METHODS OF MONITORING AND PROTECTING ACCESS TO ONLINE SERVICES

Abstract

The present description relates to a method of monitoring and protecting access to an online service from account take over, comprising the steps of: providing a traffic inspector (1) in signal communication with at least one client device (2) and with a web server (4) having an online service residing therein; providing a traffic analyzer (5) in signal communication with the traffic inspector (1); identifying each browsing session of the client device (2) on the online service; analyzing the traffic exchanged between the client device (2) and the web server (4) to extract and identify at least one username when a user performs authentication to the online service; collecting first characteristic data concerning unique and/or non-unique technical parameters and associating them with a respective identified username; identifying each anonymous web beacon generated by the client device (2) on the online service, the web beacon being indicative of the fact that the client device (2) has started a fraudulent browsing session on a phishing web server (11); collecting third characteristic data concerning unique and/or non-unique technical parameters and associating them with the anonymous web beacon; comparing the first characteristic data by means of a user prediction algorithm (7) with the third characteristic data to associate an identified username with the anonymous web beacon in case of similarity or substantial coincidence between the first characteristic data and the third characteristic data so compared; analyzing by means of a detection algorithm (8) each anonymous web beacon associated with one or more identified usernames to enter each username associated with the anonymous web beacon in which a situation involving a risk of credential theft has been detected after a phishing attack in a watch list; monitoring the browsing sessions at risk associated with each username in the watch list when its respective user further performs authentication to the online service.

Claims

1. A method of monitoring and protecting access to an online service from Account Take Over, including the steps of: providing a Traffic Inspector in signal communication with at least one client device for Internet browsing and with a web server having an online service residing therein, providing a Traffic Analyzer in signal communication with the Traffic Inspector; identifying each browsing session of the at least one client device on the online service by the Traffic Inspector; extracting and identifying at least one username by the Traffic Analyzer when a user performs authentication to the online service by analyzing the traffic exchanged between the at least one client device and the web server; collecting, by the Traffic Inspector, first characteristic data concerning unique and/or non-unique technical parameters and associating, by the Traffic Analyzer, the first characteristic data with a respective identified username; storing the first characteristic data associated with each identified username in a database associated with the Traffic Analyzer; identifying each anonymous web beacon generated by the at least one client device on the online service by the Traffic Analyzer, said web beacon being indicative of the fact that the at least one client device has started a fraudulent browsing session on a phishing web server; collecting, by the Traffic Inspector, third characteristic data concerning unique and/or non-unique technical parameters, and associating, by the Traffic Analyzer, the third characteristic data with the anonymous web beacon; associating an identified username with the anonymous web beacon in case of similarity or substantial coincidence between the first characteristic data concerning each identified username and the third characteristic data concerning the anonymous web beacon compared by means of a user prediction algorithm residing in the Traffic Analyzer; entering each username associated with the anonymous web beacon in which a situation involving a risk of credential theft has been detected after a phishing attack, in a watch list by analyzing, by means of a detection algorithm residing in the Traffic Analyzer, each anonymous web beacon associated with one or more identified usernames; monitoring the browsing sessions at risk associated with each username in the watch list when its respective user further performs authentication to the online service and identifying an Account Take Over attack by the at least one client device and protecting access to the online service when the browsing session relating to the anonymous web beacon and the subsequent authenticated session associated with the same username entered in the watch list are close in time.

2. A method of monitoring and protecting access to an online service as claimed in claim 1, wherein the step of monitoring the browsing sessions associated with each username in the watch list comprises the sub-steps of: identifying, by means of the detection algorithm, the browsing sessions at risk associated with each username in the watch list when its respective user performs authentication to the online service; protecting the browsing sessions at risk using a protection algorithm residing in the Traffic Analyzer.

3. A method of monitoring and protecting access to an online service as claimed in claim 2, wherein the step of protecting the browsing session at risk using the protection algorithm comprises the sub-step of: locking the username of the user associated with the browsing session at risk or executing a strong Customer Authentication algorithm for the username of the user associated with the browsing session at risk or executing a Multi-Factor Authentication algorithm for the username of the user associated with the browsing session at risk.

4. A method of monitoring and protecting access to an online service as claimed in claim 2, wherein the step of monitoring the browsing sessions associated with each username in the watch list comprises the sub-step of: generating a risk signal indicative of a possible threat associated with a phishing attack in the browsing session at risk.

5. A method of monitoring and protecting access to an online service as claimed in claim 1, comprising the step of: removing a username from the watch list when the detection algorithm detects that the phishing attack is over.

6. A method of monitoring and protecting access to an online service as claimed in claim 5, wherein the step of removing a username from the watch list comprises the sub-step of: removing a username from the watch list when a predetermined time interval has elapsed from the time in which the detection algorithm has detected that the malware attack is over.

7. A method of monitoring and protecting access to an online service as claimed in claim 1, wherein the step of collecting, by the Traffic Inspector, first characteristic data concerning unique and/or non-unique technical parameters, and associating, by the Traffic Analyzer, the first characteristic data with a respective identified username comprises the sub-step of: collecting, by the Traffic Inspector, first characteristic data concerning one or more of unique technical parameters, non-unique technical parameters, endpoints, networks and browsers; the step of collecting, by the Traffic Inspector, third characteristic data concerning unique and/or non-unique technical parameters, and associating, by the Traffic Analyzer, the third characteristic data with the anonymous web beacon comprises the sub-step of: collecting, by the Traffic Inspector, third characteristic data concerning one or more of unique technical parameters, non-unique technical parameters, endpoints, networks and browsers.

8. A method of monitoring and protecting access to an online service as claimed in claim 7, wherein the first third data and the third characteristic data comprise UUID and IP.

9. A method of monitoring and protecting access to an online service as claimed in claim 1, wherein the step of monitoring the browsing sessions at risk associated with each username in the watch list when the respective user performs further authentication to the online service comprises the sub-step of: comparing, by means of the detection algorithm, the first characteristic data associated with a username in the watch list with the first characteristic data collected by the Traffic Inspector when the respective user performs further authentication to the online service to identify any anomalies.

10. A method of monitoring and protecting access to an online service as claimed in claim 9, wherein the step of comparing, by means of the detection algorithm, the first characteristic data associated with a username in the watch list with the first characteristic data collected by the Traffic Inspector when the respective user performs further authentication to the online service to identify any anomalies, comprises the sub-step of: generating a warning when the first characteristic data associated with a username in the watch list differ from the first characteristic data collected by the Traffic Inspector when the respective user performs further authentication to the online service.

11. A method of monitoring and protecting access to an online service as claimed in claim 1, wherein the step of identifying each anonymous web beacon generated by the at least one client device on the online service by the Traffic Analyzer comprises the sub-step of: identifying each anonymous web beacon generated by the client device on the online service by the Traffic Analyzer using session cookies.

12. A method of monitoring and protecting access to an online service as claimed in claim 1, wherein the step of identifying each browsing session of the at least one client device on the online service by the Traffic Inspector comprises the sub-step of: intercepting, by the Traffic Inspector a HTTP request sent by a web browser residing in the at least one client device to the web server; the step of extracting and identifying at least one username by the Traffic Analyzer when a user performs authentication to the online service comprises the sub-step of: extracting a username from the HTTP request intercepted by the Traffic Inspector when a user performs authentication to the online service using an extraction algorithm residing in the Traffic Analyzer and based on regular expressions.

13. A method of monitoring and protecting access to an online service as claimed in claim 1, comprising the step of: modifying the online service by introducing a web beacon therein.

14. A method of monitoring and protecting access to an online service as claimed in claim 1, wherein the web beacon includes an HTTP request for a resource residing in the web server; the step of identifying each generated anonymous web beacon of the at least one client device on the online service by the Traffic Analyzer comprises the sub-step of: intercepting, by the Traffic Inspector, each HTTP request associated with an anonymous web beacon; the step of collecting, by the Traffic Inspector, third characteristic data concerning unique and/or non-unique technical parameters, and associating, by the Traffic Analyzer, the third characteristic data with the anonymous web beacon comprises the sub-step of: sending, by the Traffic Inspector the third characteristic data to the Traffic Analyzer, the third characteristic data being associated with unique and/or non-unique technical parameters characteristic of the request associated with the anonymous web beacon.

15. A method of monitoring and protecting access to an online service as claimed in claim 14, wherein the step of entering each username associated with the anonymous web beacon in which a situation involving a risk of credential theft has been detected after phishing, in a watch list, comprises the sub-steps of: analyzing whether each HTTP request intercepted by the Traffic Inspector and concerning a web beacon associated with a username comes from the legitimate domain of the online service; generating a warning when an HTTP request does not come from the legitimate domain of the online service.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The features and advantages of the present invention will become apparent from the following detailed description of a possible practical embodiment thereof, illustrated by way of non-limiting example in the accompanying drawings, in which:

[0023] FIGS. 1 and 2 show a system 100 in which a first embodiment of the method of the present invention can be applied;

[0024] FIG. 3 shows a flow chart of a sequence of steps of an embodiment of the method according to the first embodiment of the present invention;

[0025] FIG. 4 shows a flow chart of a further sequence of steps of the example of FIG. 3;

[0026] FIG. 5 shows a flow chart of a further sequence of steps of the example of FIGS. 3 and 4;

[0027] FIG. 6 shows a system 100 in which a second embodiment of the method of the present invention can be applied.

DETAILED DESCRIPTION

[0028] Even if not explicitly highlighted, the individual features described with reference to the specific embodiments shall be understood as accessory and/or interchangeable with other features, described with reference to other embodiments.

[0029] The present invention relates to a method of monitoring and protecting access to an online service from account take over. In particular, the object of the present invention is a method of monitoring and protecting the account of a user from an attack by an imposter F, for example with the use of malware M, aimed at the theft of user credentials for accessing the online service.

[0030] Within the scope of the present invention, an online service is a web and mobile service or application which requires credentials to be securely used by a user. A widespread online service relates to online, web or mobile banking platforms, which allow registered and authenticated users to carry out financial operations online, such as financial transactions. Specifically, a home banking service where a user can make a bank transfer after authenticating with credentials, for example username and password and optionally a temporary token.

[0031] In the attached FIGS. 1 and 2, the number 100 refers to a system in which a first embodiment of the method of the present invention can be applied. In other words, the system 100 is referred to as a network environment, clearly consisting of devices and network components for hardware-type internet browsing, such as servers, databases and processing units, in which the first embodiment of the method of the present invention can be applied.

[0032] The method of monitoring and protecting access to an online service from account take over comprises the step of providing a traffic inspector 1 in signal communication with at least one client device 2 for internet browsing and with a web server 4 having an online service residing therein.

[0033] Within the scope of the present invention, a client device 2 means a device for internet browsing placed in signal communication with the web server 4. The client device 2 is capable of sending requests to the web server 4 and receiving responses through an internet network. The client device 2 may be a tablet, a laptop computer, a desktop computer, a smart TV, a smartwatch, a smartphone, or any other device capable of processing, communicating with a web server 4, and displaying content obtained from the web server 4, or content already present within the client device 2. The content could be viewed from a browser or other types of software. Such content could be in HTML, JavaScript, or other similar formats of a known type. Furthermore, the client device 2 could contain known operating systems such as Android, iOS, or Microsoft Windows.

[0034] Preferably, a web browser 3 resides in the client device 2 if the client device 2 is a computer, or a mobile application if the client device 2 is for example a smartphone or tablet.

[0035] Hereinafter, for brevity of presentation, reference will only be made to the exemplary case of the web browser 3 residing in the client device 2.

[0036] The method further comprising the step of providing a traffic analyzer 5 in signal communication with the traffic inspector 1.

[0037] Within the scope of the present invention, traffic inspector 1 means an inline device on web traffic between each client device 2 and the web server 4 having an online service residing therein. Therefore, the traffic inspector 1 is capable of intercepting the following communication information: IP address of an HTTP request, cookies, headers, and the body of the same HTTP request. The traffic inspector 1 is preferably a hardware device, having software components residing therein, configured to generate a unique code and enter it in a cookie within the response to the HTTP request. More preferably, the traffic inspector 1 is configured to modify the DOM code of a web page by adding the code necessary to generate and send a fingerprint. Furthermore, the traffic inspector 1 is configured to send all the information collected during each user's browsing sessions on the online service residing in the web server 4 to the traffic analyzer 5.

[0038] Within the scope of the present invention, traffic analyzer 5 means a hardware device, having software components such as algorithms 7, 8, 9, 10 residing therein for: extracting the username from the information received by the traffic inspector 1 (extraction algorithm 10); associating the username with the unique information of the HTTP request from which it was extracted, such as IP, and UUID entered in a cookie; estimating the username which generated the HTTP request if said request does not contain actual credentials, the estimate being based on the unique information present in the HTTP request associated with the estimated username(s) (user prediction algorithm 7); identifying an account take over attack (detection algorithm 8); protecting the user in the event of an attack (protection algorithm 9). Furthermore, the traffic analyzer 5 preferably comprises a database 6 for storing such associations A between username and unique information such as, for example, IP and UUID.

[0039] It should be noted that, according to a preferred solution of the invention, the traffic analyzer 1 and the traffic inspector 5 can be implemented in a single machine (or electronic device) which, therefore, is capable of carrying out the activities of the traffic analyzer 1 and the traffic inspector 5 with the same methods described herein.

[0040] The method comprising the step of identifying each browsing session of the client device 2, and preferably the web browser 3, on the online service by the traffic inspector 1.

[0041] The method also comprises the step of analyzing the traffic exchanged between the client device 2 and the web server 4, and preferably between the web browser 3 and the web server 4, by the traffic analyzer 5 to extract and identify at least one username when a user performs authentications to the online service.

[0042] In other words, the architecture based on traffic inspector 1 and traffic analyzer 5 allows monitoring web/mobile application traffic.

[0043] Furthermore, the method comprises the step of collecting by the traffic inspector 1 first characteristic data concerning unique and/or non-unique technical parameters and associating the first characteristic data with a respective identified username by the traffic analyzer 5.

[0044] The method comprises the step of storing the first characteristic data associated with each identified username in a database 6 associated with the traffic analyzer 5.

[0045] The method further comprises the step of identifying each anonymous browsing session of the client device 2, and preferably the web browser 3, on the online service by the traffic analyzer 5.

[0046] Within the scope of the present invention, an anonymous browsing session is an unauthenticated browsing session of an online service.

[0047] The method also comprises the step of collecting, by the traffic inspector 1, second characteristic data concerning unique and/or non-unique technical parameters and associating, by the traffic analyzer 5, the second characteristic data with the anonymous browsing session.

[0048] The method comprises the step of comparing by means of a user prediction algorithm 7 residing in the traffic analyzer 5 the first characteristic data concerning each identified username with the second characteristic data concerning the anonymous session to associate an identified username with the anonymous browsing in case of similarity or substantial coincidence between the first characteristic data and the second characteristic data so compared. That is, the method includes associating a set of possible users with the anonymous browsing session by means of a user prediction algorithm 7, which analyzes the set of technical parameters collected on the session and compares them with the history of previously collected, analyzed, or monitored authenticated parameters and sessions.

[0049] The method comprises the step of analyzing by means of a detection algorithm 8 residing in the traffic analyzer 5 each anonymous browsing session associated with one or more identified usernames to enter each username associated with the anonymous browsing session in which a situation involving a risk of credential theft has been detected in a watch list. In other words, the method includes identifying the presence of technical risks and not, for example, the presence of malware in a browsing session which has not yet been authenticated but with predicted users in the previous step of comparison with the user prediction algorithm 7, by means of continuous monitoring before authentication. If risks are present, the predicted and at-risk users are entered in the watch list.

[0050] In addition, the method comprises the step of monitoring the browsing sessions at risk associated with each username in the watch list when the respective user further performs authentication to the online service. In addition, this step involves identifying an account take over attack by the client device 2 when the anonymous browsing session and the subsequent authenticated session associated with the same username entered in the watch list are close in time. Furthermore, this step involves protecting access to the online service when an account take over risk is identified.

[0051] According to a preferred form of the invention, the step of monitoring the browsing sessions associated with each username in the watch list comprises the sub-steps of: [0052] identifying by means of the detection algorithm 8 the browsing sessions at risk associated with each username in the watch list when the respective user performs authentication to the online service; [0053] protecting the browsing sessions at risk using a protection algorithm 9 residing in the traffic analyzer 5.

[0054] Preferably, the step of protecting the browsing session at risk using the protection algorithm 9 comprises the step of locking the username of the user associated with the browsing session at risk or executing a Strong Customer Authentication algorithm for the username of the user associated with the browsing session at risk or executing a Multi-Factor Authentication algorithm for the username of the user associated with the browsing session at risk. That is to say, when the method identifies a browsing session associated with an authenticated user, if such a user is present in the watch list of users at risk generated by the detection algorithm 8, the protection algorithm 9 triggers protection mechanisms such as, for example, user lockout, SCA, MFA, and/or reporting mechanisms to other systems or users. For example, the method may include a step of generating a warning P by the traffic analyzer 5 to signal the warning to the attacked user or to other systems or to other users.

[0055] Preferably, the step of monitoring the browsing sessions associated with each username in the watch list comprises the step of generating a risk signal indicative of the presence of a possible threat associated with the malware attack in the browsing session at risk.

[0056] According to a preferred solution, the method comprising the step of removing a username from the watch list when the detection algorithm 8 detects that the malware attack has ended. It should be noted that it is possible to establish predefined criteria such that the detection algorithm 8 is capable of detecting if the attack is over.

[0057] Preferably, the step of removing a username from the watch list comprises the step of removing a username from the watch list when a predefined time interval has elapsed from the moment when the detection algorithm 8 has detected that the malware attack is over. That is to say, the username is automatically removed from the watch list when the risk condition expires, for example using a fixed timer.

[0058] In accordance with a preferred form, the step of collecting, by the traffic inspector 1, first characteristic data concerning unique and/or non-unique technical parameters and associating, by the traffic analyzer 5, the first characteristic data with a respective identified username comprises the sub-step of collecting, by the traffic inspector 1, first characteristic data concerning one or more of unique technical parameters, non-unique technical parameters, endpoints (e.g., fingerprint), networks (e.g., IP) and browsers (e.g., tracking and marking cookies). That is, this sub-step includes that the method associates the identified username and all the unique technical parameters and not the authenticated browsing session. Furthermore, the step of collecting, by the traffic inspector 1, second characteristic data concerning unique and/or non-unique technical parameters and associating, by the traffic analyzer 5, the second characteristic data with the anonymous browsing session comprises the sub-step of collecting, by the traffic inspector 1, second characteristic data concerning one or more of unique technical parameters, non-unique technical parameters, endpoints (e.g., fingerprint), networks (e.g., IP) and browsers (e.g., tracking and marking cookies).

[0059] Preferably, the first characteristic data and the second characteristic data comprise UUID and IP. It should be noted that in FIG. 2 the second characteristic data are indicated with IP1 and UUID1.

[0060] With reference to the embodiment in which the traffic inspector 1 is configured to modify the DOM code of a web page by adding the code necessary to generate and send a fingerprint, the code necessary to generate a fingerprint preferably contains the instructions necessary to capture some information which characterize an execution environment of the aforementioned code, such as for example the web browser 3 or a mobile client device 2. More preferably, the code contains instructions aimed at transforming the collected information, i.e., the first and second characteristic data, into a compact format. The device which executes these instructions contains instructions to send the collected information to the traffic analyzer 5. Still preferably, the instructions aimed at transforming the collected information into a compact format are executed both in the web browser 3 and within the traffic inspector 1. When the instructions aimed at transforming the collected information into a compact format are executed within the web browser 3, the code sends only the compact representation of the collected information to the traffic analyzer 5. Still preferably, the information collected relates to the list of typographical sources installed within the device. More preferably, the information collected is the screen size of the device. Although such information is not unique, it is distributed with sufficient rarity to allow the identification of a client device 2 based on the same. On some devices, the characteristic information could relate to information available only in certain types of devices. For example, some mobile devices offer native serial numbers. Advantageously, such information offers even greater guarantees regarding the uniqueness of the information collected. Furthermore, the code could capture further information than previously stated. The traffic analyzer 5 stores such information in a permanent database 6 together with information about the user associated with the client device 2, as they become available. When the traffic analyzer 5 receives the fingerprint information of a client device 2, it searches within the permanent database 6 for information regarding the user which has previously been associated with such fingerprint information. Thereby, the fingerprint information allows to hypothesize the use of a device without it having been authenticated by entering the credentials thereof, similar to what occurs with UUID and IP.

[0061] In accordance with a preferred solution, the step of monitoring the browsing sessions at risk associated with each username in the watch list when the respective user performs further authentication to the online service, comprises the sub-step of: [0062] comparing by means of the detection algorithm 8 the first characteristic data associated with a username in the watch list with the first characteristic data collected by the traffic inspector 1 when the respective user performs further authentication to the online service to identify the presence of any anomalies. In FIG. 2, the first characteristic data collected by the traffic inspector 1 when the respective user in the watch list performs further authentication to the online service are indicated with IP2 and UUID2.

[0063] According to a preferred solution of the invention, the step of comparing, by means of the detection algorithm 8, the first characteristic data associated with a username in the watch list with the first characteristic data collected by the traffic inspector 1 when the respective user performs further authentication to the online service to identify the presence of any anomalies, comprises the sub-step of: [0064] generating a warning P when the first characteristic data associated with a username in the watch list differ from the first characteristic data collected by the traffic inspector 1 when the respective user performs further authentication to the online service.

[0065] In accordance with a preferred solution, the step of identifying each browsing session of the client device 2, and preferably the web browser 3, on the online service by the traffic inspector 1 comprises the sub-step of:

identifying each browsing session of the client device 2, and preferably the web browser 3, on the online service by the traffic inspector 1 using session cookies.

[0066] Preferably, the step of identifying each browsing session of the client device 2, and preferably of the web browser 3, on the online service by the traffic inspector 1, comprising the sub-step of intercepting, by the traffic inspector 1, an HTTP request sent from the web browser 3 to the web server 4. Furthermore, the step of analyzing the traffic exchanged between the web browser 3 and the web server 4 by the traffic analyzer 5 to extract and identify at least one username when a user performs authentication to the online service, comprises the step of extracting a username from the HTTP request intercepted by the traffic inspector 1 when a user performs authentication to the online service by means of an extraction algorithm 10 residing in the traffic analyzer 5 and based on regular expressions.

[0067] Advantageously, the method of the present invention allows to identify any risks, including technical risks or an action for example in the case of video on demand (VOD), deriving from an account take over attack.

[0068] Still advantageously, the method of the present invention allows to provide a prediction of the identity of the user acting in an area which is anonymous as it is not yet authenticated, generating by means of the user prediction algorithm 7 a list of potential users which could be hiding behind the anonymous browsing session. These users, in case a risk is detected in the related browsing session by means of the detection algorithm 8, are entered in a watch list. In doing so, each subsequent authenticated browsing session by a user in the watch list is controlled, so that they can request additional access credentials by means of the protection algorithm 9 and possibly lock the session in the event of a concrete threat.

[0069] Advantageously, the method of the present invention allows to identify and prevent any account take over attacks carried out against registered users of an online service.

[0070] An exemplary application of the method of the present invention is described below, with particular reference to the sequences of steps illustrated in FIGS. 3, 4 and 5.

[0071] With particular reference to FIG. 3, the step of identifying each browsing session of the web browser 3 on the online service by the traffic inspector 1 includes: [0072] sub-step 301 in which the user requests a web page by means of a web browser 3 which sends an HTTP request to the web server 4.

[0073] The step of analyzing the traffic exchanged between the web browser 3 and the web server 4 by the traffic analyzer 5 to extract and identify at least one username when a user performs authentications to the online service includes: [0074] sub-step 302 in which the traffic inspector 1 reads the configuration keys and searches for a particular UUID in the HTTP request; [0075] sub-step 303 of determining whether a UUID is present in the HTTP request; [0076] sub-step 304 to obtain the UUID, if present; [0077] sub-step 305 to add a UUID to the HTTP request if not present, and sub-step 306 to store the UUID in the web browser 3; [0078] sub-step 307 in which the traffic inspector 1 sends the HTTP request to the traffic analyzer 5; [0079] sub-step 308 in which the traffic analyzer 5 searches for username information in the HTTP request and obtains information about IPs present in the HTTP request.
The step of collecting, by the traffic inspector 1, first characteristic data concerning unique and/or non-unique technical parameters and associating, by the traffic analyzer 5, the first characteristic data with a respective identified username, includes: [0080] sub-step 309 to check if there is a username in the HTTP request; [0081] sub-step 310 in which the traffic analyzer 5 searches for usernames already associated with the UUID received; [0082] sub-step 311 in which the traffic analyzer 5 searches the database 6 for usernames already associated with received IPs.
The step of storing the first characteristic data associated with each username identified in a database 6 associated with the traffic analyzer 5 includes: [0083] if the username is present in the HTTP request, sub-step 312 in which the traffic analyzer 5 stores the associations A detected between username and IP, and stores the associations A detected between username and UUID in the database 6; [0084] sub-step 313 in which the traffic analyzer 5 joins the usernames according to predefined rules and produces a refined list of usernames.
With particular reference to FIGS. 4 and 5, sub-step 307 in which the traffic inspector 1 sends the UUID and the HTTP request to the traffic analyzer 5, includes: [0085] sub-step 401 in which the traffic inspector 1 sends legitimate UUIDs and IPs to the traffic analyzer 5 and sends the legitimate HTTP request to the traffic analyzer 5, where legitimate means that it is an authenticated, secure and user-managed browsing session; [0086] sub-step 402 in which the traffic inspector 1 sends the imposter UUID and IP to the traffic analyzer 5 and sends the imposter HTTP request to the traffic analyzer 5.
The step of comparing by means of a user prediction algorithm 7 residing in the traffic analyzer 5 the first characteristic data concerning each identified username with the second characteristic data concerning the anonymous session to associate an identified username with the anonymous browsing session in case of similarity or substantial coincidence between the first characteristic data and the second characteristic data so compared, includes: [0087] sub-step 403 in which the traffic analyzer 5 estimates the possible legitimate username behind the anonymous browsing session as a function of UUID, IP and user prediction algorithm 7.
The step of collecting, by the traffic inspector 1, first characteristic data concerning unique and/or non-unique technical parameters and associating, by the traffic analyzer 5, the first characteristic data with a respective identified username, includes: [0088] sub-step 404 in which the traffic analyzer 5 extracts information about the username from the HTTP request concerning the authenticated browsing session, subsequent to the anonymous session in which the username of the same user was predicted in sub-step 403.
The step of generating a warning P when the first characteristic data associated with a username in the watch list differ from the first characteristic data collected by the traffic inspector 1 when the respective user performs further authentication to the online service, includes: [0089] sub-step 405 in which the traffic analyzer 5 determines whether UUID and IP are unusual for the username; [0090] if it determines that UUID and IP are unusual 406, sub-step 407 in which the traffic analyzer 5 determines whether the estimated legitimate username of the anonymous session is the same one extracted from the imposter's authenticated HTTP request; [0091] if the username is the same 408, sub-step 409 in which the traffic analyzer 5 determines whether the two requests have occurred in a limited time interval; [0092] if the first anonymous and then authenticated sessions of the same user are close 410, i.e., if they occurred in a limited time interval, sub-step 411 in which the traffic analyzer 5 establishes that the imposter's request is fraudulent.
Sub-step 405 includes: [0093] sub-step 501 to check if the username is present in the HTTP request; [0094] sub-step 502 in which the traffic analyzer 5 searches if associations A between username and UUID are stored in the database 6; [0095] sub-step 503 in which the traffic analyzer 5 searches if associations A between username and IP are stored in the database 6; [0096] if the association A between username and UUID 504 is not detected and/or if the association A between username and IP 505 is not detected, sub-step 506 in which the traffic analyzer 5 generates a warning P.

[0097] A second embodiment, alternative or combinable with the previous one (see the third embodiment described below), of the method of monitoring and protecting access to an online service according to the present invention from account take over is described below.

[0098] In the attached FIG. 6, the number 100 refers to a system in which a first embodiment of the method of the present invention can be applied. In other words, the system 100 is referred to as a network environment, clearly consisting of devices and network components for hardware-type internet browsing, such as servers, databases and processing units, in which the second embodiment of the method of the present invention can be applied.

[0099] In accordance with the second embodiment, the method of monitoring and protecting access to an online service from account take over, comprising the step of providing a traffic inspector 1 in signal communication with at least one client device 2 for internet browsing and with a web server 4 having an online service residing therein.

[0100] The method also comprises the step of providing a traffic analyzer 5 in signal communication with the traffic inspector 1.

[0101] Furthermore, the method comprises the step of identifying each browsing session of the client device 2 on the online service by the traffic inspector 1.

[0102] The method comprises the step of analyzing the traffic exchanged between the client device 2 and the web server 4, by the traffic analyzer 5 to extract and identify at least one username when a user performs authentications to the online service.

[0103] In addition, the method comprises the step of collecting by the traffic inspector 1 first characteristic data concerning unique and/or non-unique technical parameters and associating the first characteristic data with a respective identified username by the traffic analyzer 5.

[0104] The method comprises the step of storing the first characteristic data associated with each identified username in a database 6 associated with the traffic analyzer 5.

[0105] The method further comprises the step of identifying each anonymous web beacon generated by the client device 2 on the online service by the traffic analyzer 5, the web beacon indicating that the client device 2 has initiated a fraudulent browsing session on a phishing web server 11.

[0106] Within the scope of the present invention, web beacons means an element included in a web page intended to monitor the actual display of the page by a user. For example, a web beacon could be an image or another type of static resource referenced by the web page. When the user obtains the web page from the web server 4 by means of a request, the beacons are not sent directly. When the page is displayed within the user's client device 2, for example through a web browser 3, the beacons referenced within the web page are requested from the web server 4. Therefore, it is possible to identify whether the online service page has actually been displayed on the client device 2 by checking in the register of requests to the web server 4 whether requests for beacons have been sent. A web beacon could be a resource already on the page (for example, a logo or other graphic elements). Or it could be an image, for example an image consisting of a single transparent pixel inserted specifically in order to ensure monitoring. These resources comprise a reference consisting of a unique name within the web page.

[0107] Furthermore, the method comprises the step of collecting by the traffic inspector 1 third characteristic data concerning unique and/or non-unique technical parameters and associating the third characteristic data with the anonymous web beacon via the traffic analyzer 5.

[0108] The method comprises the step of comparing by a user prediction algorithm 7 residing in the traffic analyzer 5 the first characteristic data concerning each identified username with the third characteristic data concerning the anonymous web beacon to associate the anonymous web beacon with an identified username in case of similarity or substantial coincidence between the first characteristic data and the third characteristic data so compared.

[0109] The method further comprises the step of analyzing by a detection algorithm 8 residing in the traffic analyzer 5 each anonymous web beacon associated with one or more identified usernames to enter each username associated with the anonymous web beacon in which a situation involving risk of credential theft following a phishing attack is detected in a watch list.

[0110] The method comprises the step of monitoring the browsing sessions at risk associated with each username in the watch list when the respective user performs further authentication to the online service. In addition, this step involves identifying an account take over attack by the client device 2 when the anonymous browsing session and the subsequent authenticated session associated with the same username entered in the watch list are close in time. Furthermore, this step involves protecting access to the online service when an account take over risk is identified.

[0111] According to a preferred form, the step of monitoring the browsing sessions associated with each username in the watch list comprises the sub-steps of: [0112] identifying by means of the detection algorithm 8 the browsing sessions at risk associated with each username in the watch list when the respective user performs authentication to the online service; [0113] protecting the browsing sessions at risk using a protection algorithm 9 residing in the traffic analyzer 5.

[0114] Preferably, the step of protecting the browsing session at risk using the protection algorithm 9 comprises the step of locking the username of the user associated with the browsing session at risk or executing a Strong Customer Authentication algorithm for the username of the user associated with the browsing session at risk or executing a Multi-Factor Authentication algorithm for the username of the user associated with the browsing session at risk.

[0115] Preferably, the step of monitoring the browsing sessions associated with each username in the watch list comprises the step of generating a risk signal indicative of the presence of a possible threat associated with the phishing attack in the browsing session at risk.

[0116] According to a preferred form, the method comprises the step of removing a username from the watch list when the detection algorithm 8 detects that the phishing attack is over.

[0117] Preferably, the step of removing a username from the watch list comprises the step of removing a username from the watch list when a predefined time interval has elapsed from the moment when the detection algorithm 8 has detected that the malware attack is over.

[0118] In accordance with a preferred solution, the step of collecting, by the traffic inspector 1, first characteristic data concerning unique and/or non-unique technical parameters and associating, by the traffic analyzer 5, the first characteristic data with a respective identified username comprises the sub-step of collecting, by the traffic inspector 1, first characteristic data concerning one or more of unique technical parameters, non-unique technical parameters, endpoints, networks and browsers.

[0119] Preferably, the step of collecting, by the traffic inspector 1, third characteristic data concerning unique and/or non-unique technical parameters and associating, by the traffic analyzer 5, the third characteristic data with the anonymous web beacon, comprises the sub-step of collecting, by the traffic inspector 1, third characteristic data concerning one or more of unique technical parameters, non-unique technical parameters, endpoints and browsers.

[0120] Preferably, the first characteristic data and the third characteristic data comprise UUID and IP.

[0121] According to a preferred form, the step of monitoring the browsing sessions at risk associated with each username in the watch list when the respective user performs further authentication to the online service, comprises the sub-step of comparing, by the detection algorithm 8, the first characteristic data associated with a username in the watch list with the first characteristic data collected by the traffic inspector 1 when the respective user performs further authentication to the online service to identify the presence of any anomalies.

[0122] According to a preferred solution, the step of comparing, by the detection algorithm 8, the first characteristic data associated with a username in the watch list with the first characteristic data collected by the traffic inspector 1 when the respective user performs further authentication to the online service to identify the presence of any anomalies, comprises the sub-step of generating a warning P when the first characteristic data associated with a username in the watch list differ from the first characteristic data collected by the traffic inspector 1 when the respective user performs further authentication to the online service.

[0123] Preferably, the step of identifying each generated anonymous web beacon of the client device 2 on the online service by the traffic analyzer 5, comprises the step of identifying each generated anonymous web beacon of the client device 2 on the online service by the traffic analyzer 5 using session cookies.

[0124] According to a preferred form, the step of identifying each browsing session of the client device 2 on the online service by the traffic inspector 1, comprising the sub-step of intercepting by the traffic inspector 1 an HTTP request sent by a web browser 3 residing in the client device 2 to the web server (4). Preferably, the step of analyzing the traffic exchanged between the client device 2 and the web server 4 by the traffic analyzer 5 to extract and identify at least one username when a user performs authentication to the online service, comprises the step of extracting a username from the HTTP request intercepted by the traffic inspector 1 when a user performs authentication to the online service by means of an extraction algorithm 10 residing in the traffic analyzer 5 and based on regular expressions.

[0125] According to a preferred form, the method comprises the step of modifying the online service by inserting a web beacon therein. For the purpose of searching for phishing sites, it is important that the resources constituting the web beacon are entered in site locations which are difficult to identify by the imposter F, to prevent them from being removed during the cloning operation of the legitimate site.

[0126] Preferably, the web beacon comprises an HTTP request from a resource residing within the web server 4. Preferably, the step of identifying each generated anonymous web beacon of the client device 2 on the online service by the traffic analyzer 5 comprises the sub-step of intercepting by the traffic inspector 1 each HTTP request associated with an anonymous web beacon. Still preferably, the step of collecting by the traffic inspector 1 third characteristic data concerning unique and/or non-unique technical parameters and associating by the traffic analyzer 5 the third characteristic data with the anonymous web beacon; comprises the sub-step of sending by the traffic inspector 1 the third characteristic data to the traffic analyzer 5, the third characteristic data being associated with unique and/or non-unique technical parameters characteristic of the request associated with the anonymous web beacon.

[0127] Preferably, the step of analyzing by means of a detection algorithm 8 residing in the traffic analyzer 5 each anonymous web beacon associated with one or more identified usernames to enter each username associated with the anonymous web beacon in which a situation involving risk of credential theft following phishing in a watch list, comprises the sub-steps of: [0128] analyzing whether each HTTP request intercepted by the traffic inspector 1 and concerning a web beacon associated with a username comes from the legitimate domain of the online service; [0129] generating a warning P when an HTTP request does not come from the legitimate domain of the online service.

[0130] More preferably, the step of generating a warning P when an HTTP request does not come from the legitimate domain of the online service comprises the step of sending the warning P to the user holding the username associated with the web beacon concerning the HTTP request not coming from the legitimate domain of the online service.

[0131] Advantageously, the user accesses the malicious site from an IP and/or with a UUID typically associated with the username thereof. Such characteristic information is transported within resource requests made to the legitimate server. They can thereby be intercepted by the traffic inspector 2 and sent to the traffic analyzer 5. The traffic analyzer 5 is capable of analyzing the requests and detecting phishing attacks using known art techniques. Furthermore, the traffic analyzer 5 is capable of associating identified phishing attacks with an unidentified user using characteristic information such as IP and UUID associated with requests.

[0132] Preferably, the step of identifying each generated anonymous web beacon of the client device 2 on the online service by the traffic analyzer 5 is performed by the detection algorithm 8.

[0133] The present invention also relates to a third embodiment of the invention which includes the combination of the previous embodiments, i.e., a combination of the first embodiment with the second embodiment.

[0134] The third embodiment relates to a method of monitoring and protecting access to an online service from account take over comprising the step of providing a traffic inspector 1 in signal communication with at least one client device 2 for internet browsing and with a web server 4 having an online service residing therein.

[0135] The method comprises the step of providing a traffic analyzer 5 in signal communication with the traffic inspector 1.

[0136] The method comprises the step of identifying each browsing session of the client device 2 on the online service by the traffic inspector 1.

[0137] Furthermore, the method comprises the step of analyzing the traffic exchanged between the client device 2 and the web server 4 by the traffic analyzer 5 to extract and identify at least one username when a user performs authentication to the online service.

[0138] The method also comprises the step of collecting by the traffic inspector 1 first characteristic data concerning unique and/or non-unique technical parameters and associating the first characteristic data with a respective identified username by the traffic analyzer 5.

[0139] The method comprises the step of storing the first characteristic data associated with each identified username in a database 6 associated with the traffic analyzer 5.

[0140] The method comprises the step of identifying by the traffic analyzer 5 each anonymous application session and each anonymous virtual session of the client device 2 on the online service.

[0141] For each anonymous application session identified in the previous step, the method comprises the following steps: [0142] identifying an anonymous browsing session of the client device 2 on the online service by the traffic analyzer 5; [0143] collecting by the traffic inspector 1 second characteristic data concerning unique and/or non-unique technical parameters and associating by the traffic analyzer 5 the second characteristic data with the anonymous browsing session; [0144] comparing by means of a user prediction algorithm 7 residing in the traffic analyzer 5 the first characteristic data concerning each identified username with the second characteristic data concerning the anonymous session to associate an identified username with the anonymous browsing in case of similarity or substantial coincidence between the first characteristic data and the second characteristic data so compared; [0145] analyzing by means of a detection algorithm 8 residing in the traffic analyzer 5 each anonymous browsing session associated with one or more identified usernames to enter each username associated with the anonymous browsing session in which a situation involving a risk of credential theft has been detected in a watch list;

[0146] For each anonymous virtual session identified in the previous step, the method comprises the following steps: [0147] identifying each anonymous web beacon generated by the client device 2 on the online service by the traffic analyzer 5, the web beacon indicating that the client device 2 has initiated a fraudulent browsing session on a phishing web server 11; [0148] collecting by the traffic inspector 1 third characteristic data concerning unique and/or non-unique technical parameters and associating the third characteristic data with the anonymous web beacon via the traffic analyzer 5; [0149] comparing by means of the user prediction algorithm 7 residing in the traffic analyzer 5 the first characteristic data concerning each identified username with the third characteristic data concerning the anonymous web beacon to associate the anonymous web beacon with an identified username in case of similarity or substantial coincidence between the first characteristic data and the third characteristic data so; [0150] analyzing by means of a detection algorithm 8 residing in the traffic analyzer 5 each anonymous web beacon associated with one or more identified usernames to enter each username associated with the anonymous web beacon in which a situation involving risk of credential theft following a phishing attack is detected in the watch list.

[0151] In addition, the method comprises the step of monitoring the browsing sessions at risk associated with each username in the watch list when the respective user further performs authentication to the online service. In addition, this step involves identifying an account take over attack by the client device 2 when the anonymous browsing session and the subsequent authenticated session associated with the same username entered in the watch list are close in time. Furthermore, this step involves protecting access to the online service when an account take over risk is identified.

[0152] It should be noted here that the steps and sub-steps described for the first and second embodiments may also be applied to the method of the third embodiment, as the latter is a synergistic combination of the two preceding embodiments. In particular, the steps and sub-steps concerning the method of the first embodiment are applicable in the case of anonymous application sessions, while the steps and sub-steps of the method of the second embodiment are applicable in the case of virtual anonymous sessions.

[0153] Advantageously, by virtue of the method of the third embodiment it is possible to intercept all the anonymous requests or web beacons generated by the client device so as to be able to identify and prevent any risks related, respectively, to credential theft attacks by malware and/or phishing.

[0154] Obviously, in order to satisfy specific and contingent needs, a person skilled in the art may apply numerous changes to the variants described above, all without departing from the scope of protection as defined by the following claims.