Abdelgawad, Mahmoud, authorRay, Indrakshi, authorAlqurashi, Saja, authorVenkatesha, Videep, authorShirazi, Hosein, authorACM, publisher2024-11-112024-11-112023-05-24Mahmoud Abdelgawad, Indrakshi Ray, Saja Alqurashi, Videep Venkatesha, and Hosein Shirazi. 2023. Synthesizing and Analyzing Attribute-Based Access Control Model Generated from Natural Language Policy Statements. In Proceedings of the 28th ACM Symposium on Access Control Models and Technologies (SACMAT '23), June 7–9, 2023, Trento, Italy. ACM, New York, NY, USA, 8 pages. https://doi.org/10.1145/3589608.3593844https://hdl.handle.net/10217/239534Access control policies (ACPs) are natural language statements that describe criteria under which users can access resources. We focus on constructing NIST Next Generation Access Control (NGAC) ABAC model from ACP statements. NGAC is more complex than RBAC or XACML ABAC as it supports dynamic, event-based policies, as well as prohibitions. We provide algorithms that use spaCy, a NLP library, to extract entities and relations from ACP sentences and convert them into the NGAC model. We then convert this NGAC model into Neo4j representation for the purpose of analysis. We apply the approach to various real-world ACP datasets to demonstrate the feasibility and assess scalability. We demonstrate that the approach is scalable and effectively extracts the NGAC ABAC model from large ACP datasets. We also show that redundancies and inconsistencies of ACP sentences are often found in unclean datasets.born digitalarticleseng© Mahmoud Abdelgawad, et al. | ACM 2023. This is the author's version of the work. It is posted here for your personal use. Not for redistribution. The definitive Version of Record was published in SACMAT '23, https://dx.doi.org/10.1145/3589608.3593844.cybersecurityattribute-based access control (ABAC)next generation access control (NGAC)natural language processing (NLP)Texthttps://doi.org/10.1145/3589608.3593844