Auditing file system permissions using association rule mining. (15th August 2016)

• Record Type: Journal Article
• Authors: Parkinson, S.; Somaraki, V.; Ward, R.
• Is Part Of: Expert systems with applications. Volume 55(2016)
• Page Start: 274
• Page End: 283
• Publication Date: 2016-08-15
• Subjects: Access control -- Auditing -- Association rule mining; Expert systems (Computer science) -- Periodicals; Systèmes experts (Informatique) -- Périodiques; Electronic journals; 006.33
• DOI: 10.1016/j.eswa.2016.02.027
• Languages: English
• ISSNs: 0957-4174

Abstract

Highlights: Modelling Microsoft's New Technology File System permissions for analysis. Using association rule mining to identify irregular file system permissions. Development of a two-stage tool for auditing Microsoft's New Technology File System. Accuracy greater than 90% for both real-world and synthetic directory structures. Abstract: Identifying irregular file system permissions in large, multi-user systems is challenging due to the complexity of gaining structural understanding from large volumes of permission information. This challenge is exacerbated when file systems permissions are allocated in an ad-hoc manner when new access rights are required, and when access rights become redundant as users change job roles or terminate employment. These factors make it challenging to identify what can be classed as an irregular file system permission, as well as identifying if they are irregular and exposing a vulnerability. The current way of finding such irregularities is by performing an exhaustive audit of the permission distribution; however, this requires expert knowledge and a significant amount of time. In this paper a novel method of modelling file system permissions which can be used by association rule mining techniques to identify irregular permissions is presented. This results in the creation of object-centric model as a by-product. This technique is then implemented and tested on Microsoft's New Technology File System permissions (NTFS). Empirical observations are derived by making comparisons with expert knowledge to determine the effectiveness of the proposed technique on five diverse real-world directory structures extracted from different organisations. The results demonstrate that the technique is able to correctly identify irregularities with an average accuracy rate of 91%, minimising the reliance on expert knowledge. Experiments are also performed on synthetic directory structures which demonstrate an accuracy rate of 95% when the number of irregular permissions constitutes 1% of the total number. This is a significant contribution as it creates the possibility of identifying vulnerabilities without prior knowledge of how to file systems permissions are implemented within a directory structure.