Policy Evolution with Grammatical Evolution

Security policies are becoming more sophisticated. Operational forces will often be faced with making tricky risk decisions and policies must be flexible enough to allow appropriate actions to be facilitated. Access requests are no longer simple subject access object matters. There is often a great deal of context to be taken into account. Most security work is couched in terms of risk management, but the benefits of actions will need to be taken into account too. In some cases it may not be clear what the policy should be. People are often better at dealing with specific examples than producing general rules. In this paper we investigate the use of Grammatical Evolution (GE), a novel evolutionary algorithm to attempt to infer Fuzzy MLS policy model from decision examples. This approach couches policy inference as a search over a policy space for a policy that is most consistent with the supplied training decision set. Each candidate policy considered is associated with a fitness that indicates how consistent is the policy with the decisions provided. This fitness is then optimised using GE techniques. The results show this approach is promising.