{"id":"https://openalex.org/W4385688122","doi":"https://doi.org/10.1145/3600160.3604988","title":"Mitigating Privilege Misuse in Access Control through Anomaly Detection","display_name":"Mitigating Privilege Misuse in Access Control through Anomaly Detection","publication_year":2023,"publication_date":"2023-08-09","ids":{"openalex":"https://openalex.org/W4385688122","doi":"https://doi.org/10.1145/3600160.3604988"},"language":"en","primary_location":{"id":"doi:10.1145/3600160.3604988","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3600160.3604988","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3600160.3604988","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 18th International Conference on Availability, Reliability and Security","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3600160.3604988","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5092793933","display_name":"Gelareh Hasel Mehri","orcid":"https://orcid.org/0009-0007-9163-1279"},"institutions":[{"id":"https://openalex.org/I83019370","display_name":"Eindhoven University of Technology","ror":"https://ror.org/02c2kyt77","country_code":"NL","type":"education","lineage":["https://openalex.org/I83019370"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Gelareh Hasel Mehri","raw_affiliation_strings":["Mathematics & Computer Science, Eindhoven University of Technology, Netherlands"],"raw_orcid":"https://orcid.org/0009-0007-9163-1279","affiliations":[{"raw_affiliation_string":"Mathematics & Computer Science, Eindhoven University of Technology, Netherlands","institution_ids":["https://openalex.org/I83019370"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5092793934","display_name":"Inez L. Wester","orcid":"https://orcid.org/0009-0007-4683-2653"},"institutions":[{"id":"https://openalex.org/I83019370","display_name":"Eindhoven University of Technology","ror":"https://ror.org/02c2kyt77","country_code":"NL","type":"education","lineage":["https://openalex.org/I83019370"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Inez L. Wester","raw_affiliation_strings":["Mathematics & Computer Science, Eindhoven University of Technology, Netherlands"],"raw_orcid":"https://orcid.org/0009-0007-4683-2653","affiliations":[{"raw_affiliation_string":"Mathematics & Computer Science, Eindhoven University of Technology, Netherlands","institution_ids":["https://openalex.org/I83019370"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5083730359","display_name":"Federica Paci","orcid":"https://orcid.org/0000-0003-3122-0236"},"institutions":[{"id":"https://openalex.org/I119439378","display_name":"University of Verona","ror":"https://ror.org/039bp8j42","country_code":"IT","type":"education","lineage":["https://openalex.org/I119439378"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Federica Paci","raw_affiliation_strings":["University of Verona, Italy"],"raw_orcid":"https://orcid.org/0000-0003-3122-0236","affiliations":[{"raw_affiliation_string":"University of Verona, Italy","institution_ids":["https://openalex.org/I119439378"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5083686418","display_name":"Nicola Zannone","orcid":"https://orcid.org/0000-0002-9081-5996"},"institutions":[{"id":"https://openalex.org/I83019370","display_name":"Eindhoven University of Technology","ror":"https://ror.org/02c2kyt77","country_code":"NL","type":"education","lineage":["https://openalex.org/I83019370"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Nicola Zannone","raw_affiliation_strings":["Mathematics & Computer Science, Eindhoven University of Technology, Netherlands"],"raw_orcid":"https://orcid.org/0000-0002-9081-5996","affiliations":[{"raw_affiliation_string":"Mathematics & Computer Science, Eindhoven University of Technology, Netherlands","institution_ids":["https://openalex.org/I83019370"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.8122,"has_fulltext":true,"cited_by_count":5,"citation_normalized_percentile":{"value":0.84802405,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":95,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"10"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9993000030517578,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/access-control","display_name":"Access control","score":0.8631309270858765},{"id":"https://openalex.org/keywords/privilege","display_name":"Privilege (computing)","score":0.7833893299102783},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.7457281947135925},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7247215509414673},{"id":"https://openalex.org/keywords/confidentiality","display_name":"Confidentiality","score":0.6483869552612305},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.6475564241409302},{"id":"https://openalex.org/keywords/misuse-detection","display_name":"Misuse detection","score":0.6249468922615051},{"id":"https://openalex.org/keywords/audit","display_name":"Audit","score":0.6137150526046753},{"id":"https://openalex.org/keywords/data-access","display_name":"Data access","score":0.5472866296768188},{"id":"https://openalex.org/keywords/component","display_name":"Component (thermodynamics)","score":0.5188273787498474},{"id":"https://openalex.org/keywords/computer-access-control","display_name":"Computer access control","score":0.4441816806793213},{"id":"https://openalex.org/keywords/mandatory-access-control","display_name":"Mandatory access control","score":0.4299771785736084},{"id":"https://openalex.org/keywords/audit-trail","display_name":"Audit trail","score":0.4259514808654785},{"id":"https://openalex.org/keywords/false-positive-paradox","display_name":"False positive paradox","score":0.42207443714141846},{"id":"https://openalex.org/keywords/permission","display_name":"Permission","score":0.41668468713760376},{"id":"https://openalex.org/keywords/role-based-access-control","display_name":"Role-based access control","score":0.36024418473243713},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.3430728316307068},{"id":"https://openalex.org/keywords/database","display_name":"Database","score":0.1729952096939087},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.16823187470436096},{"id":"https://openalex.org/keywords/anomaly-based-intrusion-detection-system","display_name":"Anomaly-based intrusion detection system","score":0.09778076410293579},{"id":"https://openalex.org/keywords/business","display_name":"Business","score":0.0821639895439148}],"concepts":[{"id":"https://openalex.org/C527821871","wikidata":"https://www.wikidata.org/wiki/Q228502","display_name":"Access control","level":2,"score":0.8631309270858765},{"id":"https://openalex.org/C2780138299","wikidata":"https://www.wikidata.org/wiki/Q3404265","display_name":"Privilege (computing)","level":2,"score":0.7833893299102783},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.7457281947135925},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7247215509414673},{"id":"https://openalex.org/C71745522","wikidata":"https://www.wikidata.org/wiki/Q2476929","display_name":"Confidentiality","level":2,"score":0.6483869552612305},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6475564241409302},{"id":"https://openalex.org/C2776973144","wikidata":"https://www.wikidata.org/wiki/Q6880649","display_name":"Misuse detection","level":4,"score":0.6249468922615051},{"id":"https://openalex.org/C199521495","wikidata":"https://www.wikidata.org/wiki/Q181487","display_name":"Audit","level":2,"score":0.6137150526046753},{"id":"https://openalex.org/C47487241","wikidata":"https://www.wikidata.org/wiki/Q5227230","display_name":"Data access","level":2,"score":0.5472866296768188},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.5188273787498474},{"id":"https://openalex.org/C44415380","wikidata":"https://www.wikidata.org/wiki/Q17008721","display_name":"Computer access control","level":3,"score":0.4441816806793213},{"id":"https://openalex.org/C2777407602","wikidata":"https://www.wikidata.org/wiki/Q1888932","display_name":"Mandatory access control","level":4,"score":0.4299771785736084},{"id":"https://openalex.org/C80958533","wikidata":"https://www.wikidata.org/wiki/Q1047174","display_name":"Audit trail","level":3,"score":0.4259514808654785},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.42207443714141846},{"id":"https://openalex.org/C2779089604","wikidata":"https://www.wikidata.org/wiki/Q7169333","display_name":"Permission","level":2,"score":0.41668468713760376},{"id":"https://openalex.org/C45567728","wikidata":"https://www.wikidata.org/wiki/Q1702839","display_name":"Role-based access control","level":3,"score":0.36024418473243713},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.3430728316307068},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.1729952096939087},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.16823187470436096},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.09778076410293579},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.0821639895439148},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0},{"id":"https://openalex.org/C121955636","wikidata":"https://www.wikidata.org/wiki/Q4116214","display_name":"Accounting","level":1,"score":0.0},{"id":"https://openalex.org/C97355855","wikidata":"https://www.wikidata.org/wiki/Q11473","display_name":"Thermodynamics","level":1,"score":0.0}],"mesh":[],"locations_count":4,"locations":[{"id":"doi:10.1145/3600160.3604988","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3600160.3604988","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3600160.3604988","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 18th International Conference on Availability, Reliability and Security","raw_type":"proceedings-article"},{"id":"pmh:oai:pure.tue.nl:openaire/f2720e48-d5f2-47ba-a2d4-f261c29a54d1","is_oa":true,"landing_page_url":"https://research.tue.nl/files/307626675/3600160.3604988.pdf","pdf_url":"https://pure.tue.nl/ws/files/307626675/3600160.3604988.pdf","source":{"id":"https://openalex.org/S4406922641","display_name":"TU/e Research Portal","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Hasel Mehri, G, Wester, I L, Paci, F & Zannone, N 2023, Mitigating Privilege Misuse in Access Control through Anomaly Detection. in ARES 2023 - 18th International Conference on Availability, Reliability and Security, Proceedings., 139, ACM International Conference Proceeding Series, Association for Computing Machinery, Inc., 18th International Conference on Availability, Reliability and Security, ARES 2023, Benevento, Italy, 29/08/23. https://doi.org/10.1145/3600160.3604988","raw_type":"info:eu-repo/semantics/conferenceObject"},{"id":"pmh:oai:pure.tue.nl:openaire_cris_publications/f2720e48-d5f2-47ba-a2d4-f261c29a54d1","is_oa":true,"landing_page_url":"https://research.tue.nl/en/publications/f2720e48-d5f2-47ba-a2d4-f261c29a54d1","pdf_url":null,"source":{"id":"https://openalex.org/S4406922641","display_name":"TU/e Research Portal","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Hasel Mehri, G, Wester, I L, Paci, F & Zannone, N 2023, Mitigating Privilege Misuse in Access Control through Anomaly Detection. in ARES 2023 - 18th International Conference on Availability, Reliability and Security, Proceedings., 139, ACM International Conference Proceeding Series, Association for Computing Machinery, Inc., 18th International Conference on Availability, Reliability and Security, ARES 2023, Benevento, Italy, 29/08/23. https://doi.org/10.1145/3600160.3604988","raw_type":"info:eu-repo/semantics/conferenceObject"},{"id":"pmh:oai:pure.tue.nl:publications/f2720e48-d5f2-47ba-a2d4-f261c29a54d1","is_oa":true,"landing_page_url":"http://www.scopus.com/inward/record.url?scp=85169687997&partnerID=8YFLogxK","pdf_url":null,"source":{"id":"https://openalex.org/S4406922641","display_name":"TU/e Research Portal","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Hasel Mehri, G, Wester, I L, Paci, F & Zannone, N 2023, Mitigating Privilege Misuse in Access Control through Anomaly Detection. in ARES 2023 - 18th International Conference on Availability, Reliability and Security, Proceedings., 139, ACM International Conference Proceeding Series, Association for Computing Machinery, Inc., 18th International Conference on Availability, Reliability and Security, ARES 2023, Benevento, Italy, 29/08/23. https://doi.org/10.1145/3600160.3604988","raw_type":"info:eu-repo/semantics/conferenceObject"}],"best_oa_location":{"id":"doi:10.1145/3600160.3604988","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3600160.3604988","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3600160.3604988","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 18th International Conference on Availability, Reliability and Security","raw_type":"proceedings-article"},"sustainable_development_goals":[{"score":0.5699999928474426,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4385688122.pdf","grobid_xml":"https://content.openalex.org/works/W4385688122.grobid-xml"},"referenced_works_count":27,"referenced_works":["https://openalex.org/W1859925930","https://openalex.org/W1964676527","https://openalex.org/W1976383685","https://openalex.org/W2056884786","https://openalex.org/W2067191022","https://openalex.org/W2089103284","https://openalex.org/W2113462162","https://openalex.org/W2123120907","https://openalex.org/W2140405352","https://openalex.org/W2167101736","https://openalex.org/W2167896190","https://openalex.org/W2538737552","https://openalex.org/W2562751797","https://openalex.org/W2583825628","https://openalex.org/W2808762748","https://openalex.org/W2810550035","https://openalex.org/W2810913013","https://openalex.org/W2986159792","https://openalex.org/W3007490601","https://openalex.org/W3028881048","https://openalex.org/W3041533630","https://openalex.org/W3081400988","https://openalex.org/W3085329122","https://openalex.org/W3123491145","https://openalex.org/W4212960548","https://openalex.org/W4220931512","https://openalex.org/W4254512317"],"related_works":["https://openalex.org/W1596015467","https://openalex.org/W4246289931","https://openalex.org/W2382286253","https://openalex.org/W2464905395","https://openalex.org/W2354790132","https://openalex.org/W2475594486","https://openalex.org/W3152820868","https://openalex.org/W99612870","https://openalex.org/W2662689715","https://openalex.org/W4385688122"],"abstract_inverted_index":{"Access":[0],"control":[1,20,33,89],"is":[2,52],"a":[3,63,84,105,120,147],"fundamental":[4],"component":[5],"of":[6,15,49,76,97,130,146],"IT":[7],"systems":[8,21,34],"to":[9,30,40,123],"guarantee":[10],"the":[11,71,94,143],"confidentiality":[12],"and":[13,74,100,160],"integrity":[14],"sensitive":[16],"resources.":[17],"However,":[18,65],"access":[19,32,88,98,111,116,132,136,144],"have":[22,27],"inherent":[23],"limitations:":[24],"once":[25],"permissions":[26],"been":[28],"assigned":[29],"users,":[31],"do":[35],"not":[36,68],"provide":[37],"any":[38],"means":[39],"prevent":[41],"users":[42],"from":[43,108,134],"misusing":[44],"such":[45],"permissions.":[46],"The":[47,149],"problem":[48],"privilege":[50,77],"misuse":[51],"typically":[53],"addressed":[54],"by":[55,127],"employing":[56],"auditing":[57,66],"mechanisms,":[58],"which":[59],"verify":[60],"users\u2019":[61],"activities":[62],"posteriori.":[64],"does":[67],"allow":[69],"for":[70,93],"timely":[72],"detection":[73,92],"mitigation":[75],"misuse.":[78],"In":[79],"this":[80],"work,":[81],"we":[82,118],"propose":[83,119],"framework":[85,141,154],"that":[86,152],"complements":[87],"with":[90],"anomaly":[91],"run-time":[95],"monitoring":[96],"requests":[99],"raises":[101],"an":[102],"alert":[103],"when":[104],"user":[106,125],"diverges":[107],"her":[109],"normal":[110],"behavior.":[112],"To":[113],"detect":[114,162],"anomalous":[115],"requests,":[117],"novel":[121],"approach":[122],"build":[124],"profiles":[126],"eliciting":[128],"patterns":[129],"typical":[131],"behavior":[133],"historical":[135],"data.":[137],"We":[138],"evaluated":[139],"our":[140,153],"using":[142],"log":[145],"hospital.":[148],"results":[150],"show":[151],"has":[155],"very":[156],"few":[157],"false":[158],"positives":[159],"can":[161],"several":[163],"attack":[164],"scenarios.":[165]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":2}],"updated_date":"2026-08-01T09:00:35.917206","created_date":"2023-08-10T00:00:00"}