  Distributed data analytics platforms (i.e., Apache Spark, Hadoop) provide
high-level APIs to programmatically write analytics tasks that are run
distributedly in multiple computing nodes. The design of these frameworks was
primarily motivated by performance and usability. Thus, the security takes a
back seat. Consequently, they do not inherently support fine-grained access
control or offer any plugin mechanism to enable it, making them risky to be
used in multi-tier organizational settings.
  There have been attempts to build "add-on" solutions to enable fine-grained
access control for distributed data analytics platforms. In this paper, first,
we show that straightforward enforcement of ``add-on'' access control is
insecure under adversarial code execution. Specifically, we show that an
attacker can abuse platform-provided APIs to evade access controls without
leaving any traces. Second, we designed a two-layered (i.e., proactive and
reactive) defense system to protect against API abuses. On submission of a user
code, our proactive security layer statically screens it to find potential
attack signatures prior to its execution. The reactive security layer employs
code instrumentation-based runtime checks and sandboxed execution to throttle
any exploits at runtime. Next, we propose a new fine-grained access control
framework with an enhanced policy language that supports map and filter
primitives. Finally, we build a system named SecureDL with our new access
control framework and defense system on top of Apache Spark, which ensures
secure access control policy enforcement under adversaries capable of executing
code.
  To the best of our knowledge, this is the first fine-grained attribute-based
access control framework for distributed data analytics platforms that is
secure against platform API abuse attacks. Performance evaluation showed that
the overhead due to added security is low.
