[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-290244-105":59,"doc-detail-290244-en":131},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":124,"head_meta":126,"extra_data":128,"updated_unix":130},105,"en","machine-learning-based-security-policy-analysis","Machine Learning-Based Security Policy Analysis","","Analysis of Security-Enhanced Linux (SELinux) policies often demands extensive manual work to spot violations and misconfigurations, while existing tools rely on mathematical abstractions that are difficult for practitioners to interpret. A graph-based machine learning framework converts SELinux policies into context graphs, uses Node2vec to learn neighborhood-preserving embeddings, and applies Random Forest, SVM, and MLP models to detect violations. Experiments on synthetic datasets reach 95% accuracy with balanced precision and recall.",{"@graph":69,"@context":123},[70,84,106],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":40,"@type":76,"position":81},"https://docshare.wps.com/document/research-report/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/machine-learning-based-security-policy-analysis/290244/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/machine-learning-based-security-policy-analysis/290244.png","ImageObject",300,407,{"name":92,"@type":93},"Finn","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-10-30","2026-09-17",true,{"@type":102,"interactionType":103,"userInteractionCount":105},"InteractionCounter",{"@type":104},"ViewAction",11,{"@type":107,"mainEntity":108},"FAQPage",[109,115,119],{"name":110,"@type":111,"acceptedAnswer":112},"Why is manual SELinux policy analysis difficult?","Question",{"text":113,"@type":114},"SELinux policies are complex and fine-grained, often containing thousands of statements, making them time-consuming to create and risky to modify while identifying violations manually is labor-intensive.","Answer",{"name":116,"@type":111,"acceptedAnswer":117},"How does the proposed method represent SELinux policies for machine learning?",{"text":118,"@type":114},"It transforms policies into graphs where nodes are security contexts and edges capture access relationships, then uses Node2vec to learn continuous feature representations that preserve neighborhood structure and violation patterns.",{"name":120,"@type":111,"acceptedAnswer":121},"Which models are used to detect SELinux violations and what results are reported?",{"text":122,"@type":114},"Random Forest, Support Vector Machine (SVM), and Multi-Layer Perceptron (MLP) are applied to the learned representations. Experiments report 95% accuracy in identifying security violations with balanced precision and recall.","https://schema.org",{"og:url":83,"og:type":125,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":127,"canonical":83},"index,follow",{"doc_id":129,"site_id":62},290244,1790467285,{"code":4,"msg":5,"data":132},{"doc_id":129,"user_id":133,"nickname":92,"user_avatar":134,"doc_module":4,"category_id":39,"category_name":40,"doc_title":65,"doc_description":67,"doc_content":135,"file_id":136,"file_url":137,"file_type":138,"file_size":139,"view_count":105,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":44,"language":140,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":141,"faqs":142,"seo_title":143,"seo_description":67,"update_tm":144,"read_time":145,"preview_page_count":4},34359740700684,"https://ap-avatar.wpscdn.com/avatar/1f400023980c374ae676?_k=1777273430885731487","Machine Learning-Based Security Policy Analysis  \nKrish Jain  \nDepartment of Computer Science University of Rochester Rochester, USA [kjain7@u.rochester.edu](kjain7@u.rochester.edu)  \nJoann Sum  \nDepartment of Computer Science California State University, Fullerton  \nFullerton, USA  \n[Josum@csu.fullerton.edu](Josum@csu.fullerton.edu)  \nAbstract—Analysis of Security-Enhanced Linux (SELinux) policies requires extensive manual effort to identify violations and security misconfigurations. Current tools employ mathematical abstractions that, while theoretically sound, produce outputs that practitioners struggle to interpret effectively. Automated approaches using machine learning have shown promise but fail to capture the complex relationships inherent in SELinux policies. Here we present a novel approach combining graph-based policy representation with neural networks to automate SELinux policy analysis. Our method transforms policies into graph structures where nodes represent security contexts and edges capture access relationships, then applies Node2vec to learn continuous feature representations that preserve policy neighborhoods and violation patterns. We develop a flexible policy analysis framework that processes these representations through Random Forest, Support Vector Machine (SVM), and Multi-Layer Perceptron (MLP) models to detect violations. Our experimental results demonstrate that this approach achieves 95% accuracy in identifying security violations while maintaining balanced precision and recall metrics, significantly outperforming existing analysis techniques. Through extensive evaluation on synthetic policy datasets derived from production systems, we show that our method effectively captures diverse violation patterns including separation of duty violations, domain transition issues, and unauthorized access paths. Together, our work presents an efficient approach for automated, interpretable SELinux policy analysis that bridges the gap between theoretical security models and practical policy management.  \nKeywords—SELinux policy, machine learning, graph databases, Neo4j, LSMs, anomaly detection  \nI. INTRODUCTION  \nSecurity-Enhanced Linux (SELinux) implements mandatory access controls (MAC) to enhance the traditional discretionary access control (DAC) model. While DAC bases access decisions solely on user ownership, SELinux requires all subjects (processes) and objects (files, sockets) to satisfy additional policy rules based on their security contexts [1] .  \nDespite SELinux's robust security model, its policy-language complexity creates significant challenges for policy analysis and management. The core problem lies in the disconnect between SELinux's intricate policy framework and the tools available to analyze them. Additionally, the fine-grained nature of SELinux access control necessitates numerous rules, often resulting in policies with thousands of statements that are time-consuming to create and risky to modify [4] .  \nPranav Kapoor  \nDepartment of Computer Science Acadia University Wolfville, CA 157998k@acadiau.ca  \nDr. Amir Eaman  \nDepartment of Computer Science Acadia University Wolfville, CA amir.eaman@acadiau.ca  \nCurrent SELinux policy analysis tools span a range of approaches. Mathematical proof-based analysis tools often introduce additional layers of abstraction, translating policies first into mathematical logic and then into mathematical models before generating results [3] . This multi-step process, while theoretically sound, produces outputs that are difficult for practitioners to interpret and apply effectively. The SETools suite [6] forms the foundation of basic analysis, providing several key utilities: apol[] offers a graphical interface for exploring and analyzing SELinux policies, allowing users to examine policy components like types, classes, and rules; seinfo[] provides command-line access to statistics and summaries of policy components; and SEsearch enables detailed searching of p","cbCaifrVabqG2OG6","https://ap.wps.com/l/cbCaifrVabqG2OG6","pdf",271922,"English","# Abstract\n# I. INTRODUCTION\n## Background of SELinux mandatory access control\n## Challenges in policy analysis and management\n## Existing tools and approaches\n## Prior research and gaps\n## Machine learning and graph-based advances","[{\"question\":\"Why is manual SELinux policy analysis difficult?\",\"answer\":\"SELinux policies are complex and fine-grained, often containing thousands of statements, making them time-consuming to create and risky to modify while identifying violations manually is labor-intensive.\"},{\"question\":\"How does the proposed method represent SELinux policies for machine learning?\",\"answer\":\"It transforms policies into graphs where nodes are security contexts and edges capture access relationships, then uses Node2vec to learn continuous feature representations that preserve neighborhood structure and violation patterns.\"},{\"question\":\"Which models are used to detect SELinux violations and what results are reported?\",\"answer\":\"Random Forest, Support Vector Machine (SVM), and Multi-Layer Perceptron (MLP) are applied to the learned representations. Experiments report 95% accuracy in identifying security violations with balanced precision and recall.\"}]","Machine Learning-Based Security Policy Analysis | PDF",1789641114,23]