Structural Feature Based Anomaly Detection for Packed Executable Identification - Computational Intelligence in Security for Information Systems - page 257

Extracted Terms Associated Synset Concept Associated Section
paziente ammalato, degente, malato, paziente Patient Invest. and Diagnosis
ansia ansioso, ansiogeno, anxiety Anxiety Invest. and Diagnosis
dolori allo stomaco dolori allo stomaco, mal di somaco, Stomach Pain Invest.and Diagnosis
aggressiva aggressivo, aggressiva, aggressive Aggressive Patient Status

storia clinica storia clinica, patient history Patient History Patient Status

Maalox Maalox Maalox Therapy

Fig. 3. Association between extracted terms and corresponding concepts

identified resource are coded in XML files according to the HL7 standard [10]
for medical records by the Postprocessing module.
The presence of concepts “Patient”, “Anxiety” and “Stomach Pain” in the
underlined part of the example, and the absence of concepts belonging to the
other sections, constitutes the features by which the subsection of the fragment
under analysis will be classified as “Investigation and Diagnosis” section.
This kind of resource can be accessible only by those people having proper
rights. In a role-based access control mechanism, these rights are associated to a
role and they are usually assigned by security administrators according to gov-
ernmental laws (on privacy in e-health, for example) and enterprise regulations.
In previous works we designed security policies for this domain [7] and located
roles were: Doctors, Administrative Managers, Nurses and Patient .Foreachrole
the possible actions considered are: “read” and “write”. In our example, being
the selected text fragment identified as “Investigation and Diagnosis” section,
the following access control rules are enforced on it:
R1: { Doctor, Investigation and Diagnosis, ( Read, W rite, ) }

R2: { Nurse, Investigation and Diagnosis, ( Read, ¬ Write ) }

R3: }

For example, R1 states that the Doctor can Read and Write on resources of type
“Investigation and Diagnosis” while a Nurse can just Read it (R2) and an Ad-
ministrative Manager cannot access it (R3). The set of rules defines the security
policy that can be associated to this document; according to the XACML archi-
tecture, these policies are stored in proper repositories and can be easily enforced
by a Policy Evaluation Point [12] to secure any structured resources.

{ Administrative M anager, Investigation and Diagnosis, ( ¬ Read, ¬ Write )

5 Conclusion and Future Works

Up to date, many systems are based on document management applications and
cannot benefit of new design techniques to structure data because of the presence
of old unstructured documents written by doctors, lawyers, administrative people
and so on. Indeed, documents, especially the old ones, are just digitalized and
made available to users. Among the other limitations, this prevents access control
mechanisms from enforcing fine-grain security policies. In this paper we proposed
an innovative framework that is based on a semantic methodology to transform
unstructured data in a structured way by extracting relevant information and
to identify critical resources to protect. We also illustrated its adoption on a