Abstract: A method of monitoring and protecting access to an online service from Account Take Over may include: providing a Traffic Inspector in communication with at least one device for Internet browsing and with a web server; providing a Traffic Analyzer in communication with the Traffic Inspector; identifying each browsing session of the at least one device; extracting and identifying at least one username when a user performs authentication to the service by analyzing traffic exchanged between the at least one device and the web server; collecting first characteristic data concerning unique and/or non-unique technical parameters and associating the first characteristic data with respective identified one or more usernames; identifying each anonymous browsing session of the at least one device on the service; and collecting second characteristic data concerning unique and/or non-unique technical parameters and associating the second characteristic data with at least one identified anonymous browsing session.

Abstract: A method for tracing malicious endpoints in communication with a back end may include: providing a reverse proxy to intercept traffic exchanged between a client and the back end; providing a processing unit with an algorithm; intercepting, using the proxy, each TLS Client HELLO directed to the back end and generating a TLS Client HELLO hash using the algorithm; intercepting and processing, using the proxy, each HTTP request to extract a Client User Agent; processing the Client User Agent to generate an Agent hash; processing the HELLO hash and Agent hash by calculating a number of occurrences in which the HELLO hash is associated with the Agent hash to obtain a relative frequency value, to determine whether the HELLO hash is common to or anomalous for the Agent hash of the client; and performing one or more attack protection actions of a Man-in-the-Middle type if the HELLO hash is anomalous.

Abstract: A method of monitoring and protecting access to an online service from an Account Take Over attack may include: providing a Traffic Inspector in signal communication with at least one client device for Internet browsing and with a web server having the online service residing therein; providing a Traffic Analyzer in signal communication with the Traffic Inspector; identifying, by the Traffic Inspector, each browsing session of the at least one client device on the online service; extracting and identifying, by the Traffic Analyzer, one or more usernames when a user performs authentication to the online service, analyzing traffic exchanged between the at least one client device and the web server; and collecting, by the Traffic Inspector, first characteristic data concerning unique and/or non-unique technical parameters and associating, by the Traffic Analyzer, the first characteristic data with respective identified one or more usernames.