Monitoring device and method implemented by an access point for a telecommunications network

A monitoring method implemented by an access point to a telecommunications network, the access point configured to maintain an address association table comprising at least one entry associating a public transport address with a private transport address, each transport address comprising an IP address and a port, the method comprising:

• selecting at least two entries in the address association table;
• memorizing at least one first characteristic obtained over a first period of time for each incoming flow and each outgoing flow associated with the selected entries;
• comparing, for at least one pair of selected entries, of at least one characteristic memorized for an incoming flow associated with one of the entries of the pair with the at least one corresponding characteristic memorized for an outgoing flow associated with the other entry of the pair;
• and
• detecting a risk of fraud upon determining, for at least one pair of entries, that an incoming flow associated with one of the entries of the pair transports an application content of the same kind as an outgoing flow associated with the other entry of the pair.