RA-SFAD: Role-Aware Session Fingerprinting and Anomaly Detection for Web Application Security

Abstract

Role-Based Access Control (RBAC) is widely used in web applications to regulate user permissions and resource access. Although effective at authorization, RBAC does not evaluate whether the behavior within an authenticated session is legitimate. As a result, threats such as credential misuse, insider attacks, and session hijacking may continue undetected even when requests satisfy existing access policies.To address this limitation, this paper presents RA-SFAD (Role-Aware Session Fingerprinting and Anomaly Detection), a lightweight framework for identifying abnormal user activity in RBAC-enabled environments. Instead of relying on a single behavioral model for all users, the framework constructs separate behavioral fingerprints for individual RBAC roles and monitors deviations from role-specific usage patterns. The detection pipeline combines per-role Isolation Forest models for identifying statistical anomalies with an LSTM-based sequence model that analyzes the temporal flow of user actions. In addition, SHAP (SHapley Additive exPlanations) is incorporated into the alerting mechanism to provide interpretable feature-level explanations for detected anomalies.The proposed framework was evaluated on a controlled dataset containing 5,800 labeled sessions distributed across three user roles. Experimental results show that RA-SFAD achieves 94% detection accuracy with an F1-score of 0.92 while maintaining a false positive rate of 4%, outperforming role-agnostic baseline approaches. The framework records an average detection latency of 420 ms and supports a throughput of approximately 2,400 sessions per second, indicating that it can operate efficiently on standard application server infrastructure. An ablation analysis further demonstrates that the role-aware modeling, hybrid detection strategy, and explainability module each contribute to the overall system performance.