Semantic analysis of role mining results and shadowed roles detection

The use of role engineering has grown in importance with the expansion of highly abstracted access control frameworks in organizations. In particular, the use of role mining techniques for the discovery of roles from previously deployed authorizations has facilitated the configuration of such frameworks. However, the literature lacks from a clear basis for appraising and leveraging the learning outcomes of the role mining process. In this paper, we provide such a formal basis. We compare sets of roles by projecting roles from one set into the other set. This approach is useful to measure how comparable the two configurations of roles are, and to interpret each role. We formally define the problem of comparing sets of roles, and prove that the problem is NP-complete. Then, we propose an algorithm to map the inherent relationship between the sets based on Boolean expressions. We demonstrate the correctness and completeness of our solution, and investigate some further issues that may benefit from our approach, such as detection of unhandled perturbations or source misconfiguration. In particular, we emphasize that the presence of shadowed roles in the role configuration increases the time complexity of sets of roles comparison. We provide a definition of the shadowed roles problem and propose a solution that detects different cases of role shadowing.     

Role mining using answer set programming

With the increasing adoption of role-based access control (RBAC) in business security, role mining technology has been widely applied to aid the process of migrating a non-RBAC system to an RBAC system. However, because it is hard to deal with a variety of constraint conflicts at the same time, none of existing role mining algorithms can simultaneously satisfy various constraints that usually describe organizations’ security and business requirements. To extend the ability of role mining technology, this paper proposes a novel role mining approach using answer set programming (ASP) that complies with constraints and meets various optimization objectives, named constrained role miner (CRM). Essentially, the idea is that ASP is an approach to declarative problem solving. Thus, either to discover RBAC configurations or to deal with conflicts between constraints, ASP programs do not need to specify how answers are computed. Finally, we demonstrate the effectiveness and efficiency of our approach through experimental results.     

一种基于划分与压缩方法的改进角色挖掘

现有自底向上的角色工程方法挖掘任务繁重,挖掘规模庞大,且难以体现挖掘结果的可用性.为提取有效、完整的可用角色集,结合枚举角色挖掘的研究及用户之间的相似度属性,将角色挖掘问题转换为聚类问题,提出一种基于划分与压缩方法的改进角色挖掘.使用围绕中心点划分方法分解用户聚类,采用聚类压缩算法压缩划分用户集,利用矩阵的稠密性分析法合并重构有效矩阵,并在构造和真实数据集上进行测试与分析.实验结果表明,该方法能够降低求解问题的复杂性及挖掘规模,并能提取出有效、完整的可用角色集;与枚举法挖掘相比,压缩率控制在40％以内、支持度阈值取约0.6时,改进挖掘的效果比较理想.     

Toward data mining engineering: A software engineering approach

The number, variety and complexity of projects involving data mining or knowledge discovery in databases activities have increased just lately at such a pace that aspects related to their development process need to be standardized for results to be integrated, reused and interchanged in the future. Data mining projects are quickly becoming engineering projects, and current standard processes, like CRISP-DM, need to be revisited to incorporate this engineering viewpoint. This is the central motivation of this paper that makes the point that experience gained about the software development process over almost 40 years could be reused and integrated to improve data mining processes. Consequently, this paper proposes to reuse ideas and concepts underlying the IEEE Std 1074 and ISO 12207 software engineering model processes to redefine and add to the CRISP-DM process and make it a data mining engineering standard.     

Bridging the gap between information architecture analysis and software engineering in interactive web application development

Web development teams comprise non-computer experts working on the conceptual modeling of non-functional aspects in software applications. Later on, such conceptual information is processed by analysts and software engineers to face the technical phases of the software project. However, this information transfer is often difficult to automate since the information processed by the different professionals involves different abstraction levels, as well as important cost and effort that need to be considered. The main aim of this research is to minimize these problems by increasing automation and interoperability in the development of interactive web applications. To take up this challenge, we have created and evaluated a tool that aims at bridging the gap between the conceptual definitions of web contents–i.e., the information architecture, and the UML elements for analysis and design required by software engineers, connecting functional and non-functional information to achieve the rest of technical activities during the software development process.     

Bridging the gap between designed and implemented controllers via adaptive robust discrete sliding mode control

Bridging the gap between designed and implemented model-based controllers is a major challenge in the design cycle of industrial controllers. This gap is created due to (i) digital implementation of controller software that introduces sampling and quantization uncertainties, and (ii) uncertainties in the modeled plant's dynamics. In this paper, a new adaptive and robust model-based control approach is developed based on a nonlinear discrete sliding mode controller (DSMC) formulation to mitigate implementation imprecisions and model uncertainties, that consequently minimizes the gap between designed and implemented controllers. The new control approach incorporates the predicted values of the implementation uncertainties into the controller structure. Moreover, a generic adaptation mechanism will be derived to remove the errors in the nonlinear modeled dynamics. The proposed control approach is illustrated on a nonlinear automotive engine control problem. The designed DSMC is tested in real-time in a processor-in-the-loop (PIL) setup using an actual electronic control unit (ECU). The verification test results show that the proposed controller design, under ADC and model uncertainties, can improve the tracking performance up to 60% compared to a conventional controller design.     

Bridging the gap between biometrics and cryptography

Commenting on the terrorist attacks on the US in September, Lutz Martiny, chairman of Eurosmart, told CTT that the smart card industry might be required to come up with secure ID documents and technologies “using biometric and encrytion/decryption procedures.” Richard Aufreiter of Utimaco Safeware, who provides our Chip Talk column this month, believes that the technology enabling the smart card to fill the gap between biometrics and cryptography is now in place.     

基于角色的访问控制技术在考务管理系统中的应用

访问控制是信息安全的一个重要保障。在介绍RBAC模型的基础上,根据考务管理系统中用户职责,规定用户访问权限,定义考务管理系统中的角色及其对应的权限,阐述RBAC在考务管理系统中的应用,为考务管理系统的访问控制安全提供一种思路。     

Bridging the gap between feature- and grid-based SLAM

One important design decision for the development of autonomously navigating mobile robots is the choice of the representation of the environment. This includes the question of which type of features should be used, or whether a dense representation such as occupancy grid maps is more appropriate. In this paper, we present an approach which performs SLAM using multiple representations of the environment simultaneously. It uses reinforcement to learn when to switch to an alternative representation method depending on the current observation. This allows the robot to update its pose and map estimate based on the representation that models the surrounding of the robot in the best way. The approach has been implemented on a real robot and evaluated in scenarios, in which a robot has to navigate in- and outdoors and therefore switches between a landmark-based representation and a dense grid map. In practical experiments, we demonstrate that our approach allows a robot to robustly map environments which cannot be adequately modeled by either of the individual representations.     

Bridging the gap between OWL and relational databases

Despite similarities between the Web Ontology Language (OWL) and schema languages traditionally used in relational databases, systems based on these languages exhibit quite different behavior in practice. The schema statements in relational databases are usually interpreted as integrity constraints and are used to check whether the data is structured according to the schema. OWL allows for axioms that resemble integrity constraints; however, these axioms are interpreted under the standard first-order semantics and not as checks. This often leads to confusion and is inappropriate in certain data-centric applications. To explain the source of this confusion, in this paper we compare OWL and relational databases w.r.t. their schema languages and basic computational problems. Based on this comparison, we extend OWL with integrity constraints that capture the intuition behind similar statements in relational databases. We show that, if the integrity constraints are satisfied, they need not be considered while answering a broad range of positive queries. Finally, we discuss several algorithms for checking integrity constraint satisfaction, each of which is suitable to different types of OWL knowledge bases.     

Bridging the gap between the linear and nonlinear predictive control: Adaptations for efficient building climate control

The linear model predictive control which is frequently used for building climate control benefits from the fact that the resulting optimization task is convex (thus easily and quickly solvable). On the other hand, the nonlinear model predictive control enables the use of a more detailed nonlinear model and it takes advantage of the fact that it addresses the optimization task more directly, however, it requires a more computationally complex algorithm for solving the non-convex optimization problem. In this paper, the gap between the linear and the nonlinear one is bridged by introducing a predictive controller with linear time-dependent model. Making use of linear time-dependent model of the building, the newly proposed controller obtains predictions which are closer to reality than those of linear time invariant model, however, the computational complexity is still kept low since the optimization task remains convex. The concept of linear time-dependent predictive controller is verified on a set of numerical experiments performed using a high fidelity model created in a building simulation environment and compared to the previously mentioned alternatives. Furthermore, the model for the nonlinear variant is identified using an adaptation of the existing model predictive control relevant identification method and the optimization algorithm for the nonlinear predictive controller is adapted such that it can handle also restrictions on discrete-valued nature of the manipulated variables. The presented comparisons show that the current adaptations lead to more efficient building climate control.     

数据挖掘技术在工程塑料合成配方研究中的应用

目前以机理模型精确描述大分子结构性能形成的影响因素还有待进一步的理论研究，但数理统计分析方法的应用对该领域的研究和生产实践有显著的指导意义。本文通过实例介绍了在工程塑料合成配方研究中使用数据挖掘技术的方法，重点讨论了基于关联规则的模型建立与应用的过程，解决了如何利用Powerbuilder的嵌入式动态SQL技术在大数据量下高效率实现数据挖掘的方法，并应用遗传算法，弱化关联度与支持率加速检索过程。最后本文讨论了数据挖掘技术在高分子材料领域未来的发展方向。     

Bridging the gap between geometric and algebraic multi-grid methods

In this paper, a multi-grid solver for the discretisation of partial differential equations on complicated domains will be developed. The algorithm requires as input only the given discretisation instead of a hierarchy of discretisations on coarser grids. Such auxiliary grids and discretisations will be generated in a black-box fashion and will be employed to define purely algebraic intergrid transfer operators. The geometric interpretation of the algorithm allows one to use the framework of geometric multigrid methods to prove its convergence. The focus of this paper is on the formulation of the algorithm and the demonstration of its efficiency by numerical experiments while the analysis is carried out for some model problems.     

Bridging the gap between business models and system models

This paper discusses links that may be made between process models and Unified Modelling Language (UML) software specification techniques, working from an argument that the whole complexity of organisational activity cannot be captured by UML alone. The approach taken is to develop a set of use cases, which would be capable of providing information support to a pre-defined organisational process. The nature of the thinking, which is necessary to derive the use cases, is outlined using the pre-defined process as a case study. The grouping of transactions and state changes into Use Cases is shown to require design choices, which may vary between particular organisational contexts. Conclusions are drawn about the direction of further investigation of links between process modelling and UML.     

Bridging the gap between software development and information security

Traditionally, software development efforts in large corporations have been about as far removed from information security as they were from human resources or any other business function. Software development has also had the tendency to be highly distributed among business units and thus not even practiced in a cohesive, coherent manner. In the worst cases, busy business unit executives trade roving bands of developers like Pokemon cards in a fifth-grade classroom (in an attempt to get ahead). Suffice it to say, none of this is good. The disconnect between security and development has ultimately produced software development efforts that lack any sort of contemporary understanding of technical security risks. Today's complex and highly connected computing environments trigger myriad security concerns, so by blowing off the idea of security entirely, software builders virtually guarantee that their creations have way too many security weaknesses that could - and should - have been avoided. This article presents some recommendations for solving this problem. Our approach is born out of experience in two diverse fields: software security and information security. Central among our recommendations is the notion of using the knowledge inherent in information security organizations to enhance secure software development efforts.     

Bridging the generation gap between text planning and linguistic realization

Text planning is traditionally done as a separate process, independent of linguistic realization. However, I show in this paper that it is essential for a text planner to know the linguistic consequences of its actions. The choice of how to realize an element affects how much information is conveyed (e.g., “Floyd arrived safely in Boston” vs. “Floyd landed safely at Logan”) and what other information can be added (e.g., “Peter was deciding for an hour” vs. *“Peter made a decision for an hour”). The choice of realization also affects how the relative salience of the elements being expressed will be perceived (e.g., “The green car is in the garage” vs. “The car in the garage is green”). I have defined an intermediate level of representation for text planning, called the Text Structure. It is an abstract linguistic level that reflects germane linguistic constraints while abstracting away from syntactic detail. This representation allows the text planner to have greater control over the decisions, so that it can take advantage of the expressiveness of language to convey subtleties of meaning. More importantly, the Text Structure allows the generation process overall to be incremental, since it ensures that the text plan being composed will always be expressible in the language. La planification de textes est habituellement réalisée séparément, sans tenir compte de la réalisation linguistique. Cependant, ľauteur demontre dans cet article qu'il est essentiel à un planificateur de textes de connai̊tre les conséquences linguistiques de ses actions. Le choix de la méhode de réalisation ?un élément influe sur la quantité?informations qui est transmise (par ex.: 〈〈 Floyd est arrivé sain et sauf à Boston 〉〉 et 〈〈 Floyd a atterri sain et sauf àľaéroport Logan 〉〉) et sur quelle autre information peut ětre ajoutée. Le choix de la méthode de réalisation influe également sur la façon dont les caractères saillants des ééments qui sont exprimés seront perçus (par ex.: 〈〈 la voiture verte est dans le garage 〉〉 et 〈〈 la voiture dans le garage est verte 〉〉). L'auteur a défini un niveau intérmediaire de représentation pour la planification de textes qu'il a appelé structure de texte. Il; s'agit ?'un niveau linguistique abstrait qui refléte les contraintes linguistiques appropriées tout en s'éloignant du détail syntaxique. Cette représentation permet au planificateur de textes ?avoir un meilleur contrǒle des décisions, et done de tirer profit de la force ?expression du langage afin de tenir compte des subtiliés de sens. Plus important encore, la structure de texte permet au processus de génération ?ětre incrémentiel, car elle s'assure que le plan de texte en voie de composition soit toujours exprimable dans le langage.