Policy Decision Point Research Articles

Revolutionizing Role-Based Access Control: The Impact of AI and Machine Learning in Identity and Access Management

Identity and access management is the bedrock of cybersecurity. Identity access to digital resources is governed by its techniques, procedures, and rules, which also define the breadth of identity permission over those resources. Some new cyberattack or data breach pops up in the news every week. Many data breaches occur due to inadequate security measures, software flaws, human mistake, malevolent insiders, or the abuse of access and privileges. An improved access control system is possible with the use of AI methods. In order for organisations to better handle authentication and access control in order to reduce cyber risks and other IAM difficulties, studies into artificial intelligence in IAM are necessary. With an eye towards AI’s potential uses in identity and access management - more especially in the areas of privilege monitoring, administration, and control - this research investigates the nature of the connection between AMIS and AI. To better understand how AI works in minimising recognised IAM issues, this study aimed to present evidence from the relevant literature. This study’s results show how AI reinforces identity and access management, which helps with automating procedures, keeping up with technology advances, and reducing the prevalence of cyber threats. One way to accomplish this is by using a binary classification system for security access control, which takes the PDP problem and turns it into a yes/no question. In order to create a distributed, effective, and accurate policy decision point (PDP), a vector decision classifier is also built using the supervised machine learning technique. Kaggle-Amazon access control policy dataset evaluated performance by comparing the proposed mechanism to previous research standards in terms of performance, duration, and flexibility. Given that the PDP is not in direct contact with the PAP, the proposed approach accomplishes a high level of secrecy in relation to access control requirements. In conclusion, PDP-based ML can manage massive access requests, execute many major policies simultaneously, and have a 95% accuracy rate, all without policy conflicts, with a response time of about 0.15 s. The security of access control can be enhanced by making it more responsive, flexible, dynamic, and dispersed.

Enhanced Adaptable and Distributed Access Control Decision Making Model Based on Machine Learning for Policy Conflict Resolution in BYOD Environment

Organisations are adopting new IT strategies such as “Bring Your Own Device” (BYOD) and remote working. These trends are highly beneficial both for enterprise owners and employees in terms of increased productivity and reduced costs. However, security issues such as unauthorised access as well as privacy concerns pose significant obstacles. These can be overcome by adopting access control techniques and a dynamic security and privacy policy that governs these issues where they arise. Policy decision points in traditional access control systems, such as role-based access control (RBAC), attribute-based access control (ABAC), or relationship-based access control (ReBAC), may be limited because the status of access control can vary in response to minor changes in user and resource properties. As a result, system administrators rely on a solution for constructing complex rules with many conditions and permissions for decision control. This results in access control issues, including policy conflicts, decision-making bottlenecks, delayed access response times and mediocre performance. This paper proposes a policy decision-making and access control-based supervised learning algorithm. The algorithm enhances policy decision points (PDPs). This is achieved by transforming the PDP’s problem into a binary classification for security access control that either grants or denies access requests. Also, a vector decision classifier based on the supervised machine learning algorithm is developed to generate an accurate, effective, distributed and dynamic policy decision point (PDP). Performance was evaluated using the Kaggle-Amazon access control policy dataset, which compared the effectiveness of the proposed mechanism to previous research benchmarks in terms of performance, time and flexibility. The proposed solution obtains a high level of privacy for access control policies because the PDP does not communicate directly with the policy administration point (PAP). In conclusion, PDP-based ML generates accurate decisions and can simultaneously fulfill multiple massive policies and huge access requests with 95% Accuracy in a short response time of around 0.15 s without policy conflicts. Access control security is improved by making it dynamic, adaptable, flexible and distributed.

Authorization Recycling in Attribute-Based Access Control

In most access control scenarios, the communication between the PDP (policy decision point) and the PEP (policy enforcement point) can cause high authorization overhead. Authorization recycling enables PEP to use the previous access control decisions fetched from the PDP to handle some upcoming access control requests, reduce authorization costs, and increase the efficiency of access control decision-making. Inspired by the RBAC (role-based access control) authorization recycling mechanism, this article first presents an ABAC (attribute-based access control) model based on Boolean expressions of subject and object attributes. It then proposes an authorization recycling approach for this model. In this approach, we provide construction and update methods for authorization data caches and access control decision-making rules for SDP (secondary decision point) by using the caches. The proposed approach can deduce precise and approximate access control decisions from the cache of authorization data, reducing communication between the PEP and the PDP. Finally, the feasibility of the proposed method is verified by conducting a small-scale test. ABAC, SDP, authorization recycling, and authorization caching.

SysFlow: Toward a Programmable Zero Trust Framework for System Security

Zero Trust, as an emerging trend of cybersecurity paradigms in modern infrastructure (e.g., enterprise, cloud, edge, IoT, and 5G), is moving security defenses from static and perimeter-based control systems to focus on users and resources with no assumption of implicit trust. However, the current Zero Trust Architecture (ZTA) mainly focuses on the network security and lacks in-depth considerations on system-level security policies and abstractions, which leaves the realization of the principle incomplete. To bridge the gap, we propose an innovative <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">programmable</i> system security framework called SYSFLOW to enable unified, dynamic, and fine-grained Zero Trust security control for system resources. SYSFLOW introduces a novel <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">system flow</i> abstraction to model <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">system activities</i> across the entire infrastructure, and provides a system-level data plane and control plane separation and abstraction. The new logically centralized controller accommodates a unified <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">programmable</i> Policy Decision Point (PDP) that acquires a holistic view of system behaviors for controlling system resource accesses by translated programmable security policies into system flow rules. The SYSFLOW data plane, acting as Policy Enforcement Point (PEP), enforces translated system flow rules, which can be updated dynamically and facilitate fine-grained responsive actions. Our extensive evaluations demonstrate the effectiveness and scalability of SYSFLOW, which addresses the security issues in various scenarios with a minor performance overhead.

Traditional Techniques and Emerging Technologies in Observability

Identity and access management is the bedrock of cybersecurity. Identity access to digital resources is governed by its techniques, procedures, and rules, which also define the breadth of identity permission over those resources. Some new cyberattack or data breach pops up in the news every week. Many data breaches occur due to inadequate security measures, software flaws, human mistake, malevolent insiders, or the abuse of access and privileges. An improved access control system is possible with the use of AI methods. In order for organisations to better handle authentication and access control in order to reduce cyber risks and other IAM difficulties, studies into artificial intelligence in IAM are necessary. With an eye towards AI’s potential uses in identity and access management - more especially in the areas of privilege monitoring, administration, and control - this research investigates the nature of the connection between AMIS and AI. To better understand how AI works in minimising recognised IAM issues, this study aimed to present evidence from the relevant literature. This study’s results show how AI reinforces identity and access management, which helps with automating procedures, keeping up with technology advances, and reducing the prevalence of cyber threats. One way to accomplish this is by using a binary classification system for security access control, which takes the PDP problem and turns it into a yes/no question. In order to create a distributed, effective, and accurate policy decision point (PDP), a vector decision classifier is also built using the supervised machine learning technique. Kaggle-Amazon access control policy dataset evaluated performance by comparing the proposed mechanism to previous research standards in terms of performance, duration, and flexibility. Given that the PDP is not in direct contact with the PAP, the proposed approach accomplishes a high level of secrecy in relation to access control requirements. In conclusion, PDP-based ML can manage massive access requests, execute many major policies simultaneously, and have a 95% accuracy rate, all without policy conflicts, with a response time of about 0.15 s. The security of access control can be enhanced by making it more responsive, flexible, dynamic, and dispersed.

Poliseek: A Fast XACML Policy Evaluation Engine Using Dimensionality Reduction and Characterized Search

Due to evaluation performance limits and compatibility problems with PDP (Policy Decision Point) in practical information systems, some established schemes have limits in handling massive complex requests. To address the existing challenges of fast rule match on interval values, we propose a novel policy evaluation engine, namely Poliseek with three desired modules. A preprocessing module of Poliseek is equipped with a static encoding strategy and converts the XACML rules and requests into four-dimensional numeric vectors in an attribute space. Owing to a novel optimization object of minimizing interval collisions, a dimensionality reducer and diffuser module can generate candidate values related to each rule vector in the identification space. These values and requests are handled by a fast policy evaluation module using well-constructed hash buckets and a characterized search algorithm. The experimental results show that if the number of requests reaches 10,000, Poliseek can find the target rule approximately 1090, 15, and 15 times faster than the Sun PDP, XEngine, and SBA-XACML, respectively. Poliseek also offers a fast evaluation progress of handling 10,000 complex policy rules with interval attribute values in 275.9 ms, which shows its strong robustness and practicality.

Improving the attribute retrieval on ABAC using opportunistic caches for Fog-Based IoT Networks

Attribute-Based Access Control (ABAC) is one of the most popular and fits access control methods for the Internet of Things (IoT). Yet, despite its popularity, just a few works address the attribute management and retrieval challenges that ABAC carries when applied to IoT. ABAC builds access policies using attributes, and most of the attributes needed for a policy evaluation in a massive and mobile IoT scenario come from an external source. As a result, the policy decision point must send an across-the-network attribute request for each policy evaluation, impacting ABAC latency and performance. Deploying attribute caches over the network can mitigate this problem, thus reducing the latency to get the needed attributes. However, due to attributes dynamic nature, the cost of keeping those caches refreshed increases for each new replica stored. Since the refreshment cost may get out of hand for massive and mobile IoT scenarios, this article presents a method to increase the performance of attribute caches without a considerable cost. The proposed method considers the mobility pattern of IoT devices and predicts where an attribute request will occur. Then, the new method proactively places the attributes closer to the subsequent access request, avoiding unnecessary caching. This approach enhances the tradeoff between the cost of creating a new replica and the benefits to the ABAC performance. Moreover, we characterize an actual authorization application running into the campus, and we use its logs to evaluate the method through trace-driven simulations. Evaluation results show our new approach can reduce up to 80% in the number of hops to achieve the attributes in the caches at negligible refreshment cost.

Embedding Risk-Based Anonymization into Data Access Control for Providing Individual-Level Health Data in a Secure Way.

Especially in biomedical research, individual-level data must be protected due to the sensitivity of the data that is associated with patients. The broad goal of scientific data re-use is to allow many researchers to derive new hypotheses and insights from the data while preserving privacy. Data usage control (DUC) as an attribute-based access mechanism promises to overcome the limitations of traditional access control models achieving that goal. Park and Sandhu provided the usage control (UCON) model as an instance of DUC, which defines policies that evaluate certain attributes. Here, we present an UCON-based architecture, which is augmented with risk-based anonymization as provided by the R package sdcMicro and an extensible Access Control Markup Language (XACML) environment with a core policy decision point as implemented by authzforce.

The blockchain based access control scheme for the Internet of Things

The Internet of Things (IoT) is an information carrier based on the Internet and traditional telecommunications networks. Access control is an important part of the service architecture, which can effectively solve the security issues in IoT. Therefore, many solutions adopt the access control to solve some security problems. However, these existing solutions cannot easily deploy access control in the IoT. As a decentralized, non-tamperable, and highly credible distributed ledger technology, blockchain is in line with the current trend of network development. To improve the transparency, non-tampering of the access control process and traceability and auditability of access flow changes, we propose a blockchain-based access control scheme for the IoT, which uses a combination of on-chain and off-chain to reduce the storage pressure of the blockchain. On the one hand, we deploy policy decision points (PDP) and other components on the smart contract in the form of chain code to better judge and execute decision-making. On the other hand, we put policy administration points (PAP) in the off-chain organization to reduce the storage pressure of the blockchain and make better access flow transformation and traceability. Ultimately, we concluded through feasibility analysis that our solution can maintain high throughput in a large-scale transaction volume environment.

Improvement on PDP Evaluation Performance Based on Neural Networks and SGDK-means Algorithm.

With the purpose of improving the PDP (policy decision point) evaluation performance, a novel and efficient evaluation engine, namely XDNNEngine, based on neural networks and an SGDK-means (stochastic gradient descent K-means) algorithm is proposed. We divide a policy set into different clusters, distinguish different rules based on their own features and label them for the training of neural networks by using the K-means algorithm and an asynchronous SGDK-means algorithm. Then, we utilize neural networks to search for the applicable rule. A quantitative neural network is introduced to reduce a server’s computational cost. By simulating the arrival of requests, XDNNEngine is compared with the Sun PDP, XEngine and SBA-XACML. Experimental results show that 1) if the number of requests reaches 10,000, the evaluation time of XDNNEngine on the large-scale policy set with 10,000 rules is approximately 2.5 ms, and 2) in the same condition as 1), the evaluation time of XDNNEngine is reduced by 98.27%, 90.36% and 84.69%, respectively, over that of the Sun PDP, XEngine and SBA-XACML.

DistriTrust: Distributed and low-latency access validation in zero-trust architecture

Enterprise networks typically use perimeter-based security to protect their IT resources from security threats originating from outside the enterprise perimeter. In such networks, connection requests from devices residing inside the perimeter are implicitly assumed to be trusted. However, in practice, a considerable fraction of cyberattacks emanate from inside the enterprise network making the perimeter-based trust assumption unrealistic. Zero-trust architecture (ZTA) is an emerging alternative to perimeter-based security, where each connection request for accessing an enterprise resource goes through stringent security checks and validation irrespective of the location of the requesting device. In ZTA, every connection request is authenticated and authorized by a trusted centralized component called the policy decision point (PDP) and subsequently granted (or denied) access to the requested resource. However, the centralized nature of the PDP often makes it vulnerable to various attacks such as compromise of secret keys, impersonation and denial of service. In this article, we propose DistriTrust which distributes trust across multiple PDPs using the notion of threshold signatures. However, involving multiple PDPs also increases latency. In order to keep latency as low as possible, we study different threshold signature schemes and identify a suitable scheme for DistriTrust. We also discuss the security properties achieved by DistriTrust. Finally, we analyze the asymptotic performance of DistriTrust and report the experimental results as well.

Blockchain-Based IoT Access Control System: Towards Security, Lightweight, and Cross-Domain

Most IoT devices cannot afford to be a blockchain node due to the high computation and storage loads. Thus, the blockchain is usually deployed on one delegate node, e.g., the edge device or cloud, which may encounters three drawbacks: (1) The delegate node becomes the single failure point when the number of delegate notes are limited. (2) The delegate node replicating the blockchain data can lead to privacy information leak. (3) The delegate node is vulnerable to the Distributed Denial of Service (DDoS) attack. To tackle these drawbacks, we consider to minimize the redundant of blockchain to make the IoT devices as the specialized blockchain nodes. In this paper, we integrate a permissioned blockchain (HLF), an attribute-based access control (ABAC) and an identity-based signature (IBS) to build a security, lightweight, and cross-domain blockchain-based IoT access control system. Specifically, we divided the IoT system into different function domains, named IoT domains. Then, we establish a local blockchain ledger for each IoT domain to enable more IoT devices as blockchain nodes. The local blockchain ledger records the IoT domain entities’ attributes, policy files’ digests, and access decisions. Meanwhile, we use the channel technology of HLF to realize cross-domain access and use the IBS to filter the legal access requests for each IoT domain to prevent DDoS attacks. We also design a policy decision point (PDP) selection algorithm that select multiple IoT devices (blockchain nodes) to achieve the real-time distributed policy decisions (off-chain). Finally, we implement and evaluate the proposed system to demonstrate its practicality.

An efficient policy evaluation engine with locomotive algorithm

The evaluation performance of PDP (policy decision point), especially in large-scale policy sets, is one of the most significant challenges in XACML (eXtensible Access Control Markup Language). With high time-consuming and extensive storage policies, large-scale policy sets are becoming more complicated when their evaluation performance need to be improved. Based on numericalization and batch processing, a new locomotive algorithm is proposed to design and implement a novel policy evaluation engine called XDPNBE that can efficiently deal with large-scale policy sets and make authorization decisions in multiple circumstances. XDPNBE enables efficient decisions within an attributed-based access control framework that has a strong promotion of evaluation performance. By simulating requests, XDPNBE is compared with the Sun PDP, XEngine, HPEngine and SBA-XACML. Experimental results show that if the number of requests reaches 10,000, the evaluation time of XDPNBE on the large-scale policy set with 120,000 rules is approximately 0.21%, 4.69%, 5.67% and 9.66% of that of the Sun PDP, XEngine, HPEngine and SBA-XACML, respectively.

ANNPDP: An Efficient and Stable Evaluation Engine for Large-Scale Policy Sets

As interactions between individuals and services increase, requests are more frequent and policy sets are larger. The evaluation performance of PDP (Policy Decision Point) plays a key role in the operation of a system. In order to solve bottlenecks of improving the PDP evaluation performance for large-scale policy sets, we propose an evaluation engine based on artificial neural networks, namely ANNPDP. We transform rules in a large-scale policy set described in the XACML (eXtensible Access Control Markup Language) into numerical rules. Evaluation networks are established and trained by the numerical rules. In order to ensure the accuracy, a misjudgment set is constructed for error corrections and stored by hash indexes. By simulating the arrival of requests, ANNPDP is compared with the Sun PDP, HPEngine, XEngine, and SBA-XACML. The experiment results show that ANNPDP has: 1) high performance: if the number of requests reaches 10,000, the evaluation time of ANNPDP on the large-scale policy set with 100,000 rules is approximately 0.46, 0.93, 0.71, and 1.43 percent of that of the Sun PDP, HPEngine, XEngine, and SBA-XACML, respectively, and 2) stability: as the size of the large-scale policy set and the number of requests increase, the evaluation time of ANNPDP grows linearly. ANNPDP can satisfy the requirements of an authorization system with large-scale policy sets.

An efficient policy evaluation engine for XACML policy management

In recent years, XACML (eXtensible Access Control Markup Language) has been widely used in the development of various applications, especially Web services. The evaluation time of a PDP (Policy Decision Point) grows significantly when the PDP loads a large-scale policy set coded in XACML. In order to improve the PDP evaluation performance, we propose an optimized policy evaluation engine, namely XDLEngine, and make the following contributions. First, XDLEngine has an advantage in the process of handling a large-scale policy set, and innovatively adopts the LDA (Latent Dirichlet Allocation) topic model to cluster policies. Second, according to the clustering results of the LDA model, we digitize and vectorize all rules in policy sets, which facilitates the rule matching. Third, the cosine similarity is introduced to classify the rules under each topic, which greatly reduces the number of comparisons in the process of rule matching and improves the matching efficiency of XDLEngine. Finally, due to the independence between different topics, we use a multi-threaded parallel search in the process of rule matching, which significantly lowers the evaluation time of XDLEngine. The experimental results show that when the number of requests reaches 20,000, the evaluation time of XDLEngine for a practical large-scale policy set with 120,000 rules is approximately 2.48%, 3.47% and 3.68% of that of the Sun PDP, XEngine and HPEngine, respectively.

Clustering and supervised response for XACML policy evaluation and management

To meet the increasingly complex requirements in access control using XACML (eXtensible Access Control Markup Language), it is necessary for a policy decision engine to deal with large-scale policy sets and intensively abundant requests efficiently. A practical policy evaluation engine, namely CSRM, is proposed to tackle this problem. The PDP (Policy Decision Point) in traditional policy decision engines is replaced by a new component ESPDP (Efficient Searching Policy Decision Point). CK-means algorithm is studied in this paper to perform clustering among all policies in a policy set. ESPDP is adopted to construct a virtual mapping table on the basis of the result of the CK-means algorithm. The virtual mapping table stores the relationship between subject attributes and policies, such that the irrelevant polices are excluded when rule search is carried out. Besides, the rules in every policy are merged according to particular principles, thus saving storage space and greatly speeding up rule search. When responding to intensive requests, a supervised response method is applied to determine an optimal rule search order by analyzing the response to the requests in a short period. The experimental results on four practical datasets demonstrate that our proposed CSRM outperforms some classic and state-of-the-art methods when dealing with large-scale policy sets. With high practicality and wide applicability, CSRM effectively eliminates the bottlenecks of improving PDP evaluation performance, and can respond to requests efficiently when handling large-scale policy sets.

XACMET: XACML Testing &amp; Modeling

In the context of access control systems, testing activity is among the most adopted means to assure that sensible information or resources are correctly accessed. In XACML-based access control systems, incoming access requests are transmitted to the policy decision point (PDP) that grants or denies the access based on the defined XACML policies. The criticality of a PDP component requires an intensive testing activity consisting in probing such a component with a set of requests and checking whether its responses grant or deny the requested access as specified in the policy. Existing approaches for improving manual derivation of test requests such as combinatorial ones do not consider policy function semantics and do not provide a verdict oracle. In this paper, we introduce XACMET, a novel approach for systematic generation of XACML requests as well as automated model-based oracle derivation. The main features of XACMET are as follows: (i) it defines a typed graph, called the XAC-Graph, that models the XACML policy evaluation; (ii) it derives a set of test requests via full-path coverage of this graph; (iii) it derives automatically the expected verdict of a specific request execution by executing the corresponding path in such graph; (iv) it allows us to measure coverage assessment of a given test suite. Our validation of the XACMET prototype implementation confirms the effectiveness of the proposed approach.

A Graph and Clustering-Based Framework for Efficient XACML Policy Evaluation

EXtensible Access Control Markup Language (XACML) is one of the standardized languages for specifying access control policies. Policies described by the XACML are used to express the security requirement in the network and information system when we study authorization access control. With the aim to improve the Policy Decision Point (PDP) evaluation performance, we put forward a Graph and Clustering-Based Framework, employing the aggregate function. First, we partition the rule set into subsets. For the single value, we select the best partition quantity based on the aggregate function. As for the interval value, we handle with the start point and the finish point, respectively, in the same way as single value. Second, the policy set is split according to the partition of rule set. In this way, not only single values, but also interval values are taken into consideration. After that, we explore the searching tree to obtain the possibly matched rules. Finally, we construct the combining tree and output the policy decision on the basis of it. The experimental results show that our approach is orders of magnitude better than the Sun PDP. A comparison in evaluation performance between the redundancy detecting and eliminating engine and the Sun PDP, as well as XEngine and SBA-XACML, is made. Experimental results show that the evaluation performance of the PDP can be prominently improved by eliminating redundancies.

Attribute-Based Access Control Using Smart Contracts for the Internet of Things

Abstract Access control is one of the most important security concerns, which is critical in resource and information protection over IoT devices. This paper proposes a new scheme that combines attribute-based access control (ABAC) model with blockchain technology and uses smart contracts for access control judgment. This scheme can realize dynamic, distributed and reliable access control in the open IoT environment. The IoT access control system based on this scheme consists of five functional modules. The information registration point registers information for each device that joins the system. Policy enforcement point (PEP) is responsible for managing agent-devices in the system and processing original access requests from access subjects. Policy decision point (PDP) makes access control right decision through smart contracts. Policy administration point (PAP) is used to manage smart contract information. Policy information point (PIP) is used to manage key attribute information of devices used for access control judgment. The scheme also includes three types of smart contracts, one management contract (MC) is used to manage other contracts in the system, one policy decision contract (PDC) is responsible for obtaining attribute information from PIP and making final access control right decision, and a large number of policy contracts (PCs) which composed of a public policy contract (PPC) and a large number of exclusive policy contracts (EPCs). These PCs are used to implement specific attribute-based access control policies. To demonstrate the application of the scheme, we simulated a scenario of access control in a home IoT environment and verified the feasibility of access control decisions using our proposed scheme through three experiments.

A distributed PDP model based on spectral clustering for improving evaluation performance

In modern access control systems, the Policy Decision Point (PDP) needs to be more efficient to meet the ever-growing demands of Web access authorization. Present XACML implementations of access control systems follow the same architecture based on ABAC, but varies in the design of PDP and other components. As a critical process in PDP, evaluation of attributes is often implemented in a simple and inefficient way in real applications. In order to improve the PDP evaluation performance, we propose a novel distributed PDP model, called XPDP, based on the combination of two-stage clustering and reordering to eliminate the limitation of computational performance of a single PDP. Firstly, we cluster rules based on subject and use spectral clustering method to perform further clustering. Secondly, the clusters of rules are reordered before evaluation for every inbound request based on similarity. Finally, we introduce a distributed PDP architecture for distributed deployment, providing with a brand new perspective of designing access control systems. A comparison in evaluation performance between the XPDP and the Sun PDP, as well as SBA-XACML, is made. In the experiment of using 10,000 synthetic access requests with three practical policy sets, the XPDP is 3.26 times faster than Sun PDP, and is 1.85 times faster than SBA-XACML. Experimental results show that the PDP evaluation performance can be prominently improved.