text:
\section{Improving FPR Performance}
\label{app:fprImprovement}

\input{tables/tab-weightLossCombination}

\begin{figure}[ht]
    \centering
	\includegraphics[width=\linewidth]
	{graphics/appendices/weighted_loss.png}
	\caption{FPR Performance Improvement in \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\).}
	\label{fig:fprImprovemnt}
\end{figure}

This section shows how to improve False Positive Rate (FPR) performance in \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\). We apply a well-known technique for performance improvement (or control) of an imbalanced dataset. The idea is to give more weight to the wrong prediction for samples from minority classes and vice-versa. However, improving in one metrics might affect the other performances.
We experiment with \(\textrm{DLBAC}\textsubscript{\textgreek{a}$-$D}\) instance for the \(amazon$-$kaggle\) dataset where there are two different classes for each sample, deny and grant.
In the \(amazon$-$kaggle\) dataset, there are only below 7\% of the samples from denying class. Hence, we modify the loss function while training the \(\textrm{DLBAC}\textsubscript{\textgreek{a}$-$D}\) to add majority weights on loss for the deny class and significantly smaller weights for the other one.
As reported in Table~\ref{tab:weightLossCombination}, we consider four different combinations of weight for the loss function for different classes.
Figure~\ref{fig:fprImprovemnt} showed, with the weight decrease for the grant class and increased weight for the deny class, the FPR reduces. It also positively impact precision which rises consistently. However, the F1 score and TPR are also affected and decrease gradually.

\section{Impact of Metadata with Non-significant Attribution Scores}
\label{app:impactNonSignificantMetadata}
To understand the effect of the metadata having non-significant or low attribution scores from Integrated Gradients, we take the attribution scores for the tuple that we presented in Figure~\ref{fig:modifyAccessThroughIG} (tuple2). There we see that the user Carol has \emph{deny} access to the projectC resource for op1 operation. We take the attribution scores for the Carol and projectC tuple and, as illustrated in Figure~\ref{fig:denyAccessTupleInterpretation}, the rmeta2 and umeta2 are the most influential metadata with the highest attribution scores. However, umeta4, umeta5, rmeta0, rmeta3, rmeta5 metadata have 0.0 attribution scores, which indicates that they have no impact on this specific decision, whereas rmeta7 and umeta7 (along with some other metadata) have less influence (smaller attribution scores). We want to evaluate the consequence if we change the value of these non or less significant metadata. We modify the value of all these metadata and replace it with the value of a known tuple (Dave and projectD) with grant access. We found no change in the access decision.

\begin{figure}[t]
    \centering
	\includegraphics[width=\linewidth]
	{graphics/appendices/deny_access_tuple_interpret.png}
	\caption{Local Interpretation of a Tuple with Deny Access.}
	\label{fig:denyAccessTupleInterpretation}
\end{figure}

\section{Decision Tree for Knowledge Transferring}
\label{app:decisionTree}

\begin{figure*}[t]

	\includegraphics[width=0.8\textwidth]
	{graphics/appendices/kt_cropped_decision_tree.png}
	\caption{Decision Tree Generated for \(u4k$-$r4k$-$auth11k\) Dataset. Part of the tree has been cropped for better illustration.}
	\label{fig:decisionTree}
\end{figure*}

We build a decision tree for (\(u4k$-$r4k$-$auth11k\)) dataset and \emph{op1} operation. We train the tree based on the training data that contain both user-resource metadata and their corresponding access permission for \emph{op1} operation. However, instead of giving permissions from the dataset, we provide corresponding \emph{probabilities} acquired from \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\). We accumulate \textit{op1} access \textit{probabilities} for the tuples in (\(u4k$-$r4k$-$auth11k\)) dataset, as discussed in Section~\ref{knowledgeTransferring}. Then we train the decision tree based on the training input from the dataset and probabilities as the target output (ground truth).

Figure~\ref{fig:decisionTree} is the decision tree generated from the \(u4k$-$r4k$-$auth11k\) dataset (with 8772 samples) based on \emph{Knowledge Transferring} for \emph{op1} operation. We demonstrate how to retrieve a rule from the tree to understand any specific decision. We cropped the tree for better visualization. Each node in the tree represents a binary decision point where the samples are split based on the condition in the corresponding node. For example, the tree's root node is rmeta2 that splits all the 8772 samples based on the `rmeta2$<=$17.5' condition.
As specified, the metadata values of our datasets are categorical, where values are integer representations of different categories. Therefore, we can round the value in each node's condition to the next integer without any issue. For instance, we can round the value of rmeta2$<=$17.5 to rmeta2$<$18 as there is no metadata value of 17.5. The MSE (mean-squared error) indicates the error that measures the quality of a split. Also, the value of the node determines the probabilities for related decisions. As we build this tree for \emph{op1} operation, we have a binary decision point --- whether or not the user has access to the corresponding resource for this operation. We round the probabilities to the \emph{grant} if the value is $>$0.5, otherwise \emph{deny}. As shown in the figure, the value in the root node is 0.478 indicates that initially, all the requests are considered `denied'.

We will walk through an access request for user \emph{Dave}'s access to the \emph{projectD} resource for \emph{op1} operation as described in Section~\ref{knowledgeTransferring}. The metadata value of Dave and projectD is available in Figure~\ref{fig:modifyAccessThroughIG} (tuple1). However, the value of rmeta2 metadata is 5 for \emph{projectD}; hence the root condition is true, and the next node is the left node with condition umeta2$<$20. This condition is also successful for Dave's umeta2$=$5 and checks the next left node to see the value of umeta0. As the value of umeta0 is 61, it can directly come to the node where umeta6 is verified. This condition is passed with umeta6$=$6, and the next left condition is also satisfied for the rmeta0$=$30. The following condition is true as the value of umeta0 is 61. Finally, the tree checks for the value of rmeta5 before making the access decision for \emph{Dave} to the \emph{projectD}. This condition is also successful for rmeta5$=$105.
We see the green shaded node is the final decision node for this request. The decision is \emph{grant} based on the value 0.82 ($>$0.5).

\section{Conclusion} \label{sec:conclusion}
We proposed DLBAC, a deep learning based access control approach, to deal with issues in classical access control approaches. As DLBAC learns based on metadata, it obviates the need for attribute/role engineering, policy engineering, etc.
We implemented \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\), a prototype of DLBAC, using both real-world and synthetic datasets.
We demonstrated \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\)'s effectiveness as well as its generalizability.
As the core of DLBAC is a neural network, we applied two different state-of-the-art techniques to understand DLBAC decisions in human terms.
We also discussed some future directions to build new models upon DLBAC and address current challenges, including access control administration issues.

\section{Future Research Directions} \label{sec:discussion}

In this section, we discuss some of the challenges for DLBAC and explore some ideas of how those could be addressed.

\textbf{Access Control Administration.} A major task in access control is policy administration, i.e. updating the system's rules to affect a particular change. It is a significant challenge for DLBAC as a policy change amounts to adjusting the current neural network's weights. This can, of course, be obtained by retraining the network. However, that is neither ideal nor cost-effective. Fine-tuning is one of the common approaches that helps a neural network to learn new changes by updating the current network's weight~\cite{kaya2019analysis}. This allows one to implement policy changes by making minor changes to the network. However, the network should handle the issue of catastrophic forgetting, which is a common pitfall in fine-tuning.
We believe these issues can be effectively mitigated by developing methods based on life-long learning~\cite{parisi2019continual} for DLBAC.

\textbf{Adversarial Attacks.} Adversarial attacks are a common concern for any machine learning based system, deep learning networks in particular. An adversary can obtain unauthorized access by fooling the network with modified samples that are indistinguishable from natural ones by human~\cite{zheng2019distributionally}.
However, such attacks could be mitigated by applying adversarial training~\cite{madry2017towards}.
In the context of DLBAC, an adversarial attack is to acquire access permissions based on modified/perturbed user and resource metadata.
In access control, the datasets and the adversarial attack profile are somewhat interesting and different from traditional image domains. One typically expects a mix of categorical and continuous metadata. Moreover, since some metadata are more trustworthy than others, an adversary does not have the complete flexibility to change an entire sample imperceptibly.
These observations could be leveraged to develop better defenses against adversarial attacks in DLBAC. Another related aspect needs to investigate whether DLBAC can efficiently handle an access request if some of its user/resource metadata are deleted, a.k.a attribute hiding attack.

\textbf{Bias and Fairness.} As DLBAC learns based on metadata distributed across various parts of an enterprise, there might be different types of human biases or errors in training data.
As such, the DLBAC network trained based on such data can inadvertently be biased, favoring some decisions. For example, as observed in the \(amazon$-$kaggle\) dataset, most of the authorization tuples were with `grant' decision, and \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) instances were biased towards the same decision. Certain metadata could be influenced by various factors including ethnographic.
Therefore, to obtain a fair and trustworthy DLBAC system, it is critical to audit training data, evaluate decisions for fairness, and establish a proper feedback loop~\cite{mehrabi2019survey}.

\textbf{DLBAC in Tandem with Traditional Access Control.} Evidently, in practice, we do not foresee (nor advocate) that DLBAC will simply substitute traditional forms of access control immediately. One research challenge is how DLBAC could be effectively integrated to operate in tandem with traditional access controls such as RBAC or ABAC. One of the issues that will arise is conflicting decisions between, say, RBAC and DLBAC. If that conflict were to be resolved in favor of RBAC, that decision could be used to fine-tune the DLBAC network. DLBAC could also be used in the background for monitoring or auditing purposes.

\section{\(\textrm{DLBAC}\textsubscript{\textgreek{a}}\): A Candidate DLBAC Model} \label{sec:dlbac-alpha}

This section presents a prototype of DLBAC, namely \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\), which is an access control model built upon the proposed DLBAC approach in Section~\ref{sec:dlbac}.
As illustrated in Figure~\ref{fig:conceptualRepresentation}, DLBAC models e.g., \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) need to be fed with authorization tuples and user/resource metadata.
We apply \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) to two real-world and eight synthetic datasets. First, we explain synthetic datasets construction and introduce real-world datasets. Then, we discuss how the \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) neural network is trained, and access decisions are made.

\subsection{Synthetic Dataset Generation}
\label{sec:datasetGeneration}
An approach to generate synthetic access control datasets was proposed in \cite{xu2014mining}. We adopt this approach with minor changes to generate multiple synthetic datasets and briefly discuss here.
The algorithm first generates a set of attribute names for users and resources randomly. Next, it generates a set of \textit{rules} based on those attributes and then uses these rules to inform user/resource creation and attribute value assignments. Each \textit{rule} is a tuple of the form $\langle \mathit{UAE}; \mathit{RAE}; OP; C \rangle$, where $\mathit{UAE}$ is the set of user attribute expression, $\mathit{RAE}$ is the set of resource attribute expression, $C$ is the set of constraints, and $OP$ is a set of operations. For example,
\textit{$\langle$title=student; type=document; {read}; department=department$\rangle$} is a rule where \textit{title=student} represents the UAE, \textit{type=document} is the RAE, \textit{read} is the operation, and \textit{department=department} is the constraint.
A user will be authorized to operate on a resource if the user satisfies the UAE, the resource satisfies the RAE, and both the user and resource satisfy the constraint.
For each rule, the algorithm generates a set of users that satisfy the rule and then generates resources where for each resource, there is at least one user available to satisfy the rule.
The following user and resource are created based on the above rule:
\textit{user(student1, title=student, department=cs)},
\textit{resource(document1, department=cs, type=document)}.
Here, the \textit{student1} and \textit{document1} are the unique ids of a user and a resource, respectively. The user \emph{student1} has two attributes (\emph{title} and \emph{department}), and the resource \emph{document1} has two attributes (department and type). Also, student1 satisfies UAE, as the user has the title \textit{student} which is part of the title in UAE. Similarly, document1 satisfies RAE for the \emph{type} attribute. Both \emph{student1} and \emph{document1} satisfy the constraint as they are from the same department. Thus, according to this rule, \emph{student1} has \emph{read} access to \emph{document1}.

Finally, once the rules are generated, users and resources are created, and attributes are assigned, it is straight-forward to create the authorization tuples. For each user, resource and operation combination that satisfies a rule, an authorization tuple is created or updated with a new operation, as the case may be.

\subsubsection{Syntax of Synthetic Dataset}
We adapt this data generation approach by creating many metadata instead of attributes.
We maintain four operations and various metadata (eight to thirteen) for each user/resource for different datasets.
We define the syntax of \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\)'s dataset to contain a set of authorization tuples. An authorization tuple could be illustrated of the form $\langle uid | rid | m^u_1:v_1, m^u_2:v_2, ..., m^u_i:v_i | m^r_1:v_1, m^r_2:v_2, ..., m^r_j:v_j | \langle op_1, op_2, op_3, op_4\rangle\rangle$. The uid and rid in the tuple indicates the unique id of a user and a resource, respectively. The next part gives the metadata values of all $i$ metadata of a user and $m^u_1$ indicates the first user metadata name (e.g. umeta0) whereas its value is indicated by $v_1$. The subsequent part presents the metadata values of all $j$ metadata of a resource, and first resource metadata name (e.g. rmeta0) and its value are represented by $m^r_1$ and $v_1$, respectively. The last part is a binary sequence with a `1' meaning `grant' and a `0' meaning `deny' for that operation. For example, $ \langle 1011 | 2021 | $\textit{30 49 5 26 63 129 3 42 $|$ 43 49 5 16 63 108 3 3 $|\langle$1 1 0 1}$\rangle\rangle$ is a sample authorization tuple of our dataset where 1011 and 2021 are the user and resource's unique number. The next eight numbers indicate the metadata values of a user, the following eight numbers represent resource's metadata values, and the final four binary digits signify the user has $op_1, op_2, op_4$ access to the resource. (In the example above, we also skip naming the metadata with the assumption that it could be inferred from the position of the metadata value.)  For simplicity, we assume the metadata values in our datasets are categorical, and each metadata value is an \textit{integer} representation of a category. We anticipate that our results will hold even in cases of metadata with \emph{real numbers}.

\subsubsection{Dataset Visualization}
\input{graphics/fig-dataset-complexity-comparison-all}
We use t-SNE plots~\cite{van2008t-SNE} to visualize the samples in our datasets. A t-SNE plot discovers relationships in the data by identifying analogous clusters of data points with several features and projecting high dimensional features into a low dimensional feature space while retaining essential information.
We project each of our samples to a 2-dimensional feature and plot them. (Note that our datasets have varying numbers of features/metadata ranging from 16 to 26 in total.)
Each \textit{dot} in the plot (Figure~\ref{fig:complexDataset-tSNE}) represents an authorization tuple, where multiple tuples of the same color indicate that they have the same access permissions. For example, two tuples with only \textit{read} and \textit{write} access permissions will have the same color. Notably, a dataset with n operations will have tuples with $2^n$ different access combinations and plotted with $2^n$ distinct colors. For instance, the authorization tuples of a dataset with two operations (e.g., read and write) can be plotted with four different colors (tuples with the read access, write access, read and write access, and no access).

The position of a tuple in the plot is fixed according to the user and resource metadata values. For instance, two different users with the same metadata values may have access to a resource (or multiple resources with the same metadata values). Therefore, these tuples will have the same position regardless of their access permissions.
Figure~\ref{fig:complexDataset-tSNE}(a) depicts a dataset of $1650$ users and $320$ resources. The tuples (dots) take the position all over the plot according to their metadata values. This dataset has four different operations, and thereby, there are tuples with 16 distinct colors.
However, we observe different tuples with the same access permission (same color) are grouped, and groups are isolated from one another, as shown in the figure with blue circles. Thus, a simple classifier can easily distinguish them without much difficulty (e.g., making one rule for each circle).
The access control states in real-world situations might be much more complicated~\cite{molloy2011adversaries}. Figure~\ref{fig:complexDataset-tSNE}(e) shows the visualization of a dataset from Amazon.
Even though this is not a complete access control scenario of the entire Amazon enterprise~\cite{cotrini2018Rhapsody}, samples with access (green dots) significantly overlap with other samples without access (red dots) which means tuples with very similar metadata values have entirely different accesses. A simple classifier would create too many rules to model such a dataset.

\subsubsection{Introducing Complexity into Synthetic Datasets}
\label{sec:introRealWorldComplexity}
Informed by t-SNE visualization of the Amazon dataset, we seek to introduce complexity into our synthetic datatsets to closely reflect real-world situations. We observe that, in practice, the access privileges of users and resources with somewhat similar metadata could vary. It is also expected that not all the metadata of a user/resource would contribute equally to their permissions.
To reflect such scenarios in some of our datasets, we determine accesses considering \emph{all} the metadata values of user and resource but \emph{hide} a portion of metadata values from the policy miner (when dealing with mining methods) and model training phase (when dealing with ML methods). However, during rule generation, we ensure that the metadata that we will hide contributes to a lesser extent toward permission decisions by excluding them from being part of the \textit{constraint} of the rules. In a nutshell, hiding metadata attempts to simulate a scenario, where access decisions are made based on access control \emph{attributes} that are not fully informed by the entire metadata set. In a perfect world, access control attributes could succinctly capture the relevant metadata distributed across an organization. However, it is reasonable to hypothesize that this is not a practical assumption.

Figure~\ref{fig:complexDataset-tSNE}(b) represents a dataset with 11 user and 11 resource metadata. The authorization tuples were created considering all the metadata. To simulate a similar situation while visualizing tuples and understand how it looks from a policy mining (or classification) perspective, we make only the first eight user and the first eight resource metadata values available for visualization. As shown, many dots of other colors now start to mix, indicating two tuples with similar user-resource metadata values may have very different accesses.
Indeed, such proximity of the tuples is challenging for clustering or rule creation. The more metadata we hide, the more complicated the dataset for policy mining and ML approaches.

\input{graphics/fig-dataset-all-datasets}
\input{tables/tab-dataset}

We still notice a few portions in the plot where the same colored dots are clustered together and separable, as shown with red circles in Figure~\ref{fig:complexDataset-tSNE}(b). This is because the dataset generation algorithm~\cite{xu2014mining} creates the metadata values based on a distribution, where the value range (i.e., number of values for each metadata) is sparse. For example, there are around one hundred different values for specific metadata (e.g., \emph{department}) in a dataset with hundred users. One can easily cluster all the users into hundreds of groups based only on the department. However, there might be the case where metadata values are required to be chosen from a set of a limited number of values (say, ten departments for hundred users). Evidently, it is harder to cluster one hundred users into ten groups than a hundred. To reflect this, for each metadata, we define a fixed and smaller set of values (6 to 20 unique values) following the same distribution used by Xu et al.~\cite{xu2014mining}. We choose each metadata value from the corresponding list during user/resource creation and metadata value assignment.
This strategy creates datasets with significantly overlapped samples as depicted in Figure~\ref{fig:complexDataset-tSNE}(c).
We also extended the number of users and resources to simulate a larger organization, which adds more overlaps among samples and higher complexity to the dataset, as shown in Figure~\ref{fig:complexDataset-tSNE}(d).

Finally, we synthesized eight different datasets (datasets \#3-\#10 in Table \ref{tab:ourDataset}) used for \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) experimentation and evaluation, with varying numbers of users, resources, user and resource metadata, and authorization tuples, each reflecting a varying degree of complexity. We use the following naming convention for our synthetic datasets, as listed in Table~\ref{tab:ourDataset}:
$u\langle$approx. number of users$\rangle-r\langle$approx. number of resources$\rangle-auth\langle$approx. number of authorization tuples$\rangle$.
We use `u', `r', and `auth' to indicate users, resources, and authorization tuples, respectively. We also visualize all the synthetic datasets in Figure~\ref{fig:allDatasets-tSNE}(a-h) using t-SNE plots. As illustrated in the Figure, each plot has dots with one of 16 different colors (for four operations), and those dots mix extensively.

\subsection{Real-world Dataset}
\label{sec:realworldDataset}
Amazon published two datasets that contain access control information which is widely used in access control research~\cite{cotrini2018Rhapsody, cappelletti2019quality, karimi2021automatic}. We name these datasets as \(amazon$-$kaggle\) and \(amazon$-$uci\), and list them in the Table~\ref{tab:ourDataset} (1-2).
The \(amazon$-$kaggle\) dataset was released in Kaggle~\cite{AmazonKaggle2013} (a platform for predictive modeling competitions) as a challenge to the community to build a machine learning model to determine the employees' accesses. The dataset holds historical access data where employees were manually allowed or denied access to resources over time. The dataset has about nine thousand users and seven thousand resources with over 32K authorizations tuples. Each tuple specifies eight user metadata that depicts a user's properties, a resource id to identify the resource, and a binary flag to indicate whether the user has access to the resource or not. However, the dataset is highly imbalanced, and about 93\% of the tuples are with grant access. We visualize this dataset in Figure~\ref{fig:allDatasets-tSNE}(i). As we see, there are dots from two colors where green and red correspond to tuples with grant and deny access, each. Notably, a significant number of dots are from grant accesses.

The \(amazon$-$uci\) dataset was provided by Amazon in the UCI machine learning repository~\cite{AmazonUCI2011}. This dataset contains access information of more than 36,000 users and 27,000 permissions. For any permission, less than 10\% of all users have requested access. The dataset is widely used in access control researches, and in most of the cases, the experiments are confined to only 5 to 8 most requested permissions~\cite{cappelletti2019quality, cotrini2018Rhapsody, karimi2021automatic}. Likewise, we took the seven most requested permissions, and for each permission, we list users who have access to the selected permissions. However, this dataset is also imbalanced, around 75\% tuples with the deny access. In addition, the dataset is not ABAC in nature, and there are some tuples in the dataset where users with identical attribute values do not have the same access permissions. Because of this, policy mining or classification approaches may suffer while clustering the users for different permissions.
We visualize this dataset in Figure~\ref{fig:allDatasets-tSNE}(j).

\subsection{Neural Network Architecture and Training}
\label{sec:organizingTrainingData}

\begin{figure}[t]
\centering
\includegraphics[width=\linewidth] {graphics/organizing_training_data_dlbacalpha.png}
\caption{Preparing Training Data for \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\).}
\label{fig:organizingTrainingDataForDLBACalpha}
\vspace{-2ex}
\end{figure}

For \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\), the deep neural network takes user/resource metadata values as input. It includes a
classification layer with the number of neurons equal to the number of operations, where each neuron outputs the \emph{probability} of granting the permission for a related operation, \textit{op}.
Given a feature vector $x$ of the user and resource metadata, the neural network can be defined as a prediction function $f$ such that $\hat{y} = f(x)$, where $\hat{y}$ is the predicted label or permission (grant (1) or deny (0)) of $op$, obtained from comparing the probability of granting the permission at the output of the network with a \emph{threshold}.
Note that for all \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) experimentation, we consider a threshold of 0.5.
To train the neural network $f$ (i.e. determine the network's weights), a set of training authorization tuples $\mathbb X$ of size $N$ is collected, where $(x_{i}, y_{i})$ denotes the $i$-th sample in $\mathbb X$, where $x_{i}$ is the feature vector of the user and resource metadata and $y_{i}$ is the corresponding $op$ or the target label.
As discussed in Section~\ref{sec:introRealWorldComplexity}, for some synthetic datasets, we hide a portion of metadata from the policy mining algorithm to mimic some complex situations. We apply this for the datasets having more than eight user metadata and eight resource metadata. In such a case, $x_{i}$ represents the feature vector of the first \emph{eight user metadata} and the first \emph{eight resource metadata}. So, for example, for a dataset with 13 user-resource metadata, we hide five metadata from the user metadata and five from the resource metadata.

Since the metadata values in our dataset are categorical, we map them to binary values by utilizing encoding. We encode a tuple's user/resource metadata value using \textit{one-hot encoding}~\cite{hancock2020survey} to transform the categorical values into a two-dimensional binary array. The row in the array represents metadata, and the column holds the encoded binary representation of the corresponding metadata value.
(Amazon dataset's metadata values are too sparse, and we use \emph{binary encoding} for them considering its memory efficiency in such cases~\cite{seger2018investigation}).
As each operation is binary, we apply them directly as the target labels without any processing. Figure~\ref{fig:organizingTrainingDataForDLBACalpha} illustrates the overall training data preparation for \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\). As illustrated, we encode the metadata values of a user $Alice$ and a resource $projectA$ and apply permissions to the associated operations without further processing.
We train \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) based on the training data,
and this \textit{trained} \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) is used in \textit{Access Control Decision Engine} (discussed below) to produce access decisions for test data.

\begin{figure}[t]
\centering
\includegraphics[width= 0.8\linewidth, scale = 0.9] {graphics/decision_making_dlbacalpha.png}
\caption{Decision Making Process in \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\).}
\label{fig:decisionMakingProcessDLBACalpha}
\vspace{-1ex}
\end{figure}

\subsection{Decision Making Process in \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\)}
\label{sec:decisionProcessDLBACalpha}

\textit{Access Control Decision Engine (Decision Engine)} is a DLBAC component responsible for receiving and authorizing any access request. In \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\), the \textit{Decision Engine} (Figure~\ref{fig:decisionMakingProcessDLBACalpha}) takes three inputs (\textit{user, resource, and operation}).
The \textit{Decision Engine} retrieves the user and resource metadata from the internal databases and then encodes them to obtain corresponding binary representation.
The encoded input is fed into the neural network to predict the corresponding request's access permission. The network outputs access information for all the operations. The decision engine then determines the actual access authorization based on the requested access and the network's output.
For the specific example in Figure~\ref{fig:decisionMakingProcessDLBACalpha}, user \emph{Alice} wants \emph{op2} access on \emph{projectA} resource. The output of the neural network for the \emph{op2} is $1$, which indicates that \emph{Alice} has \emph{op2} access on \emph{projectA}. Thus, the \textit{Decision Engine} authorizes this request.

\section{Deep Learning Based Access Control} \label{sec:dlbac}

\begin{figure}[t]
\vspace{-2ex}
\centering
	\includegraphics[width=\linewidth]
	{graphics/DecisionMakingRBAC_ABAC_DLBAC.png}
	\caption{Decision Making in Classical Approaches vs. DLBAC.}
	\label{fig:decisionMaking}
	\vspace{-2ex}
\end{figure}

In this section, we provide a brief overview of DLBAC and explain how it differs from classical approaches.

\subsection{Decision Making in Classical Approaches vs. DLBAC}
\label{sec:decisionMakingInClassicalDLBAC}
Figure~\ref{fig:decisionMaking} illustrates how DLBAC makes a decision as compared to two classical access control approaches (the discussion applies to other forms of access control approaches such as relationship based access control or ReBAC~\cite{cheng2016}). In RBAC, an access control decision is simply a cross-reference between user-role and permission-role assignment relations. In the case of ABAC, an access control rule is evaluated for a given operation based on the attributes of the user and resource in question (sometimes attributes of other entities such as ``environment'' are used as well). In DLBAC, a deep neural network makes an access control decision based on the available \emph{metadata} for the user and resource.
For example, metadata could include logs of accesses, employee join date, access time,
network access profil
, etc. For simplicity, we assume metadata are represented as name-value pairs. While syntactically they appear to be the same as attributes, which are often name-value pairs as well, semantically they are very different. Metadata are primarily different from attributes since they do not go through the access control design and engineering process. A typical organization could host multiple applications such as email, file storage, human resources, benefits, and other cloud services. Each of those applications hold metadata about users and resources in the organization. Metadata are designed inherently as part of the functionality engineering phase of the system instead of during the access control design phase of the system. Therefore, they are immediately available to DLBAC once the system is implemented.
For example, `join\_date', `spending\_history' and  `credit\_history' could be metadata of customer, whereas an engineered attribute could be `status' (such as `status $=$ platinum'), determined based on all of those metadata.

\begin{figure}[t]
\vspace{-2ex}
\centering
	\includegraphics[width=\linewidth]
	{graphics/ConceptualRepresentation_RBAC_ABAC_DLBAC.png}
	\caption{Design Process of Classical Approaches vs. DLBAC.}
	\label{fig:conceptualRepresentation}
	\vspace{-2ex}
\end{figure}

\subsection{Policy Engineering in Classical Approaches vs. DLBAC}
\label{sec:policyEngineeringInClassicalApproaches}

A conceptual representation of classical access control approaches versus DLBAC is depicted in Figure~\ref{fig:conceptualRepresentation}. For simplicity, we assume all methods obtain the current access control state of the system as authorization tuples (e.g., $\langle$user, resource, operations$\rangle$), and the metadata of users (e.g., $\langle$designation, ``employee''$\rangle$) and resources (e.g., $\langle$size, ``small''$\rangle$) as the input.
In ABAC, the first step of \textit{attribute engineering} involves designing users and resources attributes in the system that are selected and properly assigned based on available metadata. Common to ABAC and RBAC, the second stage is \textit{policy mining/engineering}, through which proper policies are developed.  Access control mining algorithms, including those using machine learning (ML), are summarized in Section~\ref{sec:relatedwork}. The last element in the conceptual representation of models is the output. For the RBAC approach, the mining process's output is a set of roles, permission assignment to roles (PA), and user assignment to roles (UA). For ABAC, the output includes a policy consisting of a set of access control rules. (Note that most ABAC mining works assume that attributes and attribute assignments are already available~\cite{sanders2019miningLeastPriviledgeABAC,narouei2019natureInspiredABACMining}). In contrast, DLBAC is an end-to-end access control approach. It does not need attribute engineering since it works directly with the users and resources metadata. The DLBAC approach's output is a trained neural network, which takes user and resource metadata as input and makes access control decisions. We note that the DLBAC is agnostic to any deep neural network architecture.

\section{Evaluation} \label{sec:evaluation}
In this section, we experimentally evaluate the performance of \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) using both synthetic and real-world datasets.

\subsection{Evaluation Methodology}
\label{sec:evaluationMethodology}
We experiment
and evaluate the performance for all the datasets listed in Table~\ref{tab:ourDataset}. We consider each dataset to represent an organization with its own unique characteristics.
We split each dataset into training (80\%) and testing (20\%) sets. As the test dataset is entirely \textit{unseen} during training, the evaluation shall adequately measure the generalization of any method.

\textbf{Instances of \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\).} DLBAC is agnostic to deep neural network architecture, and we will show that the deep learning-based model's performance is consistent across datasets. For demonstration, we implement three instances of \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) using three distinct deep neural network architectures including ResNet~\cite{he2016deep}, DenseNet~\cite{huang2017densely}, and Xception~\cite{chollet2017xception}, and name them as \(\textrm{DLBAC}\textsubscript{\textgreek{a}$-$R}\), \(\textrm{DLBAC}\textsubscript{\textgreek{a}$-$D}\), and \(\textrm{DLBAC}\textsubscript{\textgreek{a}$-$X}\), respectively. For \(\textrm{DLBAC}\textsubscript{\textgreek{a}$-$R}\), we use the ResNet network with depth 8 for the first four datasets in Table~\ref{tab:ourDataset} whereas, for the rest of the datasets, we use a ResNet with depth 50. For \(\textrm{DLBAC}\textsubscript{\textgreek{a}$-$D}\), we use the DenseNet architecture with [6,12,24,16] layers in the four dense blocks. We adopt the source code from the Keras application for all the model architectures implementation.\footnote{\url{https://github.com/keras-team/keras-applications}}

The \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) instances were developed in Python using Keras library with a TensorFlow backend and trained on Google Colab (a 12GB NVIDIA Tesla K80 GPU).
We apply Adam optimizer with an initial learning rate of 0.001, scheduled to reduce the learning rate by dividing by ten after every 10 epochs. The epoch and batch size was chosen as 60 and 16, respectively, with an early stop after 5 consecutive epochs without any performance improvement. As the \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) outputs an access probability between `0' and `1' for each operation, we use binary cross-entropy loss. We have created a repository in GitHub consisting of all the datasets, source code, and trained networks.\footnote{\url{https://github.com/dlbac/DlbacAlpha}}

\textbf{Machine learning (ML) algorithms.}
We compare the performance of \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) instances with classical machine learning approaches such as Support Vector Machine (SVM)~\cite{cortes1995support} and Random Forests (RF)~\cite{breiman2001random}. We also compare with Multi-Layer Perceptron (MLP)~\cite{schmidhuber2015deep} with four hidden layers (a shallow network) to evaluate how significant the performance difference is between a deep and a non-deep neural network.
We use the \textit{SVC} and \textit{RandomForestClassifier} class of the Python scikit-learn library~\cite{scikit-learn} for SVM and RF implementation, respectively, with their default configurations. We implement MLP using Keras library.

\textbf{Policy mining algorithms.}
There is no other existing \textit{deep learning-based} access control approach to the best of our knowledge, so a direct comparison of our work results is not currently possible. Therefore, we compare \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) with ABAC policy mining algorithms being one of the flexible and generalized access control approaches.
We compare the performance of \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) instances with the following policy mining algorithms. While a few other works exist as discussed in our related work, a key decision factor in selecting these works was our ability to readily access their source codes and our ability to clearly understand, modify/tweak as needed and compile them.
\begin{enumerate}
\item The policy mining algorithm proposed by Xu and Stoller~\cite{xu2014mining}, which we refer to as XuStoller.
\item Rhapsody~\cite{cotrini2018Rhapsody}, a policy mining algorithm built upon an ML algorithm for subgroup discovery named APRIORI-SD~\cite{kavvsek2006apriori-sd}. Rhapsody performance has a direct correlation with multiple parameters. We trial with different parameter values and selected the policy with the highest F1 score while maintaining an FPR below 0.05.
\item EPDE-ML~\cite{liu2021efficient}, a permission decision engine scheme based on ML where a trained RF model makes the access control decision.
\end{enumerate}

\textbf{Evaluation metrics.}
For ML algorithms, we compute the F1 score and compare the performance with \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) instances and show that deep learning based algorithms generally perform better than traditional ML and MLP techniques. For an extensive comparison against policy mining algorithms, we compute the F1 score, False Positive Rate (FPR), True Positive Rate (TPR), and Precision. We consider the standard definitions~\cite{liu2021efficient, cotrini2018Rhapsody} of these evaluation metrics. Policies (or models) with a higher F1 score lead to better generalization. They can make more accurate access control decisions on users and resources with attributes not explicitly seen during the mining (or training) process. Also, the higher TPR and Precision are better as these scores indicate how accurately and efficiently the policies (or models) can grant access. On the contrary, the policies (or models) with a lower FPR are better as they are less likely to give access to requests, those which should be denied according to the ground truth access control policy.

\subsection{Results}
\subsubsection{Performance comparison with ML algorithms}

\begin{figure}[t]
\vspace{-2ex}
\centering
\includegraphics[width=\linewidth]
{graphics/evaluation/f1_ml_algos.png}
\caption{F1 Score Comparison: ML Algorithms vs. \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) Instances.}
\label{fig:determiningEffectiveMLTechnique}
\vspace{-2ex}
\end{figure}

Figure~\ref{fig:determiningEffectiveMLTechnique} illustrates the overall performance of all ML approaches and \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) instances for each dataset with respect to F1 score. The performance of all the algorithms is consistent and better for the \(amazon$-$kaggle\) dataset, but it is not the case for \(amazon$-$uci\) dataset. In this case, SVM and MLP performed significantly lower, and other approaches including \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) instances could not achieve high performance. Such a result is expected due to the inconsistency in the access permissions in that dataset. The dataset contains tuples where users with identical attribute values do not have the same access permissions, as discussed in Section~\ref{sec:realworldDataset}.
The advantage of the DLBAC approach is more evident if the dataset is processed correctly. We show this using our synthetic datasets. For synthetic datasets, \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) instances achieved the highest F1 score, while SVM and MLP performed the worst.
Also, the instances of \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\)'s improvements over RF are significant (for p-value $<$ 0.05; paired T-test (not shown here)) for all the synthetic datasets except \(u5k$-$r5k$-$auth12k\) dataset.
The performance advantage of \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) instances is particularly pronounced in synthetic datasets with a large number of authorization tuples, where \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) instances report 0.03 to 0.09 improvements over RF as shown in the figure. Notably, the performances of all algorithms vary with the complexity of the datasets. However, \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) instances show the lowest variation in its performance across the datasets, implying that \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) is most robust against changes in data characteristics such as number of hidden metadata, number of users, resources, and authorization tuples. Except for the \(u4k$-$r6k$-$auth28k\) dataset, all algorithms' performances drop with the increase of hidden metadata (e.g., the \(u4k$-$r4k$-$auth22k\) dataset with 13 metadata where we hide 5 of the metadata from the feature vector as discussed in Section~\ref{sec:organizingTrainingData}), suggesting that an increase in data complexity generally impacts performance. Overall, the experimental results indicate that \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) is more effective and robust than classical ML approaches, including MLP, for making accurate access decisions.

While the performance advantages of \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) are not apparent in the Amazon datasets, we emphasize that those datasets are not reflective of the access state complexity of the entire organization but that of a small portion of the company. This is one of the reasons why we synthesized additional datasets for our experimentation.

\subsubsection{Performance comparison with policy mining algorithms}

\begin{figure}[t]
\vspace{-2ex}
\centering
\includegraphics[width=\linewidth]
{graphics/evaluation/f1_mining_algos.png}
\caption{F1 Score Comparison: Policy Mining Algorithms vs. \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) Instances.}
\label{fig:f1compareDLBACalphaPolicyMining}
\vspace{-2ex}
\end{figure}

\begin{figure}[t]
\vspace{-1ex}
\centering
\includegraphics[width=\linewidth]
{graphics/evaluation/fpr_mining_algos.png}
\caption{FPR Comparison: Policy Mining Algorithms vs. \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) Instances.}
\label{fig:fprCompareDLBACalphaPolicyMining}
\vspace{-2ex}
\end{figure}

\begin{figure}[t]
\vspace{-1ex}
\centering
\includegraphics[width=\linewidth]
{graphics/evaluation/tpr_mining_algos.png}
\caption{TPR Comparison: Policy Mining Algorithms vs. \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) Instances.}
\label{fig:tprCompareDLBACalphaPolicyMining}
\vspace{-2ex}
\end{figure}

\begin{figure}[t]
\vspace{-2ex}
\centering
\includegraphics[width=\linewidth]
{graphics/evaluation/precision_mining_algos.png}
\caption{Precision Comparison: Policy Mining Algorithms vs. \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) Instances.}
\label{fig:precisionCompareDLBACalphaPolicyMining}
\vspace{-2ex}
\end{figure}

Figures~\ref{fig:f1compareDLBACalphaPolicyMining},~\ref{fig:fprCompareDLBACalphaPolicyMining},~\ref{fig:tprCompareDLBACalphaPolicyMining}, and ~\ref{fig:precisionCompareDLBACalphaPolicyMining} compare the F1 score, FPR, TPR, and Precision, respectively of policy mining algorithms and \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) instances. We could not experiment XuStoller algorithm for the largest synthetic dataset (\(u6k$-$r6k$-$auth32k\)) as it took a very long runtime without any output. We can make the following observations based on all these experimental results.
\begin{itemize}
    \item \textit{A deep learning based approach can make more accurate access control decisions and generalize better.} The F1 score of EPDE-ML and \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) instances are significantly better than the rule-based approaches such as XuStoller and Rhapsody. That signifies, in general, machine learning-based approaches can make better generalization and accurate access control decisions. As we see in Figure~\ref{fig:f1compareDLBACalphaPolicyMining}, the performance improvements of \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) instances over EPDE-ML, which is statistically significant for most datasets, suggest that deep learning based algorithms make the more accurate decision and have even better generalization capability than classical ML-based policy mining approaches.

    \item \textit{A deep learning based approach can properly balance both over-provision and under-provision.} XuStoller and Rhapsody achieved the best FPR as shown in Figure~\ref{fig:fprCompareDLBACalphaPolicyMining}, indicating they are unlikely to give access to requests that should be denied according to the actual access control policy. However, that is not the case for denying access. As we see in Figure~\ref{fig:tprCompareDLBACalphaPolicyMining}, the TPR for Rhapsody is between 0.2 to 0.85, and for XuStoller, it is from 0 to 0.25. Such a lower TPR indicates that these algorithms are pretty inefficient while denying access (under-provisioned) even though the requests deserve grant access according to the actual access control policy.

    On the other hand, the EPDE-ML performed lowest in terms of FPR (over-provisioned) across synthetic datasets ranging from 0.06 to 0.23. Their average TPR and Precision are below 0.9.

    Such higher FPR and comparably lower TPR and Precision suggest that EPDE-ML could not achieve desirable performance in terms of over-provision and under-provision. The \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) instances obtained a much higher TPR and Precision as illustrated in Figure~\ref{fig:tprCompareDLBACalphaPolicyMining} and~\ref{fig:precisionCompareDLBACalphaPolicyMining}. Also, the  \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) instances reached an FPR which is comparable to XuStoller and Rhapsody, as shown in Figure~\ref{fig:fprCompareDLBACalphaPolicyMining}. This suggests that deep learning based approach can balance better between over- and under-provisioning.

    \item \textit{An imbalanced dataset may affect some performance that could be calibrated.} The FPR result of \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) instances for \(amazon$-$kaggle\) dataset is high, and the TPR for \(amazon$-$uci\) dataset is relatively low, arising due to the characteristics of the dataset~\cite{weng2008new}. As discussed in Section~\ref{sec:realworldDataset}, these datasets are imbalanced, one has unreasonably more samples from the grant class, and the other has more from the deny class.
    We argue that this is a typical machine learning problem, and EPDE-ML has a similar performance for these datasets. For balanced datasets, the FPR and TPR of \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) instances are consistent, and FPR is below 0.05 for most of the datasets while TPR is above 0.95, as demonstrated in Figure~\ref{fig:fprCompareDLBACalphaPolicyMining} and~\ref{fig:tprCompareDLBACalphaPolicyMining}. Evidently, these metrics could be calibrated based on the tolerance to over vs. under-provisioning of an application context. Specifically, one could favor a particular metric in \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) by modifying the loss function to increase the weight of the minority class~\cite{ho2019real},
    adjusting the threshold for granting permissions as described in Section~\ref{sec:organizingTrainingData}, etc. We note that an improvement in one of the metrics will likely negatively impact one or more of the others and that every work is prone to this issue.

\end{itemize}

Overall, the \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) instances achieved better or comparable performance for all the metrics across datasets, suggesting that deep learning based approaches generalized better and made more accurate access control decisions than rule based and classical ML based approaches.
These results demonstrate the effectiveness of using DLBAC as an access control system.

\section{Understanding DLBAC Decisions} \label{sec:understandability}

As the core of a DLBAC system is a \textit{neural network}, a major challenge is providing insights into why and how DLBAC makes certain decisions. That is, explainability is a key challenge for DLBAC.
For instance, in Figure~\ref{fig:decisionMakingProcessDLBACalpha}, the \textit{Decision Engine} received a request that user \textit{Alice} wishes \textit{op2} access on \textit{projectA} resource.
Based on the result of the \textit{neural network}, the decision engine approved the request. However, it is not quite obvious why the \textit{neural network} made that prediction for this request. Such a justification is generally straightforward in traditional access control systems as the decisions are made based on written policies. But, it is challenging for DLBAC due to the \textit{black-box} nature of a  neural network~\cite{shrikumar2017learning}.
As the decisions are made based on provided \textit{user/resource metadata}, it is essential to understand why a decision is made and which metadata influenced that decision.
Many techniques have been introduced to help gain insights into a neural network's internal details. In this section, we investigate two state-of-the-art approaches for this purpose: \textit{Integrated Gradients}~\cite{sundararajan2017axiomatic} and \emph{Knowledge Transferring}~\cite{fukui2019distilling}. We experiment on \(\textrm{DLBAC}\textsubscript{\textgreek{a}$-$R}\) instance (as introduced in Section~\ref{sec:evaluationMethodology}), and for brevity, we refer it to \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) in the following discussion.
The related source code is uploaded to GitHub.\footnote{\url{https://github.com/dlbac/DlbacAlpha/tree/main/understanding_dlbac_alpha}}

\subsection{Integrated Gradients}
\label{integratedGradients}
\textit{Integrated Gradients} is an effective interpretation technique that focuses on attributing the decisions of a neural network to the input features of the prediction samples.
It attributes a network's decision to its input features in terms of gradient, which specifies the most effective elements for a decision. To understand the \textit{decision} of \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) for a \textit{tuple}, it is required to provide the \textit{user/resource metadata values}, the \textit{decision}, and the \textit{neural network} as input to the \textit{Integrated Gradients}. Then, \textit{Integrated Gradients} outputs the \textit{attribution scores} of the input metadata that we normalize in the scale of 0 to 1, denoting the degree of impact on the decision. Such an interpretation is known as \textit{local interpretation} which helps to better understand each decision of a neural network.
It is also helpful to have a \textit{global interpretation}~\cite{gu2019semantics} of a network to understand the network's overall knowledge. Generally, it takes a set of decisions to generate a global interpretation of a network.

For \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\), we investigate explainability for both specific access control decision and the overall knowledge learned by the network. For this purpose, we train \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) on our \(u4k$-$r4k$-$auth11k\) dataset. Then, we request \textit{op1} operation access to \textit{projectD} resource for a user \textit{Dave} and the Decision Engine grants the request. To learn the reason behind this decision, we perform local interpretation with metadata values of \textit{Dave} and \textit{projectD}, the decision (\textit{grant} access on op1 operation), and the \textit{\(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) network}. As depicted in Figure~\ref{fig:localGlobalInterpretation} (blue bars), for this particular request, user's \textit{umeta4} and resource's \textit{rmeta2} metadata are the most important and influential

\begin{figure}[t]
    \vspace{-2ex}
    \centering
	\includegraphics[width= 1.0\linewidth, scale = 1.0]
	{graphics/interpret/local_global_combined.png}
	\caption{Local and Global Interpretation (blue: local interpretation of a decision in \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\). orange: global interpretation of \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) for the grant access of an operation).}
	\label{fig:localGlobalInterpretation}
	\vspace{-2ex}
\end{figure}

To achieve global interpretation for the \textit{grant} access to \textit{op1} operation, we take the \textit{op1} access information for a set of fifty random samples with grant access from the \(u4k$-$r4k$-$auth11k\) dataset. (Note that the more samples we use, the more precise the result we get. However, Integrated Gradients is memory inefficient, so we could not test more samples using our workstation with 16 GB of memory). We provide each user/resource metadata and their respective decisions for the \textit{op1} operation to \textit{Integrated Gradients} to obtain the global interpretation. Figure~\ref{fig:localGlobalInterpretation} (orange bars) depicts the global interpretation of \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) for the \(u4k$-$r4k$-$auth11k\) dataset for the \textit{grant} access to \textit{op1} operation.
The result identifies resource's \textit{rmeta2} as the most influential metadata, user's \emph{umeta2} as second most influential metadata, and the \textit{attribution scores} of other metadata

\subsubsection{Application of Integrated Gradients based Understanding}
\label{integratedGradientsJustification}
Improved explainability could be utilized to achieve other benefits.
For instance, developers can utilize interpretation techniques to debug~\cite{nguyen2015deep} incorrect decisions from the \textit{neural network} in \textit{decision engine}. We show that \textit{Integrated Gradients} based interpretation can be used to grant/deny access permissions by modifying proper metadata. As shown in Figure~\ref{fig:modifyAccessThroughIG} (tuple2), the user \textit{Carol} doesn't have op1 access on \textit{projectC} resource. Applying local interpretation on other tuple with op1 access (e.g., Dave has the op1 access to projectD resource as shown in Figure~\ref{fig:modifyAccessThroughIG} (tuple1)) revealed the \textit{attribution scores} of different metadata for op1 operation. As circled in tuple1, \textit{Dave}'s `umeta1' and `umeta4' are the most dominant metadata for this specific access. To grant Carol's op1 access on projectC resource, we utilize \textit{attribution scores} of tuple1. Our result shows that replacing Carol's `umeta1' and `umeta4' metadata value with Dave's metadata value enables Carol's op1 access to projectC resource. As reported, modifying one or two significant metadata changes corresponding access. The opposite holds for least-significant metadata where modifying multiple metadata could not alter related access.

We also experiment with such a metadata value modification across all the samples of a specific decision (e.g., tuples with `deny' access on op1) in the same dataset to see the impact of a global interpretation.
The idea is to alter the metadata values of influential metadata for a specific decision. For instance, according to Figure~\ref{fig:localGlobalInterpretation}, the \emph{rmeta2} has the most influence on denying access. If we alter the \textit{rmeta2} value of any tuple, say \emph{tupleA}, with a rmeta2 value from a known tuple with \emph{grant} access, say \emph{tupleB}, the chance of denying access for \emph{tupleA} might reduce and increases the chance of getting access. Also, altering the value of multiple influential metadata of the same tuple may eventually help to get access.

To investigate that we alter different metadata values, one by one, of all the tuples with \emph{deny} access (4581 such tuples) on \emph{op1} in order of their significance level in the global interpretation. For example, we first change the value of rmeta2 metadata, next umeta2 metadata, and so on. We utilize the user/resource metadata values from tuple1 in Figure~\ref{fig:modifyAccessThroughIG} as a known tuple with the `grant' access for \emph{op1} operation. As described in Figure~\ref{fig:modifyMetadataAcrossTuplesWithDeny}, initially, with no change, no tuple has been granted access. However, with the change of first metadata (rmeta2), around 5\% of the tuples receive grant access. By changing the second metadata value, around one-third of the tuples get grant access. A similar surge continues to obtain grant access for over half of all the tuples before decreasing for sixth metadata (rmeta5) modification, reaching below 40\%. It indicates that some tuples with such a big number of metadata modifications fall under a different distribution for which they have the `deny' access. Overall, using this technique, a system admin can estimate the impact of metadata value vs. dependent accesses.

\begin{figure}[t]
    \vspace{-2ex}
    \centering
	\includegraphics[width=\linewidth]
	{graphics/interpret/IG_To_Modify_Access_with_metadata.png}
	\caption{Applying Integrated Gradients to Grant Access.}
	\label{fig:modifyAccessThroughIG}
	\vspace{-2ex}
\end{figure}

\begin{figure}[t]
    \vspace{-2ex}
    \centering
	\includegraphics[width= 0.8\linewidth, scale = 0.8]
	{graphics/interpret/impact_glabal_ig_on_access.png}
	\caption{Modifying Metadata Value Based on Integrated Gradients Across Tuples (4581 tuples) with Deny Access.}
	\label{fig:modifyMetadataAcrossTuplesWithDeny}
	\vspace{-2ex}
\end{figure}

\begin{figure}[t]
    \vspace{-1ex}
    \centering
	\includegraphics[width=\linewidth]
	{graphics/interpret/kt_technique.png}
	\caption{Knowledge Transferring Technique.}
	\label{fig:ktTechniqueDlbac}
	\vspace{-2ex}
\end{figure}

\subsection{Knowledge Transferring}
\label{knowledgeTransferring}
Although \textit{Integrated Gradients} determines the \textit{attribution scores} of each metadata for a decision, it does not establish the relationship among metadata or the network's logic~\cite{sundararajan2017axiomatic}. \textit{Knowledge Transferring} could help to identify such relationships. With \textit{Knowledge Transferring}, we can extract a decision tree to approximately understand the decision of \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) in the form of traditional rules. While accurate reconstruction of the representation details is infeasible, the generated decision tree will give an approximate explanation of the underlying logic of \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\).
Though the decision tree makes classification decisions understandable~\cite{scikit-learn}, it does not generalize as well as deep neural networks. Interestingly, a neural network's generalization ability is likely to be transferred to a decision tree through a method called \textit{distillation}~\cite{hinton2015distilling}, which has been widely used in ML literature and we adopt in this paper.
As explained in Section~\ref{sec:organizingTrainingData}, \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\)
outputs whether a user has access to any resource by giving the \textit{probability} of granting the access instead of a direct \textit{yes/no} answer. Therefore, we can determine those \textit{probability outputs} for all the \textit{tuples} in a dataset and train a decision tree, as shown in Figure~\ref{fig:ktTechniqueDlbac}. These probabilities represent the \textit{knowledge} of the neural network, and we aim to transfer it to a decision tree.

To explore \textit{Knowledge Transferring} technique, we train \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) for the \(u4k$-$r4k$-$auth11k\) dataset that we used for the Integrated Gradients experiment. We take \textit{op1} access \textit{probabilities} for all the samples. Then, we train a decision tree (DT) on the same dataset. However, instead of giving corresponding ground-truth permissions from the dataset, we provide the \textit{probability} outputs of \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\). Eventually, we construct a DT
with a maximum depth of eight that facilitates retrieving underlying rules for any specific decision. While the tree serves the global interpretation, a rule for any specific decision represents the local interpretation.
We apply the metadata values of \textit{Dave} and \textit{projectD} that we described in previous section, and retrieve the access rules from the DT for \textit{op1} operation. We observe that \textit{Dave} obtained \emph{grant} access to \textit{projectD} for \textit{op1} based on following rule:
$\bigg\langle$
$\Big\langle$
$\langle$
umeta0 $>$ 31 $\land$ umeta0 $<$ 63
$\rangle$
$\land$
$\langle$
umeta2 $<$ 20
$\rangle$
$\land$
$\langle$
umeta6 $<$ 50
$\rangle$
$\Big\rangle$
$\land$
$\Big\langle$
$\langle$
rmeta0 $<$ 72
$\rangle$
$\land$
$\langle$
rmeta2 $<$ 18
$\rangle$
$\land$
$\langle$
rmeta5 $<$ 111
$\rangle$
$\Big\rangle$
$\bigg\rangle$.
It is worth mentioning that the decision tree should be generated with unlimited depth to obtain more precise rules.
Note that the Integrated Gradients and Knowledge Transferring techniques are orthogonal in terms of insights they each provide into the neural network and do not substitute each other. For better insights, one could use both methods.

\section{Introduction and Motivation} \label{sec:introduction}

Access Control Lists (ACLs)~\cite{harrison1976HRU}, Role-Based Access Control (RBAC) \cite{sandhu1996rbac}, and Attribute Based Access Control (ABAC)~\cite{hu2013NISTguideToABAC} are some of the mainstream approaches to determine users' access to resources. Commercial solutions \cite{ferraiolo1995commercialACneeds} that cater to organizations employ one or more of these classical access control functionalities.
While tremendous progress has been made in the realm of classical access control approaches~\cite{karp2010ACEvolution},
one fundamental issue has remained the same for over forty years. Skilled security administrators needed to engineer and manage accesses as only humans could develop detailed policy insights about individuals' needs within the broader organization. Clearly, this leads to all types of errors and inefficiencies~\cite{bauer2009real}: there remain plenty of users with accesses that should not have those accesses (over-provisioned to ease administrative burden) and plenty of users that lack accesses that should indeed have those accesses (under-provisioned for the sake of tightened security)~\cite{frank2008, sinclair2008preventative}. Administrators tactfully perform a balancing act to maximize security and minimize costs. This complexity is further exacerbated with the proliferation of cloud-based applications that perform machine-to-machine access through APIs, IoT, BYOD, etc.

In this paper, we propose an automated and dynamic access control mechanism leveraging advances in deep learning technology~\cite{schmidhuber2015deep} that could complement or potentially replace the human administrator. This approach, denoted as Deep Learning Based Access Control (DLBAC), addresses three major limitations of classical access control approaches such as RBAC and ABAC.
Without loss of generality, we use the term attribute to refer to any form of traditional access control information such as roles and relationships.

\textbf{1. Attribute Engineering.}  An organization typically holds a vast number of metadata about its users and resources. However, those metadata are often not meaningful \emph{access control attributes}. As a first step, using organizational context often inferred from those metadata, administrators engineer access control specific attributes that could be used to express access control rules subsequently. This is at best an art today involving semi-formal design and requirements engineering processes~\cite{sainan2019semi-formal}.

\textbf{2. Policy Engineering.} After access control relevant attributes are engineered, administrators need to engineer access control rules. This is accomplished through either a manual engineering process akin to attribute engineering above or automated mining techniques that take as input a primitive form of access rules such as ACLs and generate approximate ABAC rules (or user-role assignments, in the case of RBAC)~\cite{krautsevich2013policyEngineeringusingRisk, das2018}. We will show that, for complex situations, DLBAC generally captures the access control state of the system with more precision than other approaches which are based on policy mining and classical machine learning.

\textbf{3. Generalization.} Most prior approaches~\cite{narouei2019natureInspiredABACMining, bui2019greedyforRebacMining} that mine access control rules from simpler forms of access control states such as ACLs focus on accurately capturing the access control state as given in those ACLs. Unfortunately, that leads to poor generalization~\cite{cotrini2018Rhapsody, xu2014mining}---that is, the ability to make better access control decisions on users and resources with attributes that were not explicitly seen during the mining process. However, this is something machine learning methods, especially deep learning, are better at. They have an innate ability to make quality predictions as long as the test sample at prediction time aligns with the training data \emph{distribution}. We will show that the engineered rules typically make poor access control decisions for user-resource metadata that were not explicitly seen by the mining process.

DLBAC addresses the above issues by exploring a fundamentally different approach to how access control is designed today.
As illustrated in Figure~\ref{fig:decisionMaking}, DLBAC differs from classical approaches by making decisions based on the \emph{metadata} of users and resources and a trained neural network. (The key distinction between the notions of \emph{metadata} and \emph{attributes} albeit semantic has important practical benefits, which is explained in section~\ref{sec:decisionMakingInClassicalDLBAC}.) It accomplishes this (see Figure~\ref{fig:conceptualRepresentation}) by first replacing access control policies with a neural network that instead makes access control decisions. Second, the neural network is trained using raw metadata from the organization instead of laboriously engineered access control attributes.

To summarize, we make the following contributions to the field of access control:
\begin{itemize}
    \item We propose DLBAC, a new approach of automated and dynamic next generation access control.
    \item We develop a candidate DLBAC model, \textrm{DLBAC}\textsubscript{\textgreek{a}}, which outperforms classical policy mining and machine learning techniques in many aspects, including capturing the existing access control state of the system accurately and generalizing well to situations that were not seen during training time.
    \item As DLBAC is a neural network, we address previously highlighted concerns on the explainability of the black-box nature of neural network-based systems for access control~\cite{cappelletti2019quality}. We apply deep learning interpretation methods to confirm that decision-making in DLBAC can indeed be understood to a large degree (albeit not with 100\% accuracy).

    \item We synthesize several large-scale access control datasets with a varying number of users and resources. We evaluate the performance of DLBAC on those synthetic datasets along with two real-world datasets.

\end{itemize}

The rest of the paper is organized as follows. Section~\ref{sec:dlbac} presents an overview of the DLBAC approach. We discuss related work in Section~\ref{sec:relatedwork}. Section~\ref{sec:dlbac-alpha} introduces some real-world datasets and presents the synthetic data generation method for \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\), a candidate DLBAC model. In the same section, we also explain the implementation of \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\). We conduct performance evaluation of \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) in Section~\ref{sec:evaluation}. We present approaches to understand \(\textrm{DLBAC}\textsubscript{\textgreek{a}}\) decisions in Section~\ref{sec:understandability}. In Section~\ref{sec:discussion}, we discuss future research directions, and conclude in Section~\ref{sec:conclusion}.

\section{Related Work} \label{sec:relatedwork}
There is plenty of work on mining/engineering policies either by analyzing the current access control state in the forms of logs and ACLs or transforming one access control model to another. We review three classes of related work below.

\textbf{Classical Policy Mining Approaches.}
A rich body of research on mining classical access control models includes RBAC, ABAC, and ReBAC.
Many algorithms were proposed to mine RBAC policies~\cite{xu2012, frank2013}, following either top-down~\cite{vaidya2010, molloy2009, mitra2016, das2018} or bottom-up~\cite{schimpf2000} methods,
while hybrid methods~\cite{frank2009} combine the advantages of both approaches.
Researchers proposed different criteria to assess the quality of mined policy~\cite{molloy2009} or satisfy various constraints while mining~\cite{jafarian2015}.
Xu and Stoller proposed an ABAC mining algorithm~\cite{xu2014mining}, a variant of which was developed to mine ABAC policies from logs~\cite{xu2014miningFromLogs}. Many approaches have been proposed to mine ABAC policies---for instance, multi-objective evolutionary optimization framework~\cite{medvet2015}, identifying functional dependencies in database tables to mine ABAC policies~\cite{talukdar2017}, and algorithms to find both positive and negative policy rules~\cite{iyer2018mining}.
Bui et. al. \cite{bui2017} utilized XuStoller's algorithm for mining policies in the ReBAC~\cite{cheng2016} context. Extended versions of this research were presented in~\cite{bui2018,bui2019rebac}. They also proposed a greedy approach for mining ReBAC policy~\cite{bui2019greedyforRebacMining}.
Iyer et al.~\cite{iyer2019} proposed a ReBAC mining algorithm in evolving systems for mining graph transitions. The authors later proposed a method for active learning~\cite{iyer2020active} of ReBAC policies from a black-box access control decision engine using authorization and equivalence queries. A universal access control policy mining, called Unicorn, was proposed by Cotrini et al. ~\cite{cotrini2019Unicorn}, which builds policies in a class of access control models including RBAC, ABAC, and ReBAC.

\textbf{Using Machine Learning (ML) for Mining Access Control.}
Many researchers applied ML algorithms for mining access control policies.  A probabilistic model for the role mining problem driven from the logical structure of RBAC was proposed by Frank et al.~\cite{frank2008}.
Deep learning was used to identify relevant attributes~\cite{alohaly2018} to mine ABAC policies from natural language.
Other methods including classification trees~\cite{chari2016}, deep recurrent neural network (RNN)~\cite{narouei2017}, K-Nearest Neighbor (KNN)~\cite{Elhadje2017}, Decision Tree~\cite{xiang2019towards,bui2020learningReBAC-ABAC,bui2020decisionTree} and Restricted Boltzmann Machine (RBM) model~\cite{Mocanu2015} have also been used to mine ABAC policy. The first unsupervised learning-based ABAC mining method used k-modes clustering to mine rules from historical operation data~\cite{karimi2018}.
Naroui et al. ~\cite{narouei2019natureInspiredABACMining} proposed to improve an existing ABAC policy by mining a policy using ML.
Cotrini et al.~\cite{cotrini2018Rhapsody} proposed an ABAC policy mining algorithm, named Rhapsody, built upon APRIORI-SD~\cite{kavvsek2006apriori-sd} which is an ML algorithm for subgroup discovery. Rhapsody mines a generalized policy based on sparse logs.
Jabal et al.~\cite{jabal2020polisma} proposed a novel framework for learning ABAC policies from data, named Polisma, combining data mining, statistical, and ML techniques. The Polisma mine a set of rules and applies ML techniques to include requests not covered by the mined rules. Karimi et al.~\cite{karimi2021automatic} proposed an automatic approach for learning ABAC policy
by extracting rules containing both positive and negative attributes and relationship filters.

\textbf{Classical ML for Access Control Decision Making.}
Classical ML approaches have been widely used for making access decisions.
Sanders et al.~\cite{sanders2019miningLeastPriviledgeABAC} presented an approach to mine ABAC policies while satisfying the least privilege principle in a large-scale organization. Symbolic and non-symbolic ML algorithms to infer ABAC policies from access logs have been proposed by Cappelletti et al.~\cite{cappelletti2019quality}.
Liu et al. \cite{liu2021efficient} proposed a permission decision engine scheme for ABAC based on Random Forest~\cite{breiman2001random}. The method, called EPDE-ML, decoupled the decision engine from the real access control policy by moving policy updates into a separate phase.

Following our discussion in Section~\ref{sec:dlbac}, DLBAC is fundamentally different from current approaches. It aims to replace traditional rule-based methods with a neural network, leading to better decision accuracy, generalizability, and engineering ease. Comparing to the related works that uses classical machine learning, we will show that a deep learning based approach provides superior performance while being amenable to usable explainability in practice.

redpajama_set_name: RedPajamaArXiv


A two colour design, hand screen printed on a premium 80% cotton 20% polyester black hooded top. Inspired by the fictional book shop featured in the 1989 film Ghostbusters II. Features a kangaroo pouch pocket with a small hidden opening for ear phone cord feed and includes convenient headphone loops.


About: what would you like to know?? Im kind, caring, honest. Fed up being hurt and lied to so please b honest.
About: Im a divorced mom with two kids. Looking for someone to date and see if we have a connection that may lead to something long term.
46 total views, 6 today.
503 total views, 1 today.
About: Anything u want to know please ask. I am in recovery. I have 2 great kids. 17 and 7. Daughter and son. I love to laugh and making others laugh.
About: I am a recently single mom of 2 wonderful children. They are my soul priority in life and will never be second to anything. I am a bit shy at first but once I warm up to you I can be funny and.


The Pirates managed just four hits today dropping a 5-2 decision to the Saint Louis Cardinals. Last year they couldn't pitch. This year they can't hit. The losing streak is now at five. It's on to Flushing to play the Mets over the weekend. No TV tomorrow because of the Pens game.
Speaking of the Pens, I'm still exhausted after last nights 3-2 overtime win. Wow, what a game. It was that type of game that made me a hockey fan long ago. All of a sudden we are back in this thing. The Caps are a good team and this will be a tough series to win. The Pens are also a good team. Penguins in 7.
The Wilkes-Barre/Scranton Pens also got back into their series with Hershey last night winning by the same score, 3-2, in overtime. Mark Letestu scored the game winner. Game four tomorrow.
The Scranton/Wilkes-Barre Yankees swept a double header from Indianapolis today winning 7-2 and 9-3. The first game started at 10am. At least I had something to listen to at work.


text:
Room – Emma Donoghue
August 24, 2012 August 24, 2012 ChristieLeave a comment
Today I am five. I was four last night going to sleep in Wardrobe, but when I woke up in Bed in the dark I am changed to five abracadabra. Before that I was three, then two, then one, then zero. "Was I minus numbers?"
Jack is the narrator of Emma Donoghue's stunning novel, Room. (Yes, I am late to the bandwagon; everyone and their dog was talking about this book when it first came out. But you all know I buy more books than it will ever be possible for me to read, right?)
From the book's opening scene until I closed the novel a few hours later I was totally mesmerized by Jack and his Ma and the eleven by eleven world they lived in, their 'Room.' Jack and Ma live in this Room because of Old Nick, a predator who kidnapped Ma when she was 19 and has held her captive for seven years. Room is a prison, but it's also the only home Jack has ever known. He doesn't understand Outside, but he's curious and Ma knows that time is running out. They must find a way to escape.
Jack is a mesmerizing character and although it was risky to allow the story be told entirely through him, it's a risk that pays off. His worldview is so naive. He has no real concept of time (his sixth birthday will happen next week, his birthday cake takes hours and hours to make) and he believes that the people in TV "are made just of colors." His world is structured: sleep, eat, exercise, watch TV, read. His only playmate is his mother, but even through his innocent eyes he can see that Ma is struggling. Sometimes she spends entire days "Gone." Sometimes she displays emotions Jack is unable to understand.
What wakes me up is a noise over and over. Ma's not in bed. There's a bit of light, the air's still icy. I look over the edge, she's in the middle of Floor going thump thump thump with her hand. "What did Floor do?"
Ma stops, she puffs out a long breath. "I need to hit something," she says, but I don't want to break anything."
"Actually, I'd love to break something. I'd love to break everything."
"I don't like her like this. "What's for breakfast?"
Room is a remarkable achievement. It reads like a thriller; I couldn't turn the pages fast enough. But it is also a beautiful testament to the power of love. What wouldn't Ma do for Jack? Even more amazing, is what Jack is willing and able to do for Ma. I'll be thinking about this book for a long time.
Book Chat2012, Book Review, Canadian, challenging, highly recommended, literary fiction
I'll Be There – Holly Goldberg Sloan
August 23, 2012 ChristieLeave a comment
Holly Goldberg Sloan is a screenwriter/director (Angels in the Outfield, Made in America) and maybe that's the problem with her debut novel, I'll Be There. It's the story of Emily and Sam who lock eyes in a church where Emily is singing, badly, her first solo, The Jackson Five's hit I'll Be There.
Emily is the daughter of Tim, a music professor, and Debbie, an ER nurse. Her younger brother is Jared. She leads a nice life. She believes in order and destiny.
Emily's interest in personal histories made her accessible to people's deepest emotions. It was as if she had some kind of magnet that pulled at someone's soul, often when he or she least expected it.
And that same magnet, which had to have been shaped like a horseshoe, allowed someone to look at her and feel the need to share a burden.
Hers was a gift that didn't have a name.
Even she didn't understand what it all meant.
Emily just knew that the grocery store clerk's cousin had slipped on a bathmat and fallen out a second-story window only to be saved because the woman landed on a discarded mattress.
But what interested Emily the most about the incident was how the cousin had subsequently met a man in physical therapy who introduced her to his half brother who she ended up marrying and then running over with her car a year later after a heated argument. And that man, it was discovered, had been the one to dump the mattress in her yard.
He'd saved her so that she could later cripple him.
Emily found that not ironic but intriguing.
Because everything, she believed, was connected.
I quote this passage because it's a great example of how Sloan's omnipotent narrator does the work for the reader. This character is like this; here is a story to illustrate that.
Sam is the son of Clarence, a psychotic criminal. Sam's brother, Riddle, is somewhere on the autism spectrum. He is also plagued with constant colds. Sam and Riddle have been on the run with their father for the last ten years. They sleep in their truck or in run-down houses. Sam looks after Riddle as best he can. They don't go to school; they don't eat properly. Everything they know they've learned from books they've found. Riddle is artistic. He draws intricate mechanical drawings in a phone book. Sam is a self-taught musical genius. He's also beautiful, selfless and perfect.
So, Emily and Sam's eyes meet and that sets off a chain of events which propels the novel forward. Not everyone gets what Emily sees in Sam. Yes, he's good-looking and polite, but he's not forthcoming with details about his life and that's worrying to Emily's parents. Until Tim hears Sam play the guitar and then all bets are off. Suddenly Sam and Riddle are pulled into the Bell's warm and welcoming circle and it's unlike anything they've ever experienced. So, clearly, it can't last.
There are reasons to like I'll Be there. Riddle is a terrific character and the relationship between the brothers is lovely. The narrative moves along quickly, perhaps because it's written in short little scenes. But that happens to be one of the book's weaknesses for me. The omniscient narrator doesn't take the trouble to develop any one character particularly well. The novel is like a bunch of soundbites strung together. Worse, even minor characters (the hairdresser who cuts Sam's hair; an old lady who finds Clarence's stash of stolen goods; the guy who buys his stolen penny collection) get their moment in the sun. Do I really need to know how their stories pan out? I guess I do if I want to wholeheartedly buy into Ms. Sloan's over-arching theme of destiny.
The tone of the novel is off-kilter for me, too. It careens from swoony romanticism to lives-in-peril to slap-stick comedy.
Will young adults enjoy this novel? Probably. It's easy to read and Sloan does most of the work for you – right down to putting white hats on the heroes and tying the whole thing with a pink bow.
Oh, wait, that's just destiny.
Book Chat2012, Book Review, teen, YA
Divergent – Veronica Roth
The dystopian landscape is popular in young adult fiction. If it's not vampires and werewolves, angels or fairies – it's likely some future version of our world where society has run amok and children are often left to fend for themselves. The most famous recent example is likely Suzanne Collins' beloved book, The Hunger Games. Veronica Roth's popular novel Divergent has gained its own rabid fans and while I understand the book's appeal, I didn't like it as much as The Hunger Games.
Beatrice is sixteen. When you turn sixteen you must choose a faction: Abnegation (selflessness), Amity (peaceful harmony), Candor (frankness, honesty), Erudite (seeking knowledge) or Dauntless( fearless). Beatrice has grown up in an Abnegation household with her parents and older brother (by just a few months, so her brother, Caleb, must also choose a faction), but she has never felt like she belonged. Selflessness doesn't come easily to Beatrice.
When I look at the Abnegation lifestyle as an outsider, I think it's beautiful. When I watch my family move in harmony; when we go to dinner parties and everyone cleans together afterward without having to be asked; when I see Caleb help strangers carry their groceries, I fall in love with this life all over again. It's only when I try to live it myself that I have trouble. It never feels genuine.
So when it comes time to choose a faction, Beatrice chooses Dauntless. Most of Divergent is concerned with Beatrice's (renamed Tris) training at the Dauntless compound. It's a bit like a reality show: candidates are put through a series of tests and the best man (or woman) wins. Those who don't make it – because they either quit or fail – suffer worse fates. You can't go home again so you're factionless, left to scrounge for food or do the most menial jobs available.
Tris is smart, no question, but what was missing for me was the back story which Katniss Everdeen had in spades. Katniss is a beautifully written character, someone I rooted for and understood. Tris, despite her upbringing, adapts relatively easily to her new faction – learning how to fight and lie with relative ease. Perhaps Roth was thinking of the nature versus nurture debate: how much of what we are is because of environment and how much is because of biology?
My issues with the book are minor quibbles, though. Despite being almost 500 pages long, I breezed through it. Sometimes I felt like the plot was being served rather than unraveled in a meaningful and organic way. Characters turned up conveniently and were dispensed with equally trouble-free. I know many will argue that Divergent offers lots of talking points, but I didn't leave that shattered Chicago landscape feeling all that inclined to revisit.
All that said, I know there will be students in my class who will enjoy the novel and I would have no trouble recommending it – even if only as a way to talk about characterization: it's difficult to mourn for people you don't feel you know.
Rape: A Love Story – Joyce Carol Oates
Joyce Carol Oates wastes no time cutting to the chase in her novella, Rape: A Love Story.
After she was gang – raped, kicked and beaten and left to die on the floor of the filthy boathouse at Rocky Point Park. After she was dragged into the boathouse by the five drunken guys – unless there were six, or seven – and her twelve-year-old daughter with her screaming Let us go! Don't hurt us! Please don't hurt us!
Teena Maguire and her 12 – year – old daughter, Bethie, leave a July 4th party after midnight and cut through Rocky Point Park. They take a short-cut through the woods and encounter the group of drunken men – many of whom are known to Teena from around her Niagara Falls neighbourhood.
Although Bethie is beaten, she manages to escape and hide under a boat. She listens as her mother is raped and savagely beaten and left for dead. The reader is not spared from the horror of this crime, but Oates – skillful writer that she is – never crosses the line into gratuitous.
Bethie manages to attract the attention of a police officer and it happens to be Officer Dromoor, a man who knows Teena because of an encounter they'd had one night at a local bar. Dromoor is a good man – a married father-to-be with a finely attuned sense of justice.
Teena survives the attack, but her life is forever altered. Rape: A Love Story sets about examining the ways in which this horrific incident changes her and Bethie and Dromoor and even three of the perpetrators and their families. It asks questions like was Teena dressed inappropriately and thus 'asking for it'? Oates doesn't offer any answers, though.
I have a love/hate relationship with Oates. There's no denying her considerable talent, but sometimes I find her hard work. It's not style over substance – although, no question she has some stylistic tics which take some getting used to. In Rape, she employs second person narrative (always a risky choice, imho, although clearly well-handled here), choppy sentences, and a narrative that jumps around. But, let's face it, she's Joyce Carol Oates.
I always want to like her more than I actually do.
Book Chat2012, Book Chat, Book Review, challenging, explicit, literary fiction
The House at Riverton – Kate Morton
August 8, 2012 Christie1 Comment
I'm sure many of you have already read Kate Morton's debut novel, The House at Riverton, but I only just finished it yesterday afternoon. If you haven't already found a book to while away the dog day's of summer, might I suggest you run to your bookstore immediately and purchase this one. Whew. What a read!
Grace Bradley is fourteen years old when she comes to Riverton House to work. Her mother had also worked at the sprawling Essex manor house, but had to leave under mysterious circumstances. It is through Grace that we learn of Riverton and its inhabitants.
I have been thinking about the day I started at Riverton. I can see it clearly. The intervening years concertina and it is June 1914. I am fourteen again: naive, gauche. terrified, following Nancy up flight after flight of scrubbed elm stairs. Her skirt swishes efficiently with every step, each swish an indictment of my own inexperience.
The story, though, starts in the present. Grace is an old woman now. Her husband is dead; her daughter is in her sixties and her beloved grandson, Marcus, has been missing for several weeks. When a filmmaker from America writes to ask if Grace would consult on a film she's making about a tragedy at Riverton, Grace is pulled back into her memories.
Fans of Downton Abbey will be able to picture Grace's life perfectly: the servants downstairs, their dedication to service, their hierarchy. But Grace is more concerned with the Hartford siblings: David, Hannah and Emmeline. Over the years she becomes particularly close to Hannah and when Hannah marries, she is whisked off to London to live.
The House at Riverton is about an aristocratic family in decline. Set between the two great wars, characters go off to their deaths, or come home damaged. The Roaring Twenties usher in an era of shifting sensibilities. Morton does a spectacular job of evoking a time and place. It's easy to sympathize with the female characters who yearn for a different life and although criticism has been leveled at Grace for choosing service over personal happiness, I believe I understand her choice.
Because Grace is looking back, the reader knows early on that some tragedy has befallen the Hartford family. That alone would be enough to turn the pages. But the novel takes its time arriving at its conclusion. Perhaps some readers found the novel slow and the prose over-written; I know it took me a while to settle into the story.
However, when I left Grace, 468 pages later, it was with great sadness because even though this is the story of Riverton, Grace's own story is inextricably linked.
Book Chat2012, Book Review, highly recommended, literary fiction, popular fiction
So Much Pretty – Cara Hoffman
August 2, 2012 August 1, 2012 ChristieLeave a comment
I rarely pick up a book randomly anymore, but So Much Pretty was calling my name. Not only was it calling my name, it actually jumped the pile instead of languishing on my bookshelf for months and months. Still, despite the endless glowing praise I had a hard time settling into the book. Perhaps it was the time of year I started to read it – late June, when school is busy. I took the book with me on a family holiday and while the kids were swimming, I sat on a beautiful screened porch and lost myself in Cara Hoffman's small-town drama.
Told from multiple perspectives, So Much Pretty flips over the small town of Haeden, NY and exposes its creepy underbelly. When the body of a missing teenager, Wendy White, is discovered in Tern Woods, it kick starts an examination of several lives particularly Flynn, the brittle newspaper reporter and Claire and Gene and their daughter, Alice, transplants from NYC. The book also includes police reports and interviews. In this way, the book is difficult to navigate at first. It really deserves to be read in one sitting because once I made time for it, it really wouldn't let me go.
Although there is a horrific crime at the center of this book, the real crime has more to do with the ways in which people are often complicit. Parents misreading their children; neighbours turning away from each other; individuals looking for the spotlight. The story unfolds at a leisurely pace, making sure the reader understands all the players and their connections, but I feel like I missed a lot of clues – no, not even clues – signs that things were not quite right in Haeden because my mind was occupied trying to figure out how Alice was connected to Wendy. I got it horribly wrong, btw.
There are questions to be answered here, but Hoffman's feelings are opaque. She masterfully navigates all the pieces, but I never got the preachy feeling I often get with, say, a Jodi Picoult novel. The bulk of what happens to Wendy is left to the reader's imagination, and her fate is far worse because of it. This would be a fantastic book club pick because of the inherent opportunities for discussion. So, while it took me a bit to get into, I ended up loving So Much Pretty. Its copious praise is well-deserved.
Book Chat2012, Book Chat, Book Review, challenging, literary fiction
The Sense of an Ending – Julian Barnes
August 1, 2012 June 26, 2013 ChristieLeave a comment
I didn't get a chance to write my thoughts about Julian Barnes' Booker Prize winning novella, The Sense of an Ending, back when I actually finished it – which was in June. The book deserves a much more thoughtful review than I am likely to give it here.
Narrated by Tony Webster, a divorced father with a grown daughter, The Sense of an Ending is a meditation on youth and the ways in which our memories are often skewed by our desire to remember ourselves differently from how we actually were.
"We live in time – it holds us and moulds us – but I've never felt I understood it very well," Tony says. He also tells the reader that he is "not very interested in his schooldays, and don't feel any nostalgia for them. But school is where it all began…"
It is at school that Tony and his friends meet Adrian Finn, "a tall, shy boy who initially kept his eyes down and his mind to himself." Adrian is bright, clearly smarter than Tony and his friends – or perhaps just more thoughtful, more willing to question the subjects (particularly history) that he is being taught.
History is the certainty produced at the point where the imperfections of memory meet the inadequacies of documentation.
At the end of school, the four boys go their separate ways. Tony meets a girl, Veronica Ford, and it is this relationship which sets the story in motion. Things with Veronica end badly and when she ends up dating Adrian, Tony is hurt and angry.
How this threesome plays out makes up the bulk of the story, but it isn't a traditional love triangle. This is really a story about who we were, who we become and how we alter our memories to accommodate our own version of ourselves.
The Sense of an Ending is one of those books which would certainly benefit from repeat readings – and trust me, it wouldn't be a hardship. Barnes' prose is precise and devastating. The book reads like a mystery and in a way it is – we are often mysteries to ourselves and it is only when our memories are challenged that we see the person we have been.
Book Chat2012, book club pick, Book Review, challenging, highly recommended, literary fiction, prize winner
I book about books that change people's lives - just not mine. theludicreader.com/2022/01/17/the… 1 hour ago

redpajama_set_name: RedPajamaCommonCrawl