Method for filtering attack streams targetting a connectivity module

A device for filtering attack flows targeting a connectivity module from a plurality of connection inflows, comprising:

• processing circuitry configured to
• determine a plurality of aggregates, each aggregate resulting from a combination of the plurality of connection inflows received during a predefined time period, said time period considered to determine each aggregate being different from that considered to determine other aggregates, and time periods considered to determine the plurality of aggregates all being comprised in a first observation time window;
• determine a plurality of first measurement vectors that are each associated with one of said aggregates and that contain values of first characteristic parameters of the one of said aggregates with which it is associated;
• project the plurality of first measurement vectors into at least one sub-space defined by said first characteristic parameters, wherein a sub-space is a grid of cells defined by a first axis and a second axis, the first axis corresponding to a one of the first characteristic parameters and the second axis corresponding to a second one of the first characteristic parameters;
• determine another aggregate resulting from a combination of a plurality of connection inflows received during another time period, said another time period following the first observation time window;
• determine another first measurement vector that is associated with the another aggregate and that contains values of first characteristic parameters of the another aggregate;
• project the another first measurement vector into at least one sub-space defined by said first characteristic parameters;
• determine an abnormality score depending on the result of the projection of the another first measurement vector and of the projection of the plurality of first measurement vectors, wherein the abnormality score corresponds to a distance between (i) a cell within the at least one sub-space to which the first measurement vector is projected and (ii) one or more closest dense cells in the subspace where a proportion of the projection of the plurality of first measurement vectors is higher than a predetermined percentage;
• and
• compare the abnormality score to a first threshold and to a second threshold,
• wherein
• when the abnormality score is higher than the second threshold, the presence of an attack is detected in the another time period,
• when the abnormality score is lower than the first threshold, the absence of an attack is detected in the another time period,
• when the abnormality score is between the first threshold and the second threshold then the abnormality score is in a zone of doubt as to a presence of attack flows and the processing circuitry is configured to:
• determine a plurality of second measurement vectors that are each associated with one of said aggregates and that contain values of other characteristic parameters of the aggregate with which it is associated, said other characteristic parameters being different from said first characteristic parameters,
• determine another second measurement vector that is associated with the another aggregate and that contains values of other characteristic parameters of the another aggregate, and
• detect the presence or absence of an attack by analyzing the another second measurement vector.