Martín, Alejandro G.Beltrán, MartaFernández-Isabel, AlbertoMartín de Diego, Isaac2022-02-092022-02-092021Alejandro G. Martín, Marta Beltrán, Alberto Fernández-Isabel, Isaac Martín de Diego, An approach to detect user behaviour anomalies within identity federations, Computers & Security, Volume 108, 2021, 102356, ISSN 0167-4048, https://doi.org/10.1016/j.cose.2021.1023560167-4048http://hdl.handle.net/10115/18638User and Entity Behaviour Analytics (UEBA) mechanisms rely on statistical techniques and Machine Learning to determine when a significant deviation from patterns or trends established as a standard for users and entities is occurring. These mechanisms are beneficial within cybersecurity contexts because they allow managers and administrators to have early alerts warning about potential security incidents. This paper proposes the utilisation of UEBA to improve the security of Federated Identity Management (FIM) solutions. The proposed UEBA workflow allows Relying Parties within identity federations to build a session fingerprint characterising each user’s behaviour from available information. Furthermore, it enables anomaly detection based on this fingerprint, integrating raised alerts within current identity management specifications. The proposed workflow is validated and evaluated in a real use case based on a web chat application using OpenID Connect for identity management.engAttribution-NonCommercial-NoDerivatives 4.0 Internacionalhttp://creativecommons.org/licenses/by-nc-nd/4.0/Anomaly detectionBehavioural fingerprintFederated identity managementMachine learningUser and entity behaviour analyticsinfo:eu-repo/semantics/article10.1016/j.cose.2021.102356info:eu-repo/semantics/openAccess