A method for identifying between a legitimate client and an attacker, the method comprising: (a) identifying, by a device intermediary to a client and a server, a plurality of first properties of the client from which a first request is received to access the server via a session, wherein the plurality of first properties comprises a static property that does not change between multiple sessions and a dynamic property that changes between multiple sessions from the client; (b) storing, by the device, a first model of the client for the establisched using the plurality of first properties of the client for the session corresponding to a session cookie provided to the client, wherein the first model comprises models of a first networking stack, a first operating system, and a first browser of the client; (c) establishing, by the device, a second model of a second device using a plurality of second properties of the second device from which a second request for the session is received, the second request identifying the session cookie for the session, wherein the second model comprises models of a second networking stack, a second operating system, and a second browser of the second device; (d) identifying, by the device as a minimum subset for which the second model is to be considered a match to the first model, a predetermined subset of the second plurality of properties, the second networking stack, the second operating system, and the second browser of the second model of the second device and the first plurality of properties, the first networking stack, the first operating system, and the first browser of the first model; (e) determining, by the device, that the second request is not from the client for the session corresponding to the session cookie based on comparing the predetermined subset of the second plurality of properties, the second networking stack, the second operating system, and the second browser of the second model of the second device to a predetermined subset of the first plurality of properties, the first networking stack, the first operating system, and the first browser of the first model of the client stored for the session; and (f) rejecting, by the device responsive to the determination that the second request is not from the client for the session corresponding to the session cookie, the second request. (a) identifying, by a device intermediary to a client and a server, a plurality of first properties of the client from which a first request is received to access the server via a session, wherein the plurality of first properties comprises a static property that does not change between multiple sessions and a dynamic property that changes between multiple sessions from the client; (b) storing, by the device, a first model of the client for the establisched using the plurality of first properties of the client for the session corresponding to a session cookie provided to the client, wherein the first model comprises models of a first networking stack, a first operating system, and a first browser of the client; (c) establishing, by the device, a second model of a second device using a plurality of second properties of the second device from which a second request for the session is received, the second request identifying the session cookie for the session, wherein the second model comprises models of a second networking stack, a second operating system, and a second browser of the second device; (d) identifying, by the device as a minimum subset for which the second model is to be considered a match to the first model, a predetermined subset of the second plurality of properties, the second networking stack, the second operating system, and the second browser of the second model of the second device and the first plurality of properties, the first networking stack, the first operating system, and the first browser of the first model; (e) determining, by the device, that the second request is not from the client for the session corresponding to the session cookie based on comparing the predetermined subset of the second plurality of properties, the second networking stack, the second operating system, and the second browser of the second model of the second device to a predetermined subset of the first plurality of properties, the first networking stack, the first operating system, and the first browser of the first model of the client stored for the session; and (f) rejecting, by the device responsive to the determination that the second request is not from the client for the session corresponding to the session cookie, the second request.