_P  T4 R1-4 T4_M T4_M_P Switch2 R2-2 S2_M S2_M_P  T5 R1-4 T5_M T5_M_P Switch3 R3-1 S3_M S3_M_P  T6 R1-5 T6_M T6_M_P Router R3-1 R_M R_M_P  T7 R1-5 T7_M T7_M_P Firewall R3-1 F_M F_M_P  T8 R2-1 T8_M T8_M_P IPS R3-1 IPS_M IPS_M_P  T9 R2-1 T9_M T9_M_P WServer R3-1 WS_W - - WS_M WS_M_P  T10 R2-4 T10_M T10_M_P DServer R3-1 DS_D DS_D_P DS_M DS_M_P  T11 R2-4 T11_M T11_M_P FServer R3-1 FS_F FS_F_P FS_M FS_M_P  T12 R2-5 T12_M T12_M_P GServer R3-1 GS_T GS_T_P GS_M GS_M_P  T13 R2-5 T13_M T13_M_P OServer R3-1 OS_W -- OS_M OS_M_P  GM1 R1-3 G1_M G1_M_P IServer R3-1 IS_W IS_W_P IS_M IS_M_PThere were 13 users involved in analysis named from User1 to User13, who used terminals T1 to T13 and knew passwords T1_M_P to T13_M_P, respectively. Using the top-down approaches, the network security administrators had gotten 5 user roles for the business information, which were named as Ordinary User, Server Administrator, Database Administrator, Network Administrator, and Security Administrator. The role-permission assignments are listed in Table2.Table 2
User role-permission assignments by top-down methods.
Roles Service Permissions Ordinary User WS_W, OS_W  Server Administrator WS_M, FS_M, GS_M, OS_M, IS_M, DS_M, IS_W  Database Administrator DS_D  Network Administrator S1_M, S2_M,S3_M, R_M, FS_F  Security Administrator F_M, IPS_M, G1_M, G2_M, G3_M, GS_T


## 4.2. Baseline Methods

To demonstrate the effectiveness of our method, we compare our approach with two groups of baselines. The first group comprises 5 clustering methods: 2 single view methods and 3 multiview methods. The second group comprises 4 traditional role mining methods: ORCA (OFFIS Role mining tool with Cluster Analysis), CM (Complete Miner), HPr (HP Role Minimization), and HPe (HP Edge Minimization)


### 4.2.1. Clustering Methods

SP (Spectral Clustering). SP [35] is a classical single view clustering algorithm, which makes use of the eigenvalues of the data similarity matrix to perform dimensionality reduction before clustering in fewer dimensions. The similarity matrix is provided as an input, consisting of a quantitative assessment of the relative similarity of each pair of points in the dataset.SymNMF. SymNMF [36] is a clustering algorithm based on NMF, which takes a nonnegative and symmetric matrix as an input. The matrix contains pairwise similarity values of a similarity graph and is approximated by a lower rank matrix instead of the product of two lower rank matrices.PCoSpec (Pairwise Coregularized Spectral clustering) and CCoSpec (Center-wise Coregularized Spectral clustering). Two coregularization schemes are adopted in spectral clustering framework [37], PCoSpec utilizes a pairwise coregularization to enforce the eigenvectors of each pair to be similar, and CCoSpec employs the centroid-based coregularization to enforce the eigenvectors to be similar with a common center.CCoNMF (Cluster-wise Coregularized NMF clustering). CCoNMF extends NMF for multiview clustering by jointly factorizing the multiple matrices through cluster-wise coregularization [32], which enforces the cluster similarity matrices to be similar.RMSC (Robust Multiview Spectral Clustering). RMSC [38] is a multiview spectral clustering method based on Markov chain, which explicitly handles the possible noise in the transition probability matrices associated with different views.


### 4.2.2. Mining Baseline Methods

ORCA. ORCA [11] is the first role mining algorithm, which uses the hierarchical clustering technology to discover user roles. The algorithm defines each permission as an initial cluster first, then merges the clusters, and forms a role hierarchy.Complete Miner (CM). CM [10] is another classic role mining algorithm proposed in 2006. It starts by creating an initial set of roles for the distinct user-permission sets, then computes all possible intersection sets of the initial roles, and outputs a list of candidate roles.HP Role Minimization and HP Edge Minimization. HP Role Minimization (HPr) and HP Edge Minimization (HPe) [14] are the role mining algorithms based on minimum biclique coverage. HPr tries to find a minimal set of roles that override the user-permission assignment relationship, while HPe uses a heuristic method to find the smallest number of edges of an RBAC system.


## 4.2.1. Clustering Methods

SP (Spectral Clustering). SP [35] is a classical single view clustering algorithm, which makes use of the eigenvalues of the data similarity matrix to perform dimensionality reduction before clustering in fewer dimensions. The similarity matrix is provided as an input, consisting of a quantitative assessment of the relative similarity of each pair of points in the dataset.SymNMF. SymNMF [36] is a clustering algorithm based on NMF, which takes a nonnegative and symmetric matrix as an input. The matrix contains pairwise similarity values of a similarity graph and is approximated by a lower rank matrix instead of the product of two lower rank matrices.PCoSpec (Pairwise Coregularized Spectral clustering) and CCoSpec (Center-wise Coregularized Spectral clustering). Two coregularization schemes are adopted in spectral clustering framework [37], PCoSpec utilizes a pairwise coregularization to enforce the eigenvectors of each pair to be similar, and CCoSpec employs the centroid-based coregularization to enforce the eigenvectors to be similar with a common center.CCoNMF (Cluster-wise Coregularized NMF clustering). CCoNMF extends NMF for multiview clustering by jointly factorizing the multiple matrices through cluster-wise coregularization [32], which enforces the cluster similarity matrices to be similar.RMSC (Robust Multiview Spectral Clustering). RMSC [38] is a multiview spectral clustering method based on Markov chain, which explicitly handles the possible noise in the transition probability matrices associated with different views.


## 4.2.2. Mining Baseline Methods

ORCA. ORCA [11] is the first role mining algorithm, which uses the hierarchical clustering technology to discover user roles. The algorithm defines each permission as an initial cluster first, then merges the clusters, and forms a role hierarchy.Complete Miner (CM). CM [10] is another classic role mining algorithm proposed in 2006. It starts by creating an initial set of roles for the distinct user-permission sets, then computes all possible intersection sets of the initial roles, and outputs a list of candidate roles.HP Role Minimization and HP Edge Minimization. HP Role Minimization (HPr) and HP Edge Minimization (HPe) [14] are the role mining algorithms based on minimum biclique coverage. HPr tries to find a minimal set of roles that override the user-permission assignment relationship, while HPe uses a heuristic method to find the smallest number of edges of an RBAC system.


## 4.3. Experiments Setup

### 4.3.1. Scenarios Construction

To validate our framework and method, we built 3 scenarios named as Scenario1 (S1), Scenario2 (S2), and Scenario3 (S3) based on the basic experimental environment shown in Figure3 and assigned users one or more user roles, which is shown in Table 3. We can find out that each user in S1 was assigned only 1 user role, while they were assigned 2 user roles in S2. In S3, users working in one room may be assigned different user roles, which may introduce more vulnerabilities to network security.Table 3
User-role assignments in different scenario.
Scenario OrdinaryUser ServerAdministrator Database Administrator NetworkAdministrator SecurityAdministrator S1 User1, User2,User3 User4, User5 User6, User7 User8, User9, User10,User11 User12, User13  S2 All Users User7, User8 User11, User12, User13 User4, User5 User9, User10  S3 User1, User2, User5, User6, User9, User10, User13 User4, User7 User8 User11 User12For each scenario, we first configured the gate machines and firewall according to Tables2 and 3. Spatial access control lists were added on gate machines, making users have physical access to devices they managed or used, while network access control lists were added on the firewall, making the terminals have network access to the target services.It should be noted that there were potential conflicts among multi-domain configurations on the semantic level. Take the user User4 in S1 as example. User4 was a Server Administrator and should not access service DS_M and the firewall had forbidden T4 to access service DS_D directly, but T4 was permitted to access service WS_M and there was no firewall between WServer and DServer. Thus, User4 can use T4 to log in WServer remotely first and then access service DS_D (he can get the password DS_D_P from the configuration files on WServer). This is a typical semantic conflict between the network access control lists. Similarly, as User4 had the ability to access DS_D physically by entering the room 3-1, there is another conflict between the network access control list and the spatial access control list. Those conflicts may result in extra permissions for users.Then, we extracted basic information from the network and established the necessary relationship matrices. Note that there were 16 space entities, 28 object entities, 34 service entities, 32 information entities, and 13 user entities in all the 3 scenarios. The relationship matricesMOS∈R28×16, MVI∈R34×32, MOV_L∈R28×34, and MOV_R∈R28×34 were the same in all three scenarios, where MOS0=|MOV_L|0=|MOV_R|0=28 and |MVI|0=34. The matrices MSS∈R16×16 and MVO∈R34×28 varied from scenario to scenario, depending on the configurations of gate machines or firewall. For each space pair (S1,S2), we counted the users who can move from S1 to S2 under each scenario and set the parameter ε=14 when constructing the matrix MSS. The results showed that |MSS|0=46 in S1, |MSS|0=46 in S2, and |MSS|0=42 in S3. We used the scanner NMAP to get the accessibility relationships between devices and services, establishing the matrix MVO. The results showed that |MVO|0=549 in S1, |MVO|0=566 in S2, and |MSS|0=548 in S3.Finally, we detected the user roles by RMMDI and compared the results with the two groups of baseline methods. On the one hand, we performed the role mining baseline methods based on the user-permission assignment (UPA) matrices constructed from the firewall configurations and compared the results with RMMDI. On the other hand, we studied the best parameters for each clustering method and then compared the effectiveness of RMMDI with the clustering baseline methods. Accuracy and normalized mutual information (NMI) [31–33, 36] were adopted to evaluate the community detection effectiveness of different parameters, whose values both range from 0 to 1 and a higher value means better effectiveness. We calculated the accuracy and NMI of different clustering methods with ground truth after studying the best parameters for each clustering method. In the experiments, we constructed two ground truths manually. In one ground truth, we divided 21 service permissions into 5 roles according to Table 2. In the other ground truth, we combined the roles “Database Administrator” with “Server Administrator” and classified 21 service permissions into 4 roles. For one community detection result, we compared it with the two ground truths and calculated metrics separately.


## 4.3.1. Scenarios Construction

To validate our framework and method, we built 3 scenarios named as Scenario1 (S1), Scenario2 (S2), and Scenario3 (S3) based on the basic experimental environment shown in Figure3 and assigned users one or more user roles, which is shown in Table 3. We can find out that each user in S1 was assigned only 1 user role, while they were assigned 2 user roles in S2. In S3, users working in one room may be assigned different user roles, which may introduce more vulnerabilities to network security.Table 3
User-role assignments in different scenario.
Scenario OrdinaryUser ServerAdministrator Database Administrator NetworkAdministrator SecurityAdministrator S1 User1, User2,User3 User4, User5 User6, User7 User8, User9, User10,User11 User12, User13  S2 All Users User7, User8 User11, User12, User13 User4, User5 User9, User10  S3 User1, User2, User5, User6, User9, User10, User13 User4, User7 User8 User11 User12For each scenario, we first configured the gate machines and firewall according to Tables2 and 3. Spatial access control lists were added on gate machines, making users have physical access to devices they managed or used, while network access control lists were added on the firewall, making the terminals have network access to the target services.It should be noted that there were potential conflicts among multi-domain configurations on the semantic level. Take the user User4 in S1 as example. User4 was a Server Administrator and should not access service DS_M and the firewall had forbidden T4 to access service DS_D directly, but T4 was permitted to access service WS_M and there was no firewall between WServer and DServer. Thus, User4 can use T4 to log in WServer remotely first and then access service DS_D (he can get the password DS_D_P from the configuration files on WServer). This is a typical semantic conflict between the network access control lists. Similarly, as User4 had the ability to access DS_D physically by entering the room 3-1, there is another conflict between the network access control list and the spatial access control list. Those conflicts may result in extra permissions for users.Then, we extracted basic information from the network and established the necessary relationship matrices. Note that there were 16 space entities, 28 object entities, 34 service entities, 32 information entities, and 13 user entities in all the 3 scenarios. The relationship matricesMOS∈R28×16, MVI∈R34×32, MOV_L∈R28×34, and MOV_R∈R28×34 were the same in all three scenarios, where MOS0=|MOV_L|0=|MOV_R|0=28 and |MVI|0=34. The matrices MSS∈R16×16 and MVO∈R34×28 varied from scenario to scenario, depending on the configurations of gate machines or firewall. For each space pair (S1,S2), we counted the users who can move from S1 to S2 under each scenario and set the parameter ε=14 when constructing the matrix MSS. The results showed that |MSS|0=46 in S1, |MSS|0=46 in S2, and |MSS|0=42 in S3. We used the scanner NMAP to get the accessibility relationships between devices and services, establishing the matrix MVO. The results showed that |MVO|0=549 in S1, |MVO|0=566 in S2, and |MSS|0=548 in S3.Finally, we detected the user roles by RMMDI and compared the results with the two groups of baseline methods. On the one hand, we performed the role mining baseline methods based on the user-permission assignment (UPA) matrices constructed from the firewall configurations and compared the results with RMMDI. On the other hand, we studied the best parameters for each clustering method and then compared the effectiveness of RMMDI with the clustering baseline methods. Accuracy and normalized mutual information (NMI) [31–33, 36] were adopted to evaluate the community detection effectiveness of different parameters, whose values both range from 0 to 1 and a higher value means better effectiveness. We calculated the accuracy and NMI of different clustering methods with ground truth after studying the best parameters for each clustering method. In the experiments, we constructed two ground truths manually. In one ground truth, we divided 21 service permissions into 5 roles according to Table 2. In the other ground truth, we combined the roles “Database Administrator” with “Server Administrator” and classified 21 service permissions into 4 roles. For one community detection result, we compared it with the two ground truths and calculated metrics separately.


## 4.4. Result

### 4.4.1. Role Mining Results

Firstly, we performed the baseline role mining methods based on the firewall configurations. As the firewall only conducted the network access control lists, it can only reflect the accessibility between devices and services. Since each terminal was assigned to a user, we can get the 3 different UPA matrices from it. As we wanted to find disjoint service subnets, we usedW=1,1,1,∞,∞ as the optimization objective. In order to save space, only the permission divisions are shown in Table 4. We found that the permission divisions were almost the same as those in Table 2, which meant that the role mining methods can find no errors from the top-down approach.Table 4
Role mining results of baselines on all scenarios.
Scenario Method Role Permissions S1 ORCACMHPrHPe Role1 WS_W, OS_W Role2 WS_M, FS_M, GS_M, OS_M, IS_M, DS_M, IS_W Role3 DS_D Role4 S1_M, S2_M,S3_M, R_M, FS_F Role5 F_M, IPS_M, GS_T  S2 HPr Role1 WS_W, OS_W Role2 WS_W, OS_W, WS_M, FS_M, GS_M, OS_M, IS_M, DS_M, IS_W Role3 WS_W, OS_W, DS_D Role4 WS_W, OS_W, S1_M, S2_M, S3_M, R_M, FS_F Role5 WS_W, OS_W, F_M, IPS_M, GS_T  S2 ORCACMHPe Role1 WS_W, OS_W Role2 WS_M, FS_M, GS_M, OS_M, IS_M, DS_M, IS_W Role3 WS_W, OS_W, DS_D Role4 S1_M, S2_M, S3_M, R_M, FS_F Role5 F_M, IPS_M, GS_T  S3 ORCACMHPrHPe Role1 WS_W, OS_W Role2 WS_M, FS_M, GS_M, OS_M, IS_M, DS_M, IS_W Role3 DS_D Role4 S1_M, S2_M,S3_M, R_M, FS_F Role5 F_M, IPS_M, GS_TThen, we also performed the RMMDI on all scenarios with the role numberk=5,100 times for each scenario. The majority of the results were different from the result shown in Table 2. The most frequent result (222 in 300 times) is listed as Table 5. Comparing with Table 2, we counted the number of inconsistent classification results of each service. All 18 services were classified inconsistently for 572 times in total. And the top 2 services with the most inconsistent classification times were DS_D (282 times) and GS_T (258 times).Table 5
The most common result of RMMDI when k=5.
Method Role Permissions RMMDI Role1 WS_W, OS_W Role2 WS_M, FS_M, GS_M, OS_M, IS_M, DS_M, IS_W, DS_D Role3 GS_T Role4 S1_M, S2_M,S3_M, R_M, FS_F Role5 F_M, IPS_MFinally, we changed the role numberk=4 and performed the experiments 100 times under each scenario. The most common results are shown in Table 6.Table 6
The most common result of RMMDI when k=4.
Method Role Permissions RMMDI Role1 WS_W, OS_W Role2 WS_M, FS_M, GS_M, OS_M, IS_M, DS_M, IS_W, DS_D Role3 S1_M, S2_M,S3_M, R_M, FS_F Role4 F_M, IPS_M, GS_T


### 4.4.2. Parameter Study Results

We studied the parameters used in RMMDI as well as the baseline clustering methods. We performed a series of experiments for a series of different parameters and tried to find out the optimal parameters. The experiments were conducted under S2 with role numberk=4.We first studied the parameters used in baseline methods, includingλp_spec in PCoSpec, λc_spec_D and λc_spec_I in CCoSpec, and λrmsc in RMSC. With each parameter, we set λ=0.05 and studied 30 different values between 0.005 and 100. When λp_spec=0.15, λc_spec_D=8, λc_spec_I=1, and λrmsc=0.15, the methods had relatively better effectiveness on the dataset.Then, we studied the parameters in PCoNMF and CCoNMF. There are 3 parameters:λD, λI, and λDI. λD and λI represent the weights of view AVV_D and AVV_I, while λDI is the regularization parameter. We studied 27 different ratios of λD to λI between 10 and 0.02, as well as 10 different values of λDI between 0.1 and 10. The experiments were conducted 50 times for each pair. The results are shown in Figures 4 and 5. We found that the parameters λD and λI had little impact on both the accuracy and NMI when λD/λI<1 and 0.5<λDI<1.5, so we used λD=1, λI=3, and λDI=0.9 in the study of λ and the clustering experiments shown in Section 4.4.3.Figure 4
Evaluating the accuracy and NMI of PCoNMF and CCoNMF on varyingλD/λI.Figure 5
Evaluating the accuracy and NMI of PCoNMF and CCoNMF on varyingλDI.Finally, we studied the parameterλ used in RMMDI. We performed an experiment with a series of λ from 0.05 to 1 with step size 0.5 and observed their impacts on the clustering effectiveness (shown in Figure 6). The other parameters were set as mentioned in the previous paragraph.Figure 6
Evaluating the accuracy and NMI of RMMDI on varyingλ.
(a)
Evaluating the accuracy of RMMDI on varyingλ (b)
Evaluating the NMI of RMMDI on varyingλWe found that the curves showed a downward trend in whole, and the accuracy and NMI got greater values whenλ was around 0.3, which was used for the experiments shown in Section 4.4.3.


### 4.4.3. Clustering Results

We also conducted experiments to compare the effectiveness of RMMDI with the clustering baseline methods. We performed all algorithms 200 times on each scenario and compared results with the ground truth shown in Table4. All the other parameters were set as the optimal values mentioned in Section 4.4.2. The results are listed in Tables 7–9, in which the results of SP and SymNMF were the larger result of 3 different inputs, AVV, AVV_D, and AVV_I. Most of those values were from the input AVV_I.Table 7
Accuracy for different methods on 3 scenarios.
Scenario SP SymNMF PCoSpec CCoSpec PCoNMF CCoNMF RMSC S1 0.9010 0.9229 0.7121 0.9057 0.9381 0.9190 0.6952  S2 0.8981 0.9276 0.6675 0.9072 0.9428 0.9365 0.5762  S3 0.9210 0.9181 0.7070 0.9035 0.9365 0.9333 0.6333Table 8
NMI for different methods on 3 scenarios.
Scenario SP SymNMF PCoSpec CCoSpec PCoNMF CCoNMF RMSC S1 0.8605 0.8571 0.5827 0.8414 0.8738 0.8579 0.6382  S2 0.8506 0.8703 0.4869 0.8497 0.8879 0.8744 0.479  S3 0.8692 0.8538 0.5958 0.8464 0.8774 0.8719 0.4890Table 9
Runtime for different methods on 3 scenarios (s).
Scenario SP SymNMF PCoSpec CCoSpec PCoNMF CCoNMF RMSC S1 0.0178 0.0109 0.1367 0.1247 0.8533 1.1568 0.0580  S2 0.0145 0.0091 0.0973 0.1108 0.8518 1.0866 0.0440  S3 0.0127 0.0085 0.0929 0.1031 0.8494 1.2394 0.0230


## 4.4.1. Role Mining Results

Firstly, we performed the baseline role mining methods based on the firewall configurations. As the firewall only conducted the network access control lists, it can only reflect the accessibility between devices and services. Since each terminal was assigned to a user, we can get the 3 different UPA matrices from it. As we wanted to find disjoint service subnets, we usedW=1,1,1,∞,∞ as the optimization objective. In order to save space, only the permission divisions are shown in Table 4. We found that the permission divisions were almost the same as those in Table 2, which meant that the role mining methods can find no errors from the top-down approach.Table 4
Role mining results of baselines on all scenarios.
Scenario Method Role Permissions S1 ORCACMHPrHPe Role1 WS_W, OS_W Role2 WS_M, FS_M, GS_M, OS_M, IS_M, DS_M, IS_W Role3 DS_D Role4 S1_M, S2_M,S3_M, R_M, FS_F Role5 F_M, IPS_M, GS_T  S2 HPr Role1 WS_W, OS_W Role2 WS_W, OS_W, WS_M, FS_M, GS_M, OS_M, IS_M, DS_M, IS_W Role3 WS_W, OS_W, DS_D Role4 WS_W, OS_W, S1_M, S2_M, S3_M, R_M, FS_F Role5 WS_W, OS_W, F_M, IPS_M, GS_T  S2 ORCACMHPe Role1 WS_W, OS_W Role2 WS_M, FS_M, GS_M, OS_M, IS_M, DS_M, IS_W Role3 WS_W, OS_W, DS_D Role4 S1_M, S2_M, S3_M, R_M, FS_F Role5 F_M, IPS_M, GS_T  S3 ORCACMHPrHPe Role1 WS_W, OS_W Role2 WS_M, FS_M, GS_M, OS_M, IS_M, DS_M, IS_W Role3 DS_D Role4 S1_M, S2_M,S3_M, R_M, FS_F Role5 F_M, IPS_M, GS_TThen, we also performed the RMMDI on all scenarios with the role numberk=5,100 times for each scenario. The majority of the results were different from the result shown in Table 2. The most frequent result (222 in 300 times) is listed as Table 5. Comparing with Table 2, we counted the number of inconsistent classification results of each service. All 18 services were classified inconsistently for 572 times in total. And the top 2 services with the most inconsistent classification times were DS_D (282 times) and GS_T (258 times).Table 5
The most common result of RMMDI when k=5.
Method Role Permissions RMMDI Role1 WS_W, OS_W Role2 WS_M, FS_M, GS_M, OS_M, IS_M, DS_M, IS_W, DS_D Role3 GS_T Role4 S1_M, S2_M,S3_M, R_M, FS_F Role5 F_M, IPS_MFinally, we changed the role numberk=4 and performed the experiments 100 times under each scenario. The most common results are shown in Table 6.Table 6
The most common result of RMMDI when k=4.
Method Role Permissions RMMDI Role1 WS_W, OS_W Role2 WS_M, FS_M, GS_M, OS_M, IS_M, DS_M, IS_W, DS_D Role3 S1_M, S2_M,S3_M, R_M, FS_F Role4 F_M, IPS_M, GS_T


## 4.4.2. Parameter Study Results

We studied the parameters used in RMMDI as well as the baseline clustering methods. We performed a series of experiments for a series of different parameters and tried to find out the optimal parameters. The experiments were conducted under S2 with role numberk=4.We first studied the parameters used in baseline methods, includingλp_spec in PCoSpec, λc_spec_D and λc_spec_I in CCoSpec, and λrmsc in RMSC. With each parameter, we set λ=0.05 and studied 30 different values between 0.005 and 100. When λp_spec=0.15, λc_spec_D=8, λc_spec_I=1, and λrmsc=0.15, the methods had relatively better effectiveness on the dataset.Then, we studied the parameters in PCoNMF and CCoNMF. There are 3 parameters:λD, λI, and λDI. λD and λI represent the weights of view AVV_D and AVV_I, while λDI is the regularization parameter. We studied 27 different ratios of λD to λI between 10 and 0.02, as well as 10 different values of λDI between 0.1 and 10. The experiments were conducted 50 times for each pair. The results are shown in Figures 4 and 5. We found that the parameters λD and λI had little impact on both the accuracy and NMI when λD/λI<1 and 0.5<λDI<1.5, so we used λD=1, λI=3, and λDI=0.9 in the study of λ and the clustering experiments shown in Section 4.4.3.Figure 4
Evaluating the accuracy and NMI of PCoNMF and CCoNMF on varyingλD/λI.Figure 5
Evaluating the accuracy and NMI of PCoNMF and CCoNMF on varyingλDI.Finally, we studied the parameterλ used in RMMDI. We performed an experiment with a series of λ from 0.05 to 1 with step size 0.5 and observed their impacts on the clustering effectiveness (shown in Figure 6). The other parameters were set as mentioned in the previous paragraph.Figure 6
Evaluating the accuracy and NMI of RMMDI on varyingλ.
(a)
Evaluating the accuracy of RMMDI on varyingλ (b)
Evaluating the NMI of RMMDI on varyingλWe found that the curves showed a downward trend in whole, and the accuracy and NMI got greater values whenλ was around 0.3, which was used for the experiments shown in Section 4.4.3.


## 4.4.3. Clustering Results

We also conducted experiments to compare the effectiveness of RMMDI with the clustering baseline methods. We performed all algorithms 200 times on each scenario and compared results with the ground truth shown in Table4. All the other parameters were set as the optimal values mentioned in Section 4.4.2. The results are listed in Tables 7–9, in which the results of SP and SymNMF were the larger result of 3 different inputs, AVV, AVV_D, and AVV_I. Most of those values were from the input AVV_I.Table 7
Accuracy for different methods on 3 scenarios.
Scenario SP SymNMF PCoSpec CCoSpec PCoNMF CCoNMF RMSC S1 0.9010 0.9229 0.7121 0.9057 0.9381 0.9190 0.6952  S2 0.8981 0.9276 0.6675 0.9072 0.9428 0.9365 0.5762  S3 0.9210 0.9181 0.7070 0.9035 0.9365 0.9333 0.6333Table 8
NMI for different methods on 3 scenarios.
Scenario SP SymNMF PCoSpec CCoSpec PCoNMF CCoNMF RMSC S1 0.8605 0.8571 0.5827 0.8414 0.8738 0.8579 0.6382  S2 0.8506 0.8703 0.4869 0.8497 0.8879 0.8744 0.479  S3 0.8692 0.8538 0.5958 0.8464 0.8774 0.8719 0.4890Table 9
Runtime for different methods on 3 scenarios (s).
Scenario SP SymNMF PCoSpec CCoSpec PCoNMF CCoNMF RMSC S1 0.0178 0.0109 0.1367 0.1247 0.8533 1.1568 0.0580  S2 0.0145 0.0091 0.0973 0.1108 0.8518 1.0866 0.0440  S3 0.0127 0.0085 0.0929 0.1031 0.8494 1.2394 0.0230


## 5. Discussion

We propose a novel user role framework, which uses multiple domain information to mine user roles other than the preassigned user-permission assignment matrix.It is proved that the framework is suitable for role mining. For the three scenarios used in the experiment, different users are assigned to different user roles. One user may be assigned one or more user roles, and one user role may be assigned to several users. For the results listed in Tables7 and 8, we can find that the accuracy of the proposed framework is greater than 93.5% in all the three scenarios, while the NMI is greater than 87.0%. It means that the framework can detect user roles from the multiple domain configuration information successfully.More importantly, it is also demonstrated that the framework has the ability to find interdependent relationships between permissions, avoiding potential errors. From the experimental results in Section4.4.1, we find that RMMDI tends to integrate user roles “Database Administrator” and “Server Administrator”. Analyzing user potential permissions, it can be found that all Server Administrators can access service DS_D as they can both reach the service from other servers and get its password from configuration files in WServer. Therefore, it may be more appropriate to integrate user roles “Database Administrator” and “Server Administrator”. This trend cannot be found by traditional methods.It is also proved that the performances of different clustering methods vary in the framework. As shown in Tables7 and 8, the accuracy and NMI of PCoNMF are always the best among all the three scenarios, 30% better than the worst method. It means that a reasonable clustering method will promote the effectiveness of the framework significantly. Compared with the single view clustering methods, PCoNMF promotes the accuracy and NMI by more than 1%, which means the reasonable utilization of information from multiple views will get more structure information than from single view. Both the PCoSpec and RMSC have a lower accuracy or NMI, which means the multiview methods based on spectral clustering may not be suitable to the datasets.There are 4 parameters involved in the RMMDI in total and it is important to select proper values to the parameters. The first two parametersλD and λI are the weights of views AVV_D and AVV_I. From the results in Figure 4, we find that the view AVV_I has more structure information than AVV_D in the experiments and it is reasonable to set a larger λI and a smaller λD. The third parameter λDI is the regularization parameter that indicates the degree of community proximity between the two perspectives. A too low λDI will not establish the connection between two views. Nevertheless, as the view AVV_I has more structure information than AVV_D, a too big λDI will reduce the accuracy of the algorithm. Therefore, a moderate parameter λDI(0.5<λDI<1.5) will make the algorithm perform better. The last parameter λ is used in the function relationFilter(G,λ), which means to reserve the top λ×edgeNum(n) edges with the largest weight. From the results shown in Figure 6, we find that it is vital to reserve an appropriate proportion of links. A big λ will reserve more low weight links and the existences of low weight links will impact the effectiveness of the framework. However, a low value of λ will lost a lot of useful structure information, which will have an impact on the effectiveness of the algorithm too.


## 6. Conclusion

In this paper, a novel framework for role mining based on multi-domain information named as RMMDI is proposed. The key idea of the framework is to mine user roles from multiple domain information rather than existing user-permission assignment matrices. In the framework, information from the physical domain, network domain, and digital domain is used to find the relationships between user permissions, and multi-view community detection methods are used to integrate information from different domains. Experiments on 3 simulated network scenarios demonstrate that RMMDI can capture the interdependent relationships between permissions and perform user-role mining more effectively and reasonably.



---

*Source: 8085303-2019-06-11.xml*