arXiv:2604.10501v1 [cs.CR] 12 Apr 2026
M U S IM A: A T OOL WITH M ULTI - MODAL I NPUT FOR G ENERATING B ESPOKE ABAC DATASETS
Saket Jha Indian Institute of Technology Kharagpur, India [email protected]
Karthikeya S. M. Yelisetty Indian Institute of Technology Kharagpur, India [email protected]
Singabattu Sathya Indian Institute of Technology Kharagpur, India [email protected]
Shamik Sural Indian Institute of Technology Kharagpur, India [email protected]
A BSTRACT Recent advances in research on Attribute-based Access Control (ABAC) has led to the development of several ingenious methods for representing and enforcing organizational security policies. However, so far little effort has been spent towards building a tool for generating large-scale synthetic datasets that can be used to test the developed ABAC systems. In this paper, we address this shortcoming by building MuSimA - a web-based tool for generating ABAC datasets with user-specified probability distributions of attribute values. It supports multi-modal input, i.e., users can provide specifications either as a structured JSON file or as a combination of a minimal JSON along with hand-drawn distribution sketches. In the latter case, a Large Language Model is used to automatically extract appropriate distribution parameters from the sketches. The generated synthetic ABAC data matching the input specifications can be downloaded by the user. For studying scalability of algorithms and methods related to ABAC, data can be generated for varying sizes and complexities. We make MuSimA freely available for use by the research community. Keywords ABAC, Synthetic Data Generation, Data Distribution, MuSimA, Large Language Models
1
Introduction
Over the last few years, Attribute-based Access Control (ABAC) has emerged as one of the most researched topics in access control. Efforts have been made to improve ABAC policy mining algorithms [2][5][14][15], extraction of machine enforceable ABAC policies from natural language policies [16][21], and enhancing scalability [7]. ABAC has also found significant applications in the healthcare domain [8], university systems [9], IoT [17][22], cloud [18][22] and blockchain [23], among others. A common observation from the above-mentioned and other related literature is that even after claiming new research breakthroughs in ABAC, the experiments are conducted only on synthetic datasets generated by standalone simulation tools [10]. The often cited reason is a lack of available real data, since organizations are not willing to share their access control datasets. This reasoning is understandable and, to the best of our knowledge, the only two publicly available real-world datasets are Amazon Kaggle [3] and Amazon UCI [4], which have been used by several researchers for showing the efficacy of their approaches [1][12]. Since these datasets have a fixed number of entries, an effort was made in recent years to build a tool named ConGRASS that uses Conditional Tabular GAN for generating new realistic data samples from the above two real datasets [13]. However, while it can output variable sized datasets, each data point is strictly limited by the number of attributes present in the respective original datasets. Another source of data that has been used in the ABAC literature is due to Xu and Stoller [19]. Although named as case studies, these datasets are essentially simulated data produced by standalone Java programs. The main drawback with these datasets is that they allow only minor pre-determined variations in the simulation process and hence their scope is rather restricted. Besides, it does not allow generation of data sets that can have different kinds of distribu-
MuSimA: A Tool with Multi-modal Input for Generating Bespoke ABAC Datasets
tions based on the domain of application. ABAC Lab [6] is a repository of policy datasets supporting analysis and benchmarking. However, it essentially facilitates ABAC policy mining with predetermined parameters and does not support user specified attribute distributions. Further, none of the existing tools can handle environmental attributes a major differentiating factor of ABAC over other access control models like Role-based Access Control (RBAC) and Discretionary Access Control (DAC). It is in this context that we propose MuSimA (Multi-Modal Simulator for ABAC Systems) - a web based application being made freely accessible to researchers. MuSimA takes parameters like number of users, resources, environmental conditions, number of attributes, their values and distribution of the attribute values over their respective entities (user, resource and environmental condition) as input in a JSON file. An ABAC dataset satisfying such requirements is then generated with names of various entities, attributes, values of attributes, and entity-entity attribute value pair assignments, along with a set of ABAC rules. The authorizations consistent with these ABAC components are also produced. All such constituents of the generated ABAC dataset are combined in a Zip file that can be downloaded in the user’s system. The generated datasets are useful for testing across multiple layers of an ABAC system: at the Policy Information Point (PIP) for studying attribute storage strategies, at the Policy Decision Point (PDP) for evaluating and mining policies, and at the Policy Enforcement Point (PEP) for security analysis. Besides providing the desired distributions in the input JSON, these can also be hand-drawn and the corresponding images uploaded. The distributions are automatically extracted from these images using a Large Language Model (LLM). MuSimA is a Flask-based lightweight web application accessible from anywhere1 .
2
Design and Implementation of MuSimA
In this section, we present the details of MuSimA, including a system overview, input and output formats, and the data generation process. 2.1
System Overview
MuSimA follows a systematic approach for generating consistent and domain-specific datasets. A user interacting with the tool first provides a specification that defines the structure and distribution characteristics of the desired ABAC dataset relevant to the domain for which an algorithm or system is being tested. Based on these inputs, MuSimA produces a complete ABAC dataset with output files representing different views of the generated dataset. The user interface of the web application through which the users interact is minimalistic. The MuSimA tool provides a user-friendly interface for generating synthetic ABAC datasets. The web interface, shown in Figure 1, allows users to specify configuration parameters either textually or by uploading images. { "subject_size": 3, "object_size": 3, "environment_size": 2, "permit_rules_count": 1, "deny_rules_count": 1, "subject_attributes_count": 2, "object_attributes_count": 2, "environment_attributes_count": 1, "subject_attributes_values": [2, 4], "object_attributes_values": [2, 1], "environment_attributes_values": [2], "subject_distributions": [ { "distribution": "U" }, { "distribution": "N", "mean": 2, "variance": 1} ], "object_distributions": [ { "distribution": "P", "lambda": 1}, { "distribution": "U" } ], "environment_distributions": [{ "distribution": "U" }] }
Listing 1: Example Input JSON for Data Generation 2.2
Input Specification Format
Users specify the parameters of the desired ABAC dataset through a JSON configuration file (input.json) with the following structure. Let |S| denote the number of subjects, |O| the number of objects, and |E| the number of environmental entities. The inputs are: 1
https://facweb.iitkgp.ac.in/~shamik/tool.html#musima
2
MuSimA: A Tool with Multi-modal Input for Generating Bespoke ABAC Datasets
Figure 1: MuSimA Web Interface • Entity counts: ns = |S|, no = |O|, ne = |E| representing the number of subject, object and environment entities. • Attribute counts: nsa = |As |, noa = |Ao |, nea = |Ae | for subject, object, and environmental attributes, respectively. • Attribute value cardinalities: nsa,i , noa,j , nea,k representing the number of distinct values for each attribute, where for example, nsa,1 denotes the number of possible values for the subject attribute as1 . • Probability distribution sets for attribute-value assignments: Dsa , Doa , Dea for subject attributes, object attributes and environmental attributes, respectively. Each of these distributions capture how many of the corresponding entities can take each possible value of that attribute. • Policy specification: number of permit rules |Π+ | and deny rules |Π− |. The distributions currently supported by MuSimA include Sampled Normal (N) with parameters (µ, σ 2 ), Poisson (P) with parameter λ, and Uniform (U) distributions. These can be extended seamlessly without affecting the basic design of the tool. An example input JSON file is shown as Listing 1. Considering the fact that the users may not always be fully familiar with the various distributions and their parameters, MuSimA supports a graphical input option as well. Instead of mentioning the distribution details in the input JSON as shown in Listing 1, users can draw a sketch of the desired distribution of attribute values over entities. MuSimA uses an LLM to extract the distribution parameters that best fit the sketch. To handle potential inaccuracies in the initial extraction, MuSimA employs an iterative refinement process. Listing 2 illustrates the prompt used to guide the LLM in refining the parameters by comparing the original sketch with a generated approximation. After the distribution parameters are determined, MuSimA proceeds with the data generation process similar to textbased input. A few example input sketches and the corresponding extracted distributions are shown in Figure 2. The extraction logic is shown in Listing 3, and the end-to-end processing workflow is summarized in Sub-section 2.4. Input images are sanitized using MIME type checks to prevent prompt injection. Note that, no LLM is involved in the text-only input mode.
3
MuSimA: A Tool with Multi-modal Input for Generating Bespoke ABAC Datasets
(a)
(b)
(c)
Figure 2: Example hand-drawn images and corresponding LLM-generated distributions
prompt_refine = f""" Refine the parameters. Left is Original, Right is Approximation. Current Parameters: {current_params} CRITICAL INSTRUCTION: Look at the edges of the curve (at x_axis_min and x_axis_max). - If the Original sketch is still high at the edges, but your Approximation has dropped to zero, you MUST INCREASE SIGMA. - Do not sacrifice the width of the base just to make the peak sharper. - It is better to have a wider curve that covers the edges than a narrow one that fits the peak perfectly. Output the CORRECTED object. """
Listing 2: Iterative Refinement Prompt
4
MuSimA: A Tool with Multi-modal Input for Generating Bespoke ABAC Datasets
2.3
Visual Parameter Extraction
For the multi-modal input, we utilize an LLM to extract distribution parameters from hand-drawn sketches. Listing 3 shows the Python implementation of the extraction logic using the Gemini API. def analyze_and_refine(image_path): prompt_extract = """ Analyze this image. Determine if it is a Normal, Poisson, or Uniform distribution. - For Normal: Identify peak (mu), width (sigma). - For Poisson: Identify rate (lambda). - For Uniform: Identify range (low, high). """ # Call Gemini API response = client.models.generate_content( model="gemini-2.5-flash", contents=[prompt_extract, Image.open(image_path)], config={"response_mime_type": "application/json"} ) params = parse_response(response) return params
Listing 3: LLM-based Parameter Extraction Logic 2.4
Hand-Drawn Input Processing Pipeline
The hand-drawn input pipeline processes a zip file (or folder) of sketches and produces a full ABAC configuration. For each image, it first uses the LLM to read the attribute identifier (SA/OA/EA and index) and the number of values from the sketch itself, avoiding reliance on filenames. It then classifies the distribution family (Normal, Poisson, or Uniform) and extracts parameters using a type-specific schema. An interpreted plot is rendered from these parameters and compared against the original sketch. A refinement prompt iteratively corrects the parameters when necessary. The pipeline saves side-by-side comparison images and aggregates the extracted distributions and value counts into a JSON configuration. Finally, it enforces contiguous indices per attribute type (e.g., SA-1..SA-N) to ensure the output arrays align with attribute ordering. 2.5
Dataset Generation Process
The dataset generation process consists of the following stages: Stage 1: Entity and Attribute Generation. Given the set of input specifications mentioned in Sub-section 2.2, MuSimA generates the corresponding entity identifiers and attribute names as follows. • S = {s1 , s2 , . . . , sns } as the set of subjects • O = {o1 , o2 , . . . , ono } as the set of objects • E = {e1 , e2 , . . . , ene } as the set of environmental entities • As = {sa1 , sa2 , . . . , sansa } as the set of subject attributes • Ao = {oa1 , oa2 , . . . , oanoa } as the set of object attributes • Ae = {ea1 , ea2 , . . . , eanea } as the set of environmental attributes Stage 2: Attribute Value Generation. For each attribute a, MuSimA generates a set of values Va = {a1 , a2 , . . . , ava }. These are stored in mapping structures SAV, OAV and EAV, respectively, where SAV [asi ] contains all possible values for the subject attribute asi . Stage 3: Entity-Attribute-Value Assignment. For each entity e ∈ S ∪ O ∪ E, MuSimA assigns attribute values for each relevant attribute according to the specified distributions. Let a be an attribute with n possible values (a1 , a2 , . . . , an ), and D denote the desired distribution for that attribute. Depending on the nature of the distribution, attribute-values are assigned as described below. • Normal Distribution (N): MuSimA samples a real number x from a truncated normal distribution on [0, n] with user-specified mean (µ) and variance (σ 2 ), and then assigns value ak if x ∈ [k − 1, k),
for k = 1, 2, . . . , n.
This bins the interval [0, n] into n unit ranges and maps the sampled value to an attribute value accordingly. 5
MuSimA: A Tool with Multi-modal Input for Generating Bespoke ABAC Datasets
• Poisson Distribution (P): Given parameter λ, MuSimA computes probabilities λk e−λ , for k = 1, 2, . . . , n, k! normalizes them so that the weights sum to 1, and samples ak according to these discrete probabilities. • Uniform Distribution (U): Since all attribute values are equally likely, the assignment samples an index k ∈ [1, n] uniformly at random and assigns ak . P (X = k) =
Thus, for each attribute assignment: v ∼ D,
v ∈ Va = {a1 , a2 , . . . , an }
These assignments are stored in mapping structures: SV [si ] = [v1 , v2 , . . . , vnsa ] for subjects, OV [oj ] = [v1 , v2 , . . . , vnoa ] for objects, and EV [ek ] = [v1 , v2 , . . . , vnea ] for environmental entities. Stage 4: ABAC Policy Generation. MuSimA generates |Π+ | permit rules and |Π− | deny rules. Each permit rule ri+ ∈ Π+ and deny rule ri− ∈ Π− is of the form: ri± :
n sa ^
(saj = vjsa ) ∧
j=1
n oa ^
(oak = vkoa ) ∧
n ea ^
(eal = vlea ) → permit/deny
l=1
k=1
where each condition specifies an attribute-value pair. Multiple permit rules combine disjunctively (access granted if any permit rule matches). However, in case of conflicting policies, deny rules take precedence (deny-overrides-permit semantics). Stage 5: Access Control Matrix Generation. For each tuple (si , oj , ek ) ∈ S × O × E, MuSimA evaluates the attribute values against both rule sets. An entry in the access control matrix ACM [si , oj , ek ] is set to 1 (permit) if any permit rule in Π+ matches and no deny rule in Π− matches, and 0 (deny) otherwise, i.e.,
ACM [si , oj , ek ] =
1 0
if ∃ri+ ∈ Π+ : conditions satisfied ∧∄rj− ∈ Π− : conditions satisfied otherwise
{ "S": ["S_1", "S_2", "S_3"], "O": ["O_1", "O_2", "O_3"], "E": ["E_1", "E_2"], "SA": ["SA_1", "SA_2"], "OA": ["OA_1", "OA_2"], "EA": ["EA_1"], "SAV": { "SA_1": ["SA_1_1", "SA_1_2"], "SA_2": ["SA_2_1", "SA_2_2", "SA_2_3", "SA_2_4"] }, "OAV": { "OA_1": ["OA_1_1", "OA_1_2"], "OA_2": ["OA_2_1"] }, "EAV": { "EA_1": ["EA_1_1", "EA_1_2"] }, "SV": { "S_1": ["SA_1_2", "SA_2_3"], "S_2": ["SA_1_2", "SA_2_4"], "S_3": ["SA_1_1", "SA_2_3"] }, "OV": { "O_1": ["OA_1_2", "OA_2_1"], "O_2": ["OA_1_1", "OA_2_1"], "O_3": ["OA_1_1", "OA_2_1"] }, "EV": { "E_1": ["EA_1_2"], "E_2": ["EA_1_2"] }, "permit_rules": [ "SA_1=SA_1_2, SA_2=SA_2_4, OA_1=OA_1_1, OA_2=OA_2_1, EA_1=EA_1_2" ], "deny_rules": [ "SA_1=SA_1_1, SA_2=SA_2_3, OA_1=OA_1_1, OA_2=OA_2_1, EA_1=EA_1_2" ], }
Listing 4: Output JSON for Input of Listing 1 2.6
Output File Formats
MuSimA generates output files representing different components of the generated ABAC dataset: i. output.json: Contains the structured representation of the complete ABAC system, including (Listing 4): 6
MuSimA: A Tool with Multi-modal Input for Generating Bespoke ABAC Datasets
16
15.3%
Normal Poisson Uniform
12 8.17%
8
7.77%
7.06%
6.63% 6.6%
5.71%
Error (%)
Error (%)
12
8
11.82%
12
7.19%
6.67%
5.67%
3.8%
4.56%
4
9.49%
6.97%
4.71% 4.18% 4.2%
6.14% 5.59% 5.84% 5.01%
4.39% 3.4% 3.66%
4
3% 2.4%
1.42%
0
Subject Attribute
6.91%
5.6% 5.46%
2.28%
OA OA 1 OA 2 OA 3 OA 4 OA 5 OA 6 OA 7 O 8 OAA 9 OA 1 0 OA 1 1 OA 1 2 OA 1 3 OA 1 4 OA 1 5 OA 1 6 OA 1 7 OA 1 8 OA 1 9 20
SA SA 1 SA 2 SA 3 SA 4 SA 5 SA 6 SA 7 S 8 SAA 9 SA 10 SA 11 SA 12 SA 13 SA 14 SA 15 SA 16 SA 17 SA 18 SA 19 20
3.24% 2.61%
2.64% 2.37%
9% 8.56%
8
1.53%
1.31% 1.29% 1.13% 0.87% 0.48%
0
4.41% 3.85% 3.84%
4.03%
2.12% 0.87% 0.68% 0.69% 0.94% 0.46%
5.52%
5.5%
4.17%
4
Normal Poisson Uniform
10.89%
5.03%
4.33%
16
Error (%)
Normal Poisson Uniform
0
EA EA 1 EA 2 EA 3 EA 4 EA 5 EA 6 EA 7 E 8 EAA 9 EA 10 EA 11 EA 12 EA 13 EA 14 EA 15 EA 16 EA 17 EA 18 EA 19 20
16
Object Attribute
Environment Attribute
(b)
(c)
(a)
Figure 3: Error Distribution for (a) Subject Attribute (SA) (b) Object Attribute (OA) (c) Environment Attribute (EA). • Entity sets: S, O, E with identifiers • Attribute definitions: As , Ao , Ae • Attribute value sets: SAV, OAV, EAV mapping each attribute to its possible values • Entity-attribute assignments: SV, OV, EV mapping each entity to its assigned attribute values • A permit policy Π+ and a deny policy Π− : The number of rules in each is the same as that specified by accepted rules count and denied rules count in input.json. ii. ACM.txt: Contains the Access Control Matrix with decision entries (0/1) for all (si , oj , ek ) combinations. iii. access data.txt: A flattened representation where each line contains the attribute values for a subject-objectenvironment tuple and the corresponding access decision d ∈ {0, 1}, suitable for machine learning applications. iv. Distribution Attestation: A set of images (similar to Figure 4 shown later in Section 3) depicting how well the generated output distributions match the desired distributions. For multi-modal input, additional images are produced plotting the extracted distributions alongside the hand-drawn distributions (similar to Figure 2).
3
Experimental Results
To validate the correctness of the attribute value assignment process, we computed the expected count for each attribute value under different distributions and compared them against actual generated counts. For each attribute i with ni possible values {a1 , a2 , . . . , ani }, we define the attribute-level error as: ϵi =
ni X |E[Count(ak )] − Actual(ak )| k=1
Actual(ak )
Where, E[Count(ak )], the expected count for each ak is computed from the corresponding distribution, i.e., Uniform, truncated Normal, or normalized Poisson (See Section 2.5). For each distribution type, the average error across all attributes is computed as: N 1 X ϵ̄ = ϵi N i=1 where N is the number of attributes for that distribution. To evaluate the performance of the MuSimA in generating large-scale datasets, we conducted experiments with the following configuration: 100,000 subjects, 2500 objects, 1000 environmental entities, and 50 authorization rules. A total of 60 distributions were used (20 for subject attributes, 20 for object attributes, and 20 for environmental attributes). Table 1 summarizes the attribute-level mean errors for each entity type while Figures 3(a)-(c) show the detailed per-attribute error distribution for subject, object, and environment attributes respectively. Subject attributes exhibit the lowest errors on average (3.25%), with most attributes showing errors below 4%. Object attributes display 7
Attribute Values
164
277
159
406
279
524
419
535
524
393
386
208
(a)
7
6 7
OA
7
5 7
OA
4 OA
3 7
7
2
Attribute Values
OA
1
7
OA
EA
OA
7
6 16
5 EA
EA
16
16
4
3 16
2 EA
EA
EA
7 19
1
6 19
EA
16
5 19
Expected Actual Dist: Poisson
0 16
4 19
EA
EA
3 19
EA
2 19
EA
1 19
EA
196
200
0
EA
400
OA
0
600
524
800 Count
64
63
166
167
243
294
269
269 63
100
176
166
200
Expected Actual Dist: Normal
56
Count
300
12
162
14
66
270 164
Expected Actual Dist: Normal 62
62
100
265
265 174
164
200 61
Count
300
255
MuSimA: A Tool with Multi-modal Input for Generating Bespoke ABAC Datasets
Attribute Values
(b)
(c)
250
237
Expected Actual Dist: Uniform
258
250
259
250
246
250
400 200
Attribute Values
Attribute Values
4 EA
9
3 EA
9
2 9
Attribute Values
(e)
(d)
EA
EA
9
1
5 5 SA
SA
5
4
3 5 SA
5 SA
SA
5
1
2
0
5 10 OA
10
4
3 OA
OA
10 OA
10 OA
10
2
0
Count
00
20,0
0
3
20,0 0
20,0 2
20,0 0
57
0
Expected Actual Dist: Uniform
19,8
00 20,0
0
15 20,3
05
20,0 0
2
19,8
00 20,0
284
290
4 Count
Expected Actual Dist: Poisson 499
484
646
605
708
404
431
646
800 600 400 200 0
1
Count
·104
(f)
Figure 4: Expected vs Actual Count for (a) EA 19 (b) EA 16 (c) OA 7 (d) OA 10 (e) SA 5 (f) EA 9
Table 1: Mean Error by Entity Type for Large-Scale Dataset
Entity Type Subject Attributes (SA) Object Attributes (OA) Environment Attributes (EA) Overall
No. of Attributes 20 20 20 60
Mean Error (%) 3.25 5.45 5.30 4.66
errors averaging 5.45%, while environment attributes show errors at 5.30%. The higher error in OA 16 (15.3%) indicates a particularly challenging distribution. To validate the correctness of the data generation process, we analyzed the specific value counts for selected attributes. The comparisons between Actual vs. Expected counts for the Normal distribution (EA 19 and EA 16) are shown in Figures 4a and 4b. For the Poisson distribution (OA 7 and OA 10), the results are presented in Figures 4c and 4d. Finally, the results for the Uniform distribution (SA 5 and EA 9) are illustrated in Figures 4e and 4f. Attributes with simpler distributions (e.g., uniform or near-uniform) tend to have lower errors, while those with complex or highly skewed distributions show higher errors. Despite this variation, the overall mean error of 4.66% confirms that the tool maintains acceptable accuracy even when generating large-scale datasets with thousands of entities.
4
Related Work
Over the last few years, ABAC has emerged as one of the most researched access control models for enforcing organizational security policies with efforts to improve policy mining algorithms [19], extraction of machine-enforceable policies from natural language specifications [21], and enhance scalability [10]. ABAC has found significant applications in healthcare, university systems, cloud computing [18], IoT [17] and blockchain-based systems [7]. ABAC policy mining aims to automate the transition to ABAC by generating policies from existing lower-level access control data [20]. Xu and Stoller [19] introduced the first ABAC policy mining algorithm whose datasets—including University, Project Management, and Healthcare scenarios—have become common benchmarks in the field. Subsequent works have developed evolutionary algorithms for mining both permit and deny rules. However, existing datasets highlight limitations, particularly regarding the proportion of access requests versus sparse logs, necessitating synthetic log generation capabilities [11]. Two publicly available real-world datasets are the Amazon Kaggle [3] and Amazon UCI [4] datasets, commonly used by researchers. The Amazon Kaggle dataset provides only eight anonymized user attributes with no resource attributes and lacks a rule set essential for comprehensive evaluation. The Amazon UCI dataset similarly lacks clear attribute 8
MuSimA: A Tool with Multi-modal Input for Generating Bespoke ABAC Datasets
Table 2: Qualitative Comparison of ABAC Data Generation Tools
Feature Env. attributes User-specified dist. Multi-modal input Arbitrary scale Deny rules ACM generation Open source
Xu & Stoller [19] × × × × ✓ × ✓
ConGRASS [13] × × × ✓ × × ✓
ABAC Lab [6] × × × × × × ✓
MuSimA This work ✓ ✓ ✓ ✓ ✓ ✓ ✓
data and rule sets, with cases where identical users have different access permissions. Both datasets are unsuitable for generating interpretable ABAC rules with reasonable accuracy [13]. Existing synthetic generation approaches have significant limitations. ConGRASS [13] uses Conditional Tabular GAN to generate data but remains constrained by the original datasets’ attribute dimensionality. Xu and Stoller’s simulated datasets [19] allow only minor pre-determined variations, cannot generate domain-specific distributions, and cannot handle environmental attributes—a major ABAC differentiator from RBAC and DAC. ABAC Lab [6] is an interactive platform providing a repository of datasets including the E-Document dataset and Workforce Management dataset. It offers synthetic log generation, rule analysis, and visualization features. However, it focuses primarily on policy mining rather than flexible dataset generation, using pseudo-random algorithms with pre-configured size parameters instead of allowing users to specify arbitrary attribute distributions. Table 2 provides a qualitative comparison of MuSimA with existing tools and datasets highlighting the key differentiating features.
5
Conclusion and Future Directions
We have proposed MuSimA - an ABAC data generator with multi-modal input (text-based JSON or hand-drawn distribution sketches). The output contains the details of the intended ABAC dataset along with distribution attestation images. While MuSimA is a web based tool, due to its modular design, it supports Bring Your Own Model, and the source code is open source2 for organizations to run the tool locally for avoiding potential privacy concerns. There are several promising directions for future development. Instead of manually specifying all parameters, future versions could analyze real access logs or organizational data to learn realistic patterns, extract attribute distributions, and identify correlations between attributes. Modeling such correlated attribute distributions which is not supported now, would produce datasets that better reflect real-world scenarios and is an important future extension of this work. MuSimA currently supports both permit and deny rules with deny-overrides semantics. Advanced policy features such as conditional policies based on time or location, role hierarchies, and separation-of-duty constraints are planned. Comparison of the generated datasets with existing real-world datasets like Amazon Kaggle [3] and Amazon UCI [4] to evaluate the realistic nature of the datasets generated by MuSimA is another promising direction for future work.
References [1]
[2] [3] [4] 2
Amani Abu Jabal et al. “Polisma - A Framework for Learning Attribute-Based Access Control Policies”. In: 25th European Symposium on Research in Computer Security. 2020, pp. 523–544. DOI: 10.1007/978- 3030-58951-6_26. Nakul Aggarwal and Shamik Sural. “RanSAM: Randomized Search for ABAC Policy Mining”. In: ACM Conference on Data and Application Security and Privacy. 2023, pp. 291–293. DOI: 10.1145/3577923.3585050. Amazon Employee Access challenge: 2014. URL: https:/ /www.kaggle. com/competitions/amazon employee-access-challenge/data. Amazon UCI Dataset. 2011. URL: http : / / archive . ics . uci . edu / ml / datasets / Amazon + Access + Samples.
https://doi.org/10.5281/zenodo.18876163
9
MuSimA: A Tool with Multi-modal Input for Generating Bespoke ABAC Datasets
[5]
[6]
[7]
[8]
[9] [10] [11]
[12] [13]
[14] [15] [16]
[17] [18]
[19] [20]
[21] [22]
[23]
Anna Bamberger and Maribel Fernández. “From Static to Dynamic Access Control Policies via Attribute-Based Category Mining”. In: 33rd International Symposium on Logic-Based Program Synthesis and Transformation. 2023, pp. 188–197. DOI: 10.1007/978-3-031-45784-5_12. Thang Bui et al. “ABAC Lab: An Interactive Platform for Attribute-based Access Control Policy Analysis, Tools, and Datasets [Dataset/Tool Paper]”. In: ACM Symposium on Access Control Models and Technologies. 2025, pp. 111–116. DOI: 10.1145/3734436.3734441. Yuqing Ding et al. “SharAcc: Enhancing scalability and security in Attribute-Based Access Control with sharding-based blockchain and full decentralization”. In: Computer Networks 257 (2025), p. 110992. DOI: 10.1016/j.comnet.2024.110992. Yunhua He et al. “Attribute-Based Access Control Scheme for Secure Identity Resolution in Prognostics and Health Management”. In: IEEE Internet of Things Journal 11.13 (2024), pp. 23140–23155. DOI: 10.1109/ JIOT.2024.3387079. Kaiqing Huang. “Traceable and revocable large universe multi-authority attribute-based access control with resisting key abuse”. In: Comput. Networks 272 (2025), p. 111694. DOI: 10.1016/j.comnet.2025.111694. Gaurav Madkaikar et al. “Performance analysis of dynamic ABAC systems using a queuing theoretic framework”. In: Comput. Secur. 154 (2025), p. 104432. DOI: 10.1016/j.cose.2025.104432. Decebal Mocanu et al. “Towards ABAC policy mining from logs with deep learning”. In: 18th International Multiconference on Intelligent Systems. 2015. URL: https : / / pure . tue . nl / ws / files / 9876041 / ABACPolicyMining_author_version.pdf. Mohammad Nur Nobi et al. “Toward Deep Learning Based Access Control”. In: ACM Conference on Data and Application Security and Privacy. 2022, pp. 143–154. DOI: 10.1145/3508398.3511497. Ritwik Rai and Shamik Sural. “Tool/Dataset Paper: Realistic ABAC Data Generation using Conditional Tabular GAN”. In: ACM Conference on Data and Application Security and Privacy. 2023, pp. 273–278. DOI: 10.1145/ 3577923.3583635. Siyuan Shang et al. “ABAC policy mining method based on hierarchical clustering and relationship extraction”. In: Comput. Secur. 139 (2024), p. 103717. DOI: 10.1016/j.cose.2024.103717. Siyuan Shang et al. “ABAC policy mining method for heterogeneous access control system”. In: J. Supercomput. 81.9 (2025), p. 1065. DOI: 10.1007/s11227-025-07539-6. Pratik Sonune et al. LMN: A Tool for Generating Machine Enforceable Policies from Natural Language Access Control Rules using LLMs. 2025. arXiv: 2502.12460 [cs.CR]. URL: https://arxiv.org/abs/2502. 12460. Zihao Wang et al. “Attribute-Based Bilateral Access Control With Sanitization and Trust Management for IIoT”. In: IEEE Internet Things J. 12.8 (2025), pp. 10818–10833. DOI: 10.1109/JIOT.2024.3513454. Wuwei Weng et al. “Efficient Registered Attribute Based Access Control With Same Sub-Policies in Mobile Cloud Computing”. In: IEEE Transactions on Mobile Computing 24.9 (2025), pp. 8441–8453. DOI: 10.1109/ TMC.2025.3556279. Zhongyuan Xu and Scott D. Stoller. “Mining Attribute-Based Access Control Policies”. In: IEEE Transactions on Dependable and Secure Computing 12.5 (2015), pp. 533–545. DOI: 10.1109/TDSC.2014.2369048. Zhongyuan Xu and Scott D. Stoller. “Mining Attribute-Based Access Control Policies from Logs”. In: IFIP WG 11.3 Conference on Data and Applications Security and Privacy. 2014, pp. 276–291. DOI: 10.1007/9783-662-43936-4_18. Mian Yang et al. “Extraction of Machine Enforceable ABAC Policies from Natural Language Text using LLM Knowledge Distillation”. In: 30th ACM SACMAT. 2025, pp. 157–168. DOI: 10.1145/3734436.3734447. Hui Yin et al. “Privacy-Preservation Enhanced and Efficient Attribute-Based Access Control for Smart Health in Cloud-Assisted Internet of Things”. In: IEEE Internet Things J. 12.1 (2025), pp. 894–903. DOI: 10.1109/ JIOT.2024.3470891. Zhaoqian Zhang et al. “Attribute-Based Access Control With Credible Outsourcing and Collusion-Resistant Revocation Based on Blockchain for Iomt”. In: Concurr. Comput. Pract. Exp. 37.12-14 (2025), pp. 1–17.
10