Nowadays, the situation of data security is ever-increasing severity, however, the most damaging security threats do not originate from malicious outsiders but from malfeasant and negligent insiders. Generally, insider threats are prone to cause incalculable losses and serious issues due to that the insiders have the authority to access sensitive information. Therefore, how to effectively prevent and respond to insider threats is a significant challenge. Undoubtedly, the key to defending against insider threats is restricting access permissions and optimizing access control policies in real-time. To enhance data security, we propose MLCAC, a multi-layered collaborative access control model, which focuses on protecting sensitive data. A key insight is the design of a decentralized optimization for domain and authority. MLCAC prohibits unauthorized behavior and continuously monitors access logs which are analyzed by using the co-occurrence matrix to make intelligent decisions and dynamically adjust the access control policy in real time. In experiments, we collected 12574 access logs about 1753 system software and analyzed the correlation between software by using the co-occurrence matrix algorithm, including 824 groups co-occurring software of which the highest frequency is 12. The experiments indicate that the accuracy of the policy generated by intelligent decision-making is 89.55%. Therefore, the algorithm is significantly efficient for intelligent decision-making, which is the foundation of automatically generating policies and dynamic authorization.

Nowadays, SELinux has been widely applied in Linux systems to enforce security policy and provide flexible MAC. However, improperly configured rules in policies may cause illegal operations and serious security problems to the system. Up till now, it is a challenging task to analyze and modify anomalous rules in policy, since policy rules are massive and semantically complex. In this paper, we propose SPRT, an architecture for adjusting SELinux policy automatically to mitigate vulnerabilities caused by misconfigured policy. Based on the features of security description text of the vulnerabilities in CVE repository, we innovatively propose a criteria for classification of vulnerabilities and adjust SELinux policy according to the classification results, providing a new perspective on the field of policy adjustment. SPRT uses NLP techniques to train the prototype network model to automatically classify vulnerabilities into three categories. Furthermore, SPRT constructs a knowledge base to identify the mapping of policy, vulnerabilities and rules to be modified. It helps modify the rules in policy based on the classification results and audit logs to mitigate the potential impact of vulnerabilities. Our evaluation shows SPRT is effective in vulnerability mitigation, both in terms of fixing misconfigured policies and suppressing attacks generated by vulnerabilities. We collect policies in SELinux that involve the file-label mapping relationship, type transition policy rules and type enforcement policy rules, amounting to around 130,000 rules in all. Additionally, we analyze more than 400 security description texts of vulnerabilities. In our experiments, we compare other three supervised learning models with SPRT and demonstrate that SPRT can automatically classify vulnerabilities with a high accuracy of 92.84%. Additionally, SPRT provides effective policy adjustment to mitigate the damage that 90.47% of vulnerabilities resulting from misconfigured policies cause.