A method for traffic management, comprising: identifying which of multiple request-response transactions transmitted between a server and a client were generated in a browsing session and which request-response transactions do not belong to any browsing session by evaluating a criterion that depends on a temporal pattern of the request-response transactions; intercepting messages of the multiple request-response transactions communicated between the server and the client operated by a user, whereby a request-response transaction is a message pair that includes a client request message and a respective server response message; the method comprising: identifying in the intercepted messages, request-response transactions meeting a predefined criterion indicative of a browsing session start event that depends on the temporal pattern; determining, based on the temporal pattern, times of the identified intercepted messages as browsing session start times; identifying corresponding browsing session end times for the determined browsing session start times; and identifying the intercepted request-response transactions as belonging to a browsing session conducted by the user or not belonging to a browsing session conducted by the user, responsive to whether the transactions are between the identified browsing session start times and the respective browsing session end times. identifying which of multiple request-response transactions transmitted between a server and a client were generated in a browsing session and which request-response transactions do not belong to any browsing session by evaluating a criterion that depends on a temporal pattern of the request-response transactions; intercepting messages of the multiple request-response transactions communicated between the server and the client operated by a user, whereby a request-response transaction is a message pair that includes a client request message and a respective server response message; the method comprising: identifying in the intercepted messages, request-response transactions meeting a predefined criterion indicative of a browsing session start event that depends on the temporal pattern; determining, based on the temporal pattern, times of the identified intercepted messages as browsing session start times; identifying corresponding browsing session end times for the determined browsing session start times; and identifying the intercepted request-response transactions as belonging to a browsing session conducted by the user or not belonging to a browsing session conducted by the user, responsive to whether the transactions are between the identified browsing session start times and the respective browsing session end times. identifying in the intercepted messages, request-response transactions meeting a predefined criterion indicative of a browsing session start event that depends on the temporal pattern; determining, based on the temporal pattern, times of the identified intercepted messages as browsing session start times; identifying corresponding browsing session end times for the determined browsing session start times; and identifying the intercepted request-response transactions as belonging to a browsing session conducted by the user or not belonging to a browsing session conducted by the user, responsive to whether the transactions are between the identified browsing session start times and the respective browsing session end times.