{"id":"https://openalex.org/W4308219631","doi":"https://doi.org/10.1145/3560810.3564264","title":"Detecting Anomalous Misconfigurations in AWS Identity and Access Management Policies","display_name":"Detecting Anomalous Misconfigurations in AWS Identity and Access Management Policies","publication_year":2022,"publication_date":"2022-11-04","ids":{"openalex":"https://openalex.org/W4308219631","doi":"https://doi.org/10.1145/3560810.3564264"},"language":"en","primary_location":{"id":"doi:10.1145/3560810.3564264","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3560810.3564264","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3560810.3564264","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2022 on Cloud Computing Security Workshop","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3560810.3564264","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5026980331","display_name":"Thijs van Ede","orcid":"https://orcid.org/0000-0003-3865-6390"},"institutions":[{"id":"https://openalex.org/I94624287","display_name":"University of Twente","ror":"https://ror.org/006hf6230","country_code":"NL","type":"education","lineage":["https://openalex.org/I94624287"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Thijs van Ede","raw_affiliation_strings":["University of Twente, Enschede, Netherlands"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Twente, Enschede, Netherlands","institution_ids":["https://openalex.org/I94624287"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5088094815","display_name":"Niek Khasuntsev","orcid":null},"institutions":[{"id":"https://openalex.org/I94624287","display_name":"University of Twente","ror":"https://ror.org/006hf6230","country_code":"NL","type":"education","lineage":["https://openalex.org/I94624287"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Niek Khasuntsev","raw_affiliation_strings":["University of Twente, Enschede, Netherlands"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Twente, Enschede, Netherlands","institution_ids":["https://openalex.org/I94624287"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5049950226","display_name":"Bas Steen","orcid":null},"institutions":[{"id":"https://openalex.org/I4210133447","display_name":"PricewaterhouseCoopers (Netherlands)","ror":"https://ror.org/031601h81","country_code":"NL","type":"company","lineage":["https://openalex.org/I4210133447","https://openalex.org/I4210133790"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Bas Steen","raw_affiliation_strings":["PwC Advisory N.V., Amsterdam, Netherlands"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"PwC Advisory N.V., Amsterdam, Netherlands","institution_ids":["https://openalex.org/I4210133447"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5071672404","display_name":"Andrea Continella","orcid":"https://orcid.org/0000-0002-0329-1830"},"institutions":[{"id":"https://openalex.org/I94624287","display_name":"University of Twente","ror":"https://ror.org/006hf6230","country_code":"NL","type":"education","lineage":["https://openalex.org/I94624287"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Andrea Continella","raw_affiliation_strings":["University of Twente, Enschede, Netherlands"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Twente, Enschede, Netherlands","institution_ids":["https://openalex.org/I94624287"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":6,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"63","last_page":"74"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9894999861717224,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8837345838546753},{"id":"https://openalex.org/keywords/cloud-computing","display_name":"Cloud computing","score":0.6529648303985596},{"id":"https://openalex.org/keywords/identity-management","display_name":"Identity management","score":0.4874720573425293},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.40010207891464233},{"id":"https://openalex.org/keywords/access-control","display_name":"Access control","score":0.2803942859172821},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.0884806215763092}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8837345838546753},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.6529648303985596},{"id":"https://openalex.org/C555379026","wikidata":"https://www.wikidata.org/wiki/Q977772","display_name":"Identity management","level":3,"score":0.4874720573425293},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.40010207891464233},{"id":"https://openalex.org/C527821871","wikidata":"https://www.wikidata.org/wiki/Q228502","display_name":"Access control","level":2,"score":0.2803942859172821},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0884806215763092}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/3560810.3564264","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3560810.3564264","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3560810.3564264","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2022 on Cloud Computing Security Workshop","raw_type":"proceedings-article"},{"id":"pmh:oai:ris.utwente.nl:openaire/74288515-3170-4053-8e71-c884c2541ab5","is_oa":true,"landing_page_url":"https://research.utwente.nl/en/publications/74288515-3170-4053-8e71-c884c2541ab5","pdf_url":"https://ris.utwente.nl/ws/files/288388617/3560810.3564264.pdf","source":{"id":"https://openalex.org/S4406922991","display_name":"University of Twente Research Information","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Ede, T V, Khasuntsev, N, Steen, B & Continella, A 2022, Detecting Anomalous Misconfigurations in AWS Identity and Access Management Policies. in CCSW 2022 - Proceedings of the 2022 Cloud Computing Security Workshop, co-located with CCS 2022. pp. 63-74, ACM Cloud Computing Security Workshop, CCSW 2022, Los Angeles, California, United States, 7/11/22. https://doi.org/10.1145/3560810.3564264","raw_type":"info:eu-repo/semantics/conferenceObject"}],"best_oa_location":{"id":"doi:10.1145/3560810.3564264","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3560810.3564264","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3560810.3564264","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2022 on Cloud Computing Security Workshop","raw_type":"proceedings-article"},"sustainable_development_goals":[{"display_name":"Reduced inequalities","score":0.5699999928474426,"id":"https://metadata.un.org/sdg/10"}],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4308219631.pdf","grobid_xml":"https://content.openalex.org/works/W4308219631.grobid-xml"},"referenced_works_count":13,"referenced_works":["https://openalex.org/W2037101844","https://openalex.org/W2072202366","https://openalex.org/W2107528096","https://openalex.org/W2144182447","https://openalex.org/W2350778671","https://openalex.org/W2612872092","https://openalex.org/W2753289012","https://openalex.org/W2889665541","https://openalex.org/W2899289096","https://openalex.org/W2929275958","https://openalex.org/W2946364701","https://openalex.org/W2962756421","https://openalex.org/W2986159792"],"related_works":["https://openalex.org/W2748952813","https://openalex.org/W4244478748","https://openalex.org/W4223488648","https://openalex.org/W2134969820","https://openalex.org/W2251605416","https://openalex.org/W4389340727","https://openalex.org/W4205786897","https://openalex.org/W3150465815","https://openalex.org/W1997222214","https://openalex.org/W4302444936"],"abstract_inverted_index":{"In":[0,61],"recent":[1],"years,":[2],"misconfigurations":[3,55,108],"of":[4,24,45,100,141],"cloud":[5,25,135],"services":[6],"have":[7],"led":[8],"to":[9,18,51,144,156,163],"major":[10],"security":[11],"incidents":[12],"and":[13,21,37,73,95,127,168],"large-scale":[14],"data":[15,131],"breaches.":[16],"Due":[17],"the":[19,84,98,139],"dynamic":[20],"complex":[22],"nature":[23],"environments,":[26],"misconfigured":[27],"(e.g.,":[28],"overly":[29],"permissive)":[30],"access":[31,74,128],"policies":[32,76,87],"can":[33,58,88,109],"be":[34,59,89,110],"easily":[35],"introduced":[36],"often":[38],"go":[39],"undetected":[40],"for":[41,71],"a":[42,66,101,117,151],"long":[43],"period":[44],"time.":[46],"Therefore,":[47],"it":[48,149,160],"is":[49,106,161],"critical":[50],"identify":[52],"any":[53],"potential":[54],"before":[56],"they":[57],"abused.":[60],"this":[62],"paper,":[63],"we":[64],"present":[65],"novel":[67],"misconfiguration":[68],"detection":[69],"approach":[70,82,123,143],"identity":[72,126],"management":[75,129],"in":[77,97,115],"AWS.":[78],"We":[79,120,137],"base":[80],"our":[81,122,142],"on":[83,124],"observation":[85],"that":[86,107,148],"modeled":[90],"as":[91,113,171],"permissions":[92],"between":[93,166],"entities":[94],"objects":[96],"form":[99],"graph.":[102],"Our":[103],"key":[104],"idea":[105],"effectively":[111],"detected":[112],"anomalies":[114],"such":[116],"graph":[118],"representation.":[119],"evaluate":[121],"real-world":[125],"policy":[130],"from":[132],"three":[133],"enterprise":[134],"environments.":[136],"investigate":[138],"effectiveness":[140],"detect":[145,165],"misconfigurations,":[146],"showing":[147],"has":[150],"slightly":[152],"lower":[153],"precision":[154],"compared":[155],"rule-based":[157],"systems,":[158],"but":[159],"able":[162],"correctly":[164],"3.7":[167],"6.4":[169],"times":[170],"many":[172],"misconfigurations.":[173]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":2},{"year":2024,"cited_by_count":1},{"year":2023,"cited_by_count":1}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2022-11-09T00:00:00"}