Automatic Test Case Generation for XACML Access Control Policies Using Graph-Based Modeling and Genetic Algorithms

Abstract: XACML (eXtensible Access Control Markup Language) is a widely used standard fordefining attribute-based access control (ABAC) policies in cloud and service-oriented systems. However, validating XACML policies is challenging due to their hierarchical structure and flexibility,which often introduce issues such as redundant rules and logical conflicts. Manual test case design istime-consuming and frequently fails to achieve suffcient coverage. To address these challenges, thispaper proposes an approach for generating and optimizing test cases from XACML access controlpolicies. We implement this approach as a tool that transforms XACML policies into an XACMLFlow Graph (XFG) and systematically derives test cases through graph traversal. A genetic algorithmis then applied to optimize the generated test suite while preserving high coverage. Experimentalresults on standard XACML policy sets show that the proposed approach significantly reduces testsuite size while maintaining effective coverage, making it suitable for practical policy testing andcontinuous assurance.Keywords: XACML, Test Case Generation, Graph-Based Modeling, Genetic Algorithm, PolicyVerification, ABAC