An Explainable Method for Automatic Extraction of Natural Language Access Control Policy Key Components
Source abstract
Abstract
Access control schemes and models are essential tools for system administrators to protect the integrity of the information. However, they are frequently articulated in natural language, which is a powerful form that guarantees flexibility and expressiveness; however, their inherent ambiguity and unstructured nature pose significant challenges for automated enforcement and rigorous analysis. In this study, we evaluated several transformer-based models for the automated extraction of key components of Natural Language Access Control Policy (NLACP). To this end, we relied on a labeled dataset comprising software requirements specifications from different sectors, such as healthcare and conference management systems. We then conducted a fine-tuning phase, where the BERT model demonstrated optimal performance in extracting entities within a 3-entity paradigm, achieving an F-Measure value of 0.89. ModernBERT proved to be the most promising model in the more complex 5-entity extraction task, with a maximum F-Measure score of 0.84. Furthermore, we introduce an explainability step using layer-wise integrated gradients to gain insight into the decision-making process of these deep models, ensuring that the extracted policy components are both accurate and interpretable.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Access Control and Trust · Explainable Artificial Intelligence (XAI) · Topic Modeling
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
IMT School for Advanced Studies Lucca, 55100 Lucca, Italy
Institute for Informatics and Telematics, National Research Council of Italy (CNR), 56124 Pisa, Italy
Institute for High Performance Computing and Networking, National Research Council of Italy (CNR), 87036 Rende, Italy
Department of Medicine and Health Sciences “Vincenzo Tiberio”, University of Molise, 86100 Campobasso, Italy
References (23)
Show source-provided references
1. Cheng, Y., Xu, M., Zhang, Y., Li, K., Wu, H., Zhang, Y., Guo, S., Qiu, W., Yu, D., and Cheng, X. (2025). Say What You Mean: Natural Language Access Control with Large Language Models for Internet of Things. arXiv.
2. Tang, A. (2023). Implementation of Formal Semantics and the Potential of Non-Classical Logic Systems for the Enhancement of Access Control Models: A Literature Review. arXiv.
3. Mondragon, J., Rubio-Medrano, C., Cruz, G., and Shastri, D. (2025). “I Apologize For Not Understanding Your Policy”: Exploring the Specification and Evaluation of User-Managed Access Control Policies by AI Virtual Assistants. arXiv.
4. Bella, G., Castiglione, G., and Santamaria, D.F. (2023). An automated method for the ontological representation of security directives. arXiv.10.2139/ssrn.4862271 ↗
5. Fatema, K., Debruyne, C., Lewis, D., OSullivan, D., Morrison, J.P., and Mazed, A.A. (2016, January 22–26). A semi-automated methodology for extracting access control rules from the european data protection directive. Proceedings of the 2016 IEEE Security and Privacy Workshops (SPW), San Jose, CA, USA.10.1109/SPW.2016.16 ↗
6. Gillioz, A., Casas, J., Mugellini, E., and Abou Khaled, O. (2020, January 6–9). Overview of the Transformer-based Models for NLP Tasks. Proceedings of the 2020 15th Conference on Computer Science and Information Systems (FedCSIS), Sofia, Bulgaria.
7. Akiba, T., Sano, S., Yanase, T., Ohta, T., and Koyama, M. (2019, January 4–8). Optuna: A next-generation hyperparameter optimization framework. Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, Anchorage, AK, USA.10.1145/3292500.3330701 ↗
8. Explainable artificial intelligence applications in cyber security: State-of-the-art in research10.1109/ACCESS.2022.3204051 ↗
9. Sundararajan, M., Taly, A., and Yan, Q. (2017, January 6–11). Axiomatic attribution for deep networks. Proceedings of the International Conference on Machine Learning, Sydney, Australia.
10. Petrillo, L., Martinelli, F., Santone, A., and Mercaldo, F. (2025, January 18–21). TALLM: A framework for Text Analysis using Large Language Models. Proceedings of the 2025 IEEE 13th International Conference on Healthcare Informatics (ICHI), Rende, Italy.10.1109/ICHI64645.2025.00089 ↗
11. Xiao, X., Paradkar, A., Thummalapenta, S., and Xie, T. (2012, January 11–16). Automated extraction of security policies from natural-language software documents. Proceedings of the ACM SIGSOFT 20th International Symposium on the Foundations of Software Engineering, Cary, NC, USA.10.1145/2393596.2393608 ↗
12. Slankas, J., Xiao, X., Williams, L., and Xie, T. (2014, January 8–12). Relation extraction for inferring access control rules from natural language artifacts. Proceedings of the 30th Annual Computer Security Applications Conference, New Orleans, LA, USA.10.1145/2664243.2664280 ↗
13. Brodie, C.A., Karat, C.M., and Karat, J. (2006, January 12–14). An empirical study of natural language parsing of privacy policy rules using the SPARCLE policy workbench. Proceedings of the Second Symposium on Usable Privacy and Security, Pittsburgh, PA, USA.10.1145/1143120.1143123 ↗
14. Jayasundara, S.H., Arachchilage, N.A.G., and Russello, G. (2024). Ragent: Retrieval-based access control policy generation. arXiv.
15. The proposition bank: An annotated corpus of semantic roles10.1162/0891201053630264 ↗
16. WordNet: A lexical database for English10.1145/219717.219748 ↗
17. Narouei, M., Khanpour, H., and Takabi, H. (2017, January 19–21). Identification of access control policy sentences from natural language policy documents. Proceedings of the IFIP Annual Conference on Data and Applications Security and Privacy, Philadelphia, PA, USA.10.1007/978-3-319-61176-1_5 ↗
18. Automatic extraction of access control policies from natural language documents
19. Alohaly, M., Takabi, H., and Blanco, E. (2019, January 15–17). Towards an automated extraction of abac constraints from natural language policies. Proceedings of the IFIP International Conference on ICT Systems Security and Privacy Protection, Charleston, SC, USA.10.1007/978-3-030-22312-0_8 ↗
20. Zhu, Z., Ren, Z., and Du, X. (2021, January 10–12). Unstructured text ABAC attribute mining technology based on deep learning. Proceedings of the 2021 3rd International Academic Exchange Conference on Science and Technology Innovation (IAECST), Guangzhou, China.10.1109/IAECST54258.2021.9695911 ↗
21. Heaps, J., Krishnan, R., Huang, Y., Niu, J., and Sandhu, R. (2021, January 19–20). Access control policy generation from user stories using machine learning. Proceedings of the IFIP Annual Conference on Data and Applications Security and Privacy, Calgary, AB, Canada.10.1007/978-3-030-81242-3_10 ↗
22. Xu, Z., and Stoller, S.D. (2014, January 14–16). Mining attribute-based access control policies from logs. Proceedings of the IFIP Annual Conference on Data and Applications Security and Privacy, Vienna, Austria.10.1007/978-3-662-43936-4_18 ↗
23. Medvet, E., Bartoli, A., Carminati, B., and Ferrari, E. (April, January 29). Evolutionary inference of attribute-based access control policies. Proceedings of the International Conference on Evolutionary Multi-Criterion Optimization, Guimarães, Portugal.