Graph-Embedding and Neural-Network Pipeline for SELinux Policy Anomaly Detection
An automated SELinux security-policy analysis method that represents policies as a graph whose nodes are security contexts and whose edges are access relationships, learns continuous node embeddings with Node2vec, and feeds them to Random Forest, SVM, and multi-layer-perceptron classifiers to flag policy violations. On synthetic datasets derived from production systems the MLP reached about 95% accuracy with balanced precision and recall, detecting separation-of-duty violations, domain-transition issues, and unauthorized access paths.
Graph-Embedding and Neural-Network Pipeline for SELinux Policy Anomaly Detection
Security-Enhanced Linux (SELinux) is a robust security mechanism that enforces mandatory access controls (MAC), but its policy language's complexity creates challenges for policy analysis and managem…