<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-03789500v2</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-03T15:31:50+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">Towards a Better Understanding of Impersonation Risks</title>
            <author role="aut">
              <persName>
                <forename type="first">Anne</forename>
                <surname>Bumiller</surname>
              </persName>
              <email type="md5">0e0b5e3fc02972c96b6b8e500e511323</email>
              <email type="domain">inria.fr</email>
              <idno type="idhal" notation="numeric">1151120</idno>
              <idno type="halauthorid" notation="string">2553694-1151120</idno>
              <affiliation ref="#struct-491189"/>
              <affiliation ref="#struct-419153"/>
              <affiliation ref="#struct-365900"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Olivier</forename>
                <surname>Barais</surname>
              </persName>
              <email type="md5">b19ee4f192e7f3a0e707e0f39f0470f9</email>
              <email type="domain">irisa.fr</email>
              <idno type="idhal" notation="string">olivierbarais</idno>
              <idno type="idhal" notation="numeric">1972</idno>
              <idno type="halauthorid" notation="string">9282-1972</idno>
              <idno type="IDREF">https://www.idref.fr/094608946</idno>
              <idno type="ORCID">https://orcid.org/0000-0002-4551-8562</idno>
              <affiliation ref="#struct-491189"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Nicolas</forename>
                <surname>Aillery</surname>
              </persName>
              <email type="md5">520ddf9f49ce603802b30dd24b718227</email>
              <email type="domain">orange.com</email>
              <idno type="idhal" notation="numeric">1151123</idno>
              <idno type="halauthorid" notation="string">1246635-1151123</idno>
              <affiliation ref="#struct-204598"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Gael</forename>
                <surname>Le Lan</surname>
              </persName>
              <email type="md5">cfd22a2a75b31fa618bcd3463180017a</email>
              <email type="domain">orange.com</email>
              <idno type="idhal" notation="numeric">1151124</idno>
              <idno type="halauthorid" notation="string">2553695-1151124</idno>
              <affiliation ref="#struct-204598"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Anne</forename>
                <surname>Bumiller</surname>
              </persName>
              <email type="md5">0e0b5e3fc02972c96b6b8e500e511323</email>
              <email type="domain">inria.fr</email>
            </editor>
          </titleStmt>
          <editionStmt>
            <edition n="v1">
              <date type="whenSubmitted">2022-10-03 14:55:07</date>
            </edition>
            <edition n="v2" type="current">
              <date type="whenSubmitted">2022-10-10 10:23:46</date>
              <date type="whenModified">2026-02-07 05:23:54</date>
              <date type="whenReleased">2022-10-14 09:58:46</date>
              <date type="whenProduced">2022-11-11</date>
              <date type="whenEndEmbargoed">2022-10-10</date>
              <ref type="file" target="https://hal.science/hal-03789500v2/document">
                <date notBefore="2022-10-10"/>
              </ref>
              <ref type="file" subtype="author" n="1" target="https://hal.science/hal-03789500v2/file/Towards_a_Better_Understanding_of_Impersonation_Risks-cameraReady.pdf" id="file-3807758-3327457">
                <date notBefore="2022-10-10"/>
              </ref>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="1262435">
                <persName>
                  <forename>Anne</forename>
                  <surname>Bumiller</surname>
                </persName>
                <email type="md5">0e0b5e3fc02972c96b6b8e500e511323</email>
                <email type="domain">inria.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-03789500</idno>
            <idno type="halUri">https://hal.science/hal-03789500</idno>
            <idno type="halBibtex">bumiller:hal-03789500</idno>
            <idno type="halRefHtml">&lt;i&gt;SINCONF 2022 - 15th IEEE International Conference on Security of Information and Networks&lt;/i&gt;, Nov 2022, Sousse, Tunisia. pp.1-9</idno>
            <idno type="halRef">SINCONF 2022 - 15th IEEE International Conference on Security of Information and Networks, Nov 2022, Sousse, Tunisia. pp.1-9</idno>
            <availability status="restricted">
              <licence target="https://about.hal.science/hal-authorisation-v1/">HAL Authorization<ref corresp="#file-3807758-3327457"/></licence>
            </availability>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="UNIV-RENNES1">Université de Rennes 1</idno>
            <idno type="stamp" n="CNRS">CNRS - Centre national de la recherche scientifique</idno>
            <idno type="stamp" n="INRIA">INRIA - Institut National de Recherche en Informatique et en Automatique</idno>
            <idno type="stamp" n="UNIV-UBS">Université de Bretagne Sud</idno>
            <idno type="stamp" n="INSA-RENNES">Institut National des Sciences Appliquées de Rennes</idno>
            <idno type="stamp" n="INRIA-RENNES">INRIA Rennes - Bretagne Atlantique</idno>
            <idno type="stamp" n="IRISA">Irisa</idno>
            <idno type="stamp" n="IRISA_SET">IRISA_SET</idno>
            <idno type="stamp" n="INRIA_TEST">INRIA - Institut National de Recherche en Informatique et en Automatique</idno>
            <idno type="stamp" n="TESTALAIN1">TESTALAIN1</idno>
            <idno type="stamp" n="CENTRALESUPELEC">Ecole CentraleSupélec</idno>
            <idno type="stamp" n="INRIA2">INRIA 2</idno>
            <idno type="stamp" n="UR1-HAL">Publications labos UR1 dans HAL-Rennes 1</idno>
            <idno type="stamp" n="UR1-MATH-STIC">UR1 - publications Maths-STIC</idno>
            <idno type="stamp" n="UR1-UFR-ISTIC">UFR ISTIC Informatique et électronique</idno>
            <idno type="stamp" n="TEST-UR-CSS">TEST Université de Rennes CSS</idno>
            <idno type="stamp" n="UNIV-RENNES">Université de Rennes</idno>
            <idno type="stamp" n="INRIA-RENGRE">INRIA-RENGRE</idno>
            <idno type="stamp" n="UR1-MATH-NUM">Pôle UnivRennes - Mathématiques - Numérique </idno>
            <idno type="stamp" n="CYBERSCHOOL">CyberSchool - Ecole universitaire de recherche en Cybersécurité</idno>
          </seriesStmt>
          <notesStmt>
            <note type="audience" n="2">International</note>
            <note type="invited" n="0">No</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
            <note type="proceedings" n="1">Yes</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">Towards a Better Understanding of Impersonation Risks</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Anne</forename>
                    <surname>Bumiller</surname>
                  </persName>
                  <email type="md5">0e0b5e3fc02972c96b6b8e500e511323</email>
                  <email type="domain">inria.fr</email>
                  <idno type="idhal" notation="numeric">1151120</idno>
                  <idno type="halauthorid" notation="string">2553694-1151120</idno>
                  <affiliation ref="#struct-491189"/>
                  <affiliation ref="#struct-419153"/>
                  <affiliation ref="#struct-365900"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Olivier</forename>
                    <surname>Barais</surname>
                  </persName>
                  <email type="md5">b19ee4f192e7f3a0e707e0f39f0470f9</email>
                  <email type="domain">irisa.fr</email>
                  <idno type="idhal" notation="string">olivierbarais</idno>
                  <idno type="idhal" notation="numeric">1972</idno>
                  <idno type="halauthorid" notation="string">9282-1972</idno>
                  <idno type="IDREF">https://www.idref.fr/094608946</idno>
                  <idno type="ORCID">https://orcid.org/0000-0002-4551-8562</idno>
                  <affiliation ref="#struct-491189"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Nicolas</forename>
                    <surname>Aillery</surname>
                  </persName>
                  <email type="md5">520ddf9f49ce603802b30dd24b718227</email>
                  <email type="domain">orange.com</email>
                  <idno type="idhal" notation="numeric">1151123</idno>
                  <idno type="halauthorid" notation="string">1246635-1151123</idno>
                  <affiliation ref="#struct-204598"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Gael</forename>
                    <surname>Le Lan</surname>
                  </persName>
                  <email type="md5">cfd22a2a75b31fa618bcd3463180017a</email>
                  <email type="domain">orange.com</email>
                  <idno type="idhal" notation="numeric">1151124</idno>
                  <idno type="halauthorid" notation="string">2553695-1151124</idno>
                  <affiliation ref="#struct-204598"/>
                </author>
              </analytic>
              <monogr>
                <meeting>
                  <title>SINCONF 2022 - 15th IEEE International Conference on Security of Information and Networks</title>
                  <date type="start">2022-11-11</date>
                  <date type="end">2022-11-13</date>
                  <settlement>Sousse</settlement>
                  <country key="TN">Tunisia</country>
                </meeting>
                <imprint>
                  <biblScope unit="pp">1-9</biblScope>
                  <date type="datePub">2022</date>
                </imprint>
              </monogr>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <keywords scheme="author">
                <term xml:lang="en">Explainable AI</term>
                <term xml:lang="en">Shapley Values</term>
                <term xml:lang="en">Authentication</term>
                <term xml:lang="en">Impersonation Risk</term>
              </keywords>
              <classCode scheme="halDomain" n="stat.ap">Statistics [stat]/Applications [stat.AP]</classCode>
              <classCode scheme="halTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halOldTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halTreeTypology" n="COMM">Conference papers</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>In many situations, it is of interest for authentication systems to adapt to context (e.g., when the user's behavior differs from the previous behavior). Hence, during authentication events, it is common to use contextually available features to calculate an impersonation risk score. This paper proposes an explainability model that can be used for authentication decisions and, in particular, to explain the impersonation risks that arise during suspicious authentication events (e.g., at unusual times or locations). The model applies Shapley values to understand the context behind the risks. Through a case study on 30,000 real world authentication events, we show that risky and nonrisky authentication events can be grouped according to similar contextual features, which can explain the risk of impersonation differently and specifically for each authentication event. Hence, explainability models can effectively improve our understanding of impersonation risks. The risky authentication events can be classified according to attack types. The contextual explanations of the impersonation risk can help authentication policymakers and regulators who attempt to provide the right authentication mechanisms, to understand the suspiciousness of an authentication event and the attack type, and hence to choose the suitable authentication mechanism.</p>
            </abstract>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="researchteam" xml:id="struct-491189" status="VALID">
          <idno type="RNSR">201422126U</idno>
          <idno type="ROR">https://ror.org/0194hft57</idno>
          <orgName>Diversity-centric Software Engineering</orgName>
          <orgName type="acronym">DiverSe</orgName>
          <date type="start">2014-07-01</date>
          <date type="end">2026-06-30</date>
          <desc>
            <address>
              <addrLine>Campus de Beaulieu, 35042 Rennes cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.inria.fr/equipes/diverse</ref>
          </desc>
          <listRelation>
            <relation active="#struct-419153" type="direct"/>
            <relation active="#struct-300009" type="indirect"/>
            <relation active="#struct-491188" type="direct"/>
            <relation active="#struct-490899" type="indirect"/>
            <relation active="#struct-105160" type="indirect"/>
            <relation active="#struct-117606" type="indirect"/>
            <relation active="#struct-301232" type="indirect"/>
            <relation active="#struct-172265" type="indirect"/>
            <relation active="#struct-247362" type="indirect"/>
            <relation active="#struct-411575" type="indirect"/>
            <relation name="UMR6074" active="#struct-441569" type="indirect"/>
            <relation active="#struct-481355" type="indirect"/>
            <relation active="#struct-302102" type="indirect"/>
          </listRelation>
        </org>
        <org type="laboratory" xml:id="struct-419153" status="VALID">
          <idno type="RNSR">198018249C</idno>
          <idno type="ROR">https://ror.org/04040yw90</idno>
          <orgName>Centre Inria de l'Université de Rennes</orgName>
          <desc>
            <address>
              <addrLine>Campus de beaulieu35042 Rennes cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.inria.fr/centre/rennes</ref>
          </desc>
          <listRelation>
            <relation active="#struct-300009" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-365900" status="VALID">
          <orgName>Orange Labs</orgName>
          <desc>
            <address>
              <country key="FR"/>
            </address>
          </desc>
        </org>
        <org type="laboratory" xml:id="struct-204598" status="VALID">
          <orgName>Orange Labs [Cesson-Sévigné]</orgName>
          <desc>
            <address>
              <addrLine>4 Rue du Clos Courtel, 35510 Cesson-Sévigné</addrLine>
              <country key="FR"/>
            </address>
          </desc>
          <listRelation>
            <relation active="#struct-365900" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-300009" status="VALID">
          <idno type="ROR">https://ror.org/02kvxyf05</idno>
          <orgName>Institut National de Recherche en Informatique et en Automatique</orgName>
          <orgName type="acronym">Inria</orgName>
          <desc>
            <address>
              <addrLine>Domaine de VoluceauRocquencourt - BP 10578153 Le Chesnay Cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.inria.fr/en/</ref>
          </desc>
        </org>
        <org type="department" xml:id="struct-491188" status="VALID">
          <orgName>LANGAGE ET GÉNIE LOGICIEL</orgName>
          <orgName type="acronym">IRISA-D4</orgName>
          <desc>
            <address>
              <country key="FR"/>
            </address>
          </desc>
          <listRelation>
            <relation active="#struct-490899" type="direct"/>
            <relation active="#struct-105160" type="indirect"/>
            <relation active="#struct-117606" type="indirect"/>
            <relation active="#struct-301232" type="indirect"/>
            <relation active="#struct-172265" type="indirect"/>
            <relation active="#struct-247362" type="indirect"/>
            <relation active="#struct-300009" type="indirect"/>
            <relation active="#struct-411575" type="indirect"/>
            <relation name="UMR6074" active="#struct-441569" type="indirect"/>
            <relation active="#struct-481355" type="indirect"/>
            <relation active="#struct-302102" type="indirect"/>
          </listRelation>
        </org>
        <org type="laboratory" xml:id="struct-490899" status="VALID">
          <idno type="IdRef">026386909</idno>
          <idno type="ISNI">0000 0001 2298 7270</idno>
          <idno type="RNSR">200012163A</idno>
          <idno type="ROR">https://ror.org/00myn0z94</idno>
          <orgName>Institut de Recherche en Informatique et Systèmes Aléatoires</orgName>
          <orgName type="acronym">IRISA</orgName>
          <date type="start">2017-01-01</date>
          <desc>
            <address>
              <addrLine>Avenue du général LeclercCampus de Beaulieu 35042 RENNES CEDEX</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.irisa.fr</ref>
          </desc>
          <listRelation>
            <relation active="#struct-105160" type="direct"/>
            <relation active="#struct-117606" type="direct"/>
            <relation active="#struct-301232" type="indirect"/>
            <relation active="#struct-172265" type="direct"/>
            <relation active="#struct-247362" type="direct"/>
            <relation active="#struct-300009" type="direct"/>
            <relation active="#struct-411575" type="direct"/>
            <relation name="UMR6074" active="#struct-441569" type="direct"/>
            <relation active="#struct-481355" type="direct"/>
            <relation active="#struct-302102" type="indirect"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-105160" status="VALID">
          <idno type="IdRef">26693823X</idno>
          <idno type="ROR">https://ror.org/015m7wh34</idno>
          <orgName>Université de Rennes</orgName>
          <orgName type="acronym">UR</orgName>
          <desc>
            <address>
              <addrLine>Campus de Beaulieu, 263 avenue Général Leclerc, CS 74205, 35042 RENNES CEDEX</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.univ-rennes.fr/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-117606" status="VALID">
          <idno type="ROR">https://ror.org/04xaa4j22</idno>
          <orgName>Institut National des Sciences Appliquées - Rennes</orgName>
          <orgName type="acronym">INSA Rennes</orgName>
          <desc>
            <address>
              <addrLine>20, avenue des Buttes de Coësmes - CS 70839 - 35708 Rennes cedex 7</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.insa-rennes.fr/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-301232" type="direct"/>
          </listRelation>
        </org>
        <org type="regroupinstitution" xml:id="struct-301232" status="VALID">
          <idno type="IdRef">162105150</idno>
          <orgName>Institut National des Sciences Appliquées</orgName>
          <orgName type="acronym">INSA</orgName>
          <desc>
            <address>
              <country key="FR"/>
            </address>
          </desc>
        </org>
        <org type="institution" xml:id="struct-172265" status="VALID">
          <idno type="IdRef">05017746X</idno>
          <idno type="ISNI">0000000121680285</idno>
          <idno type="ROR">https://ror.org/04ed7fw48</idno>
          <orgName>Université de Bretagne Sud</orgName>
          <orgName type="acronym">UBS</orgName>
          <date type="start">1995-02-07</date>
          <desc>
            <address>
              <addrLine>BP 92116 - 56321 Lorient cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.univ-ubs.fr/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-247362" status="VALID">
          <idno type="ROR">https://ror.org/03rxtdc22</idno>
          <orgName>École normale supérieure - Rennes</orgName>
          <orgName type="acronym">ENS Rennes</orgName>
          <desc>
            <address>
              <addrLine>Campus de Ker Lann - avenue Robert Schuman - 35170 Bruz</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.ens-rennes.fr</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-411575" status="VALID">
          <idno type="IdRef">184443237</idno>
          <idno type="ROR">https://ror.org/019tcpt25</idno>
          <orgName>CentraleSupélec</orgName>
          <desc>
            <address>
              <addrLine>3, rue Joliot Curie,Plateau de Moulon,91192 GIF-SUR-YVETTE Cedex</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">http://www.centralesupelec.fr</ref>
          </desc>
        </org>
        <org type="regroupinstitution" xml:id="struct-441569" status="VALID">
          <idno type="IdRef">02636817X</idno>
          <idno type="ISNI">0000000122597504</idno>
          <idno type="ROR">https://ror.org/02feahw73</idno>
          <orgName>Centre National de la Recherche Scientifique</orgName>
          <orgName type="acronym">CNRS</orgName>
          <date type="start">1939-10-19</date>
          <desc>
            <address>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.cnrs.fr/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-481355" status="VALID">
          <idno type="IdRef">202743233</idno>
          <idno type="ROR">https://ror.org/030hj3061</idno>
          <orgName>IMT Atlantique</orgName>
          <orgName type="acronym">IMT Atlantique</orgName>
          <date type="start">2017-01-01</date>
          <desc>
            <address>
              <addrLine>Campus Brest : Technopôle Brest-Iroise CS 8381829238 BREST Cedex 3 -Campus Nantes : 4, rue Alfred Kastler- La chantrerie 44300 NANTES -Campus Rennes :  2 Rue de la Châtaigneraie, 35510 CESSON SEVIGNE</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.imt-atlantique.fr</ref>
          </desc>
          <listRelation>
            <relation active="#struct-302102" type="direct"/>
          </listRelation>
        </org>
        <org type="regroupinstitution" xml:id="struct-302102" status="VALID">
          <idno type="IdRef">192427156</idno>
          <idno type="ISNI">000000012202567X</idno>
          <idno type="ROR">https://ror.org/025vp2923</idno>
          <idno type="Wikidata">Q27962533</idno>
          <orgName>Institut Mines-Télécom [Paris]</orgName>
          <orgName type="acronym">IMT</orgName>
          <date type="start">2012-03-01</date>
          <desc>
            <address>
              <addrLine>19 Place Marguerite Perey, 91120 Palaiseau</addrLine>
              <country key="FR"/>
            </address>
            <ref type="url">https://www.imt.fr/</ref>
          </desc>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>