METHOD OF MONITORING AND PROTECTING ACCESS TO AN ONLINE SERVICE

The present description relates to a method of monitoring and protecting access to an online service from account take over, comprising the steps of: providing a traffic inspector (1) in signal communication with at least one client device (2) for internet browsing and with a web server (4) having an online service residing therein; identifying each browsing session of the client device (2) on the online service; analyzing the traffic exchanged between the client device (2) and the web server (4) to extract and identify at least one username when a user performs authentication to the online service; collecting first characteristic data concerning unique and/or non-unique technical parameters and associating them with a respective identified username; identifying each anonymous application session and each anonymous virtual session of the client device (2) on the online service; for each anonymous application session identified in the previous step, identifying an anonymous browsing session of the client device (2) on the online service, collecting second characteristic data to be compared with the first characteristic data to associate an identified username with the anonymous browsing session in case of similarity or substantial coincidence between such data, inserting each username associated with the anonymous browsing session in which a situation involving risk of credential theft has been detected in a watch list; for each anonymous virtual session identified in the previous step, identifying an anonymous web beacon generated by the client device (2) on the online service, collecting third characteristic data to be compared with the first characteristic data to associate an identified username with the anonymous web beacon in case of similarity or substantial coincidence between such data, entering each username associated with the anonymous web beacon in which a situation involving risk of credential theft following a phishing attack has been detected in a watch list; monitoring the browsing sessions at risk associated with each username in the watch list when its respective user further performs authentication to the online service.