A method for classifying a TCP connection carrying HTTP traffic as a trusted or an untrusted TCP connection, the method being performed by an analyser device, the method comprising: - detecting an HTTP request message of an HTTP session in the HTTP traffic carried by the TCP connection; - obtaining, from headers of the detected HTTP request message, information to build a signature of the HTTP session; - comparing the signature of the HTTP session with signatures stored beforehand by the analyser device in a signatures database; - classifying the TCP connection as a trusted connection, when the signature of the HTTP session matches a signature that is stored beforehand by the analyser device in the signatures database and that is representative of a trusted HTTP client application; characterized in that the method further comprises: - performing an authentication procedure, when the signature of the HTTP session does not match any signature stored beforehand by the analyser device in the signatures database, the authentication procedure requesting a user to provide authentication data; - adding the signature of the HTTP session in the signatures database, when valid authentication data are provided by the user, the signature of the HTTP session being representative in the signatures database of a trusted HTTP client application, and classifying the TCP connection as a trusted connection; and otherwise, classifying the TCP connection as an untrusted connection, in that the authentication procedure comprises: - sending a response to a device having originated the detected HTTP request message, said response redirecting the device having originated the detected HTTP request message toward another URL; - receiving from the device having originated the detected HTTP request message another HTTP request message referring to said another URL; - sending in response to said another HTTP request message a web page via which the user is able to enter authentication information; and - when valid authentication information is received, considering the TCP connection as trusted, otherwise considering the TCP connection as untrusted, in that the web page is adapted to enable the user to enter a login and a password as authentication information, and in that the analyser device compares the entered login and passwords with login and password stored beforehand, or in that the web page is adapted to display a CAPTCHA image and enable the user to enter a string, and in that the analyser device compares the entered string with a predefined string corresponding to the displayed CAPTCHA image, and in that the web page is further adapted to enable the user to select a profile from amongst a set of profiles determined by the analyser device as compatible with the detected HTTP request message, each profile including a list of HTTP mandatory headers expected to be present in each HTTP request message compliant with the signature, a list of HTTP optional headers expected to be present in each HTTP request message compliant with the signature, a list of HTTP mandatory headers having specific values to be present in each HTTP request message compliant with the signature, and information representative of a sequence in which the HTTP mandatory headers appear in the detected HTTP request message. - detecting an HTTP request message of an HTTP session in the HTTP traffic carried by the TCP connection; - obtaining, from headers of the detected HTTP request message, information to build a signature of the HTTP session; - comparing the signature of the HTTP session with signatures stored beforehand by the analyser device in a signatures database; - classifying the TCP connection as a trusted connection, when the signature of the HTTP session matches a signature that is stored beforehand by the analyser device in the signatures database and that is representative of a trusted HTTP client application; - performing an authentication procedure, when the signature of the HTTP session does not match any signature stored beforehand by the analyser device in the signatures database, the authentication procedure requesting a user to provide authentication data; - adding the signature of the HTTP session in the signatures database, when valid authentication data are provided by the user, the signature of the HTTP session being representative in the signatures database of a trusted HTTP client application, and classifying the TCP connection as a trusted connection; and otherwise, classifying the TCP connection as an untrusted connection, - sending a response to a device having originated the detected HTTP request message, said response redirecting the device having originated the detected HTTP request message toward another URL; - receiving from the device having originated the detected HTTP request message another HTTP request message referring to said another URL; - sending in response to said another HTTP request message a web page via which the user is able to enter authentication information; and - when valid authentication information is received, considering the TCP connection as trusted, otherwise considering the TCP connection as untrusted,