Abstract: A method performed by a server for protecting a network infrastructure can include: receiving, from an inline hardware appliance associated with an asset, traffic associated with the asset; analyzing the traffic based on a behavioral fingerprint associated with the asset to determine if the traffic is normal or abnormal, wherein the behavioral fingerprint can be stored on the server; and in response to determining that the traffic is normal, forwarding the traffic to the asset.