Exploring Graph-Based Machine Learning for Anomaly Detection in SELinux Security Policies

Security-Enhanced Linux (SELinux) enforces access controls through security policies, but the complexity of these policies can make them difficult to manage and analyze effectively. In this work-in-progress paper, we explore a graph-based machine learning approach to automate the analysis of SELinux policies and detect anomalies. By representing policies as graphs and applying node embedding techniques like Node2Vec, we aim to train machine learning models that can identify policy violations efficiently. Our preliminary results suggest that this method could provide administrators with a more intuitive and effective way to handle complex SELinux policies, potentially improving the accuracy of anomaly detection.