FR3087912A1 - COMPUTER INTRUSION ANTICIPATION PROCESS - Google Patents

Abstract

The invention relates to a computer intrusion anticipation method comprising the following steps: - aggregation of data from past intrusions or attempted intrusions (14a-14e); - enrichment of each data (Dx); - creation of symbolic data classes (Cx) on said enriched data (Dx); - for several initial conditions (Ci), grouping (54) of said symbolic data classes (Cx) on the basis of an initial condition (Ci) by means of a dynamic cloud algorithm (23); - determination (55) of the most recurring groupings (R1-R5) forming sets of concomitant intrusions or attempts at past intrusions; - search (56) for at least one precursor element (Ep) linked to a set; and - implementation (57) of detection means (15a-15e) of said at least one precursor element (Ep) so as to anticipate the occurrence of a computer intrusion attempt.

Description

TECHNICAL FIELD The invention relates to a method of computer intrusion anticipation, that is to say a method for detecting the imminence of a computer intrusion attempt in order to activate effective countermeasures.

For example, the invention makes it possible to limit access to a computer server for a set of Internet addresses when a risk of attack originating from these addresses is detected.

The invention finds a particularly advantageous application for countering computer hackers who carry out massive attacks on a computer system by means of bots.

The term "bot" is the contraction of the term "robot".

Within the meaning of the invention, a bot is an automatic or semi-automatic software agent which interacts with at least one computer server in the manner of a client program used by a human.

This interaction between the server and the bot is facilitated by the use of the Internet network and of the Internet address transmission and control protocol, better known by the abbreviation TCP / IP for “Transmission Control Protocol / Internet Protocol” in the literature. Anglo-Saxon.

The present invention relates to a particular field of analysis, namely the analysis of symbolic data.

BACKGROUND ART The last decade has seen the emergence of massive computer attacks aimed at destabilizing one or more computer systems.

Many analyzes are carried out on these attacks in order to determine the protagonists and / or the motivations behind these massive attacks.

2 In addition, some analyzes have shown recurring behaviors among hackers, such as spear phishing techniques through email messages.

As a result of these analyzes, the staff of a large number of companies have been trained to thwart this type of attack.

However, only the most obvious observable behaviors are detectable with classical digital data analysis methods.

The present invention relates to a more general field of analysis than the digital one, namely the analysis of symbolic data.

Symbolic data analysis extends classical data analysis to more complex data and often closer to multidimensional reality.

This new field of mathematical analysis is described in particular in the scientific publications “Analysis of symbolic data and the knowledge graph of an agent” by Philippe Caillou and Edwin Diday (EGC 2005, Paris) and “Introduction to the analysis of symbolic data By Edwin Diday (HAL, May 2006).

Symbolic Data Analysis (ADS) is based on modeling the real world assumed to be made up of individuals and concepts.

The individuals are modeled in a description space which expresses the properties using variables and a description consists of one or more products expressing these properties by their domain of variation for the individual considered.

A class of individuals is modeled in the description space using an operator using the descriptions of the individuals that constitute it.

Each individual is thus considered as a particular case of classes of individuals.

The concepts are modeled in a space called “symbolic objects”.

Each symbolic object is defined by a triplet formed by a description of a class of individuals, a comparison operator between two descriptions and a recognition function.

3 The principle of ADS is to analyze a set of individuals while taking into account the specific statistics, the repeated data and the internal variation of each of them.

In summary, ADS is a new field of mathematical analysis aimed at conserving the complexity of a large number of agglomerated data.

ADS has already shown interesting results for multiple applications, such as the detection of anomalies on structures, the monitoring of the structural health of structures, the prediction of the service life of structures. art, the implementation of intelligent systems for the prevention of structural risks, the study of patient care pathways in a territory, or the study and prevention of natural and technological risks in a territory.

However, ADS has never been used in the area of computer intrusions.

The objective technical problem which the invention proposes to solve is to anticipate certain computer intrusion attempts.

DISCLOSURE OF THE INVENTION The present invention results from a discovery according to which the analysis of symbolic data on past attacks makes it possible to group together several intrusions or attempted intrusions prior to a given massive attack.

For each massive attack, it is possible to search for the occurrence of precursor events of the attack.

These precursor events correspond, most often, to tests carried out to configure the bots intended to perpetrate the attacks.

Thus, by looking for the occurrence of these precursor events, often minor, difficult to detect and isolated, it is possible to anticipate a future attempt at computer intrusion.

In the context of the invention, ADS aims to detect these precursor events in a large number of heterogeneous data collected.

ADS makes it possible to merge and exploit these heterogeneous data 4 by means of a dynamic cloud algorithm with several initial conditions.

To this end, the invention relates to a computer intrusion anticipation method comprising the following steps: aggregation of data on intrusions or past intrusion attempts, each data item comprising at least one time-stamp indication, a originating internet address, a target internet address and a port linked to the intrusion or past intrusion attempt; 10 - enrichment of each piece of data so as to associate said originating internet address with at least one geographic information item and said target internet address with at least one business sector; - creation of symbolic data classes on said enriched data, said symbolic data classes comprising: - at least one class linked to time information for the first detection of each originating internet address; - at least one class linked to recurrence information for each originating internet address; at least one class linked to recurrence information for each target internet address; and - at least one class linked to recurrence information for each port of each data item; - for several initial conditions, grouping of said symbolic data classes on the basis of an initial condition by means of a dynamic cloud algorithm; - determination of the most recurring groupings forming sets of concomitant past intrusions or attempted intrusions; - search for at least one precursor element linked to a set, and - implementation of means for detecting said at least one precursor element so as to anticipate the occurrence of a computer intrusion attempt.

The invention thus makes it possible to use the symbolic data classes to form groupings and to detect recurrences in these groupings forming sets of concomitant intrusions or attempts at past intrusions.

For example, it is possible to detect that a large number of attacks are carried out simultaneously from several Internet addresses simultaneously and that these attacks generally target the same sector of activity.

5 By researching the previous activities of these internet addresses, it is possible to detect that small-scale tests are first performed from a particular internet address and under particular conditions, for example on a public holiday in the country of attacking internet address.

In doing so, it is possible to detect a precursor event linked to a set of intrusions or past intrusion attempts.

For the purposes of the invention, the internet address is understood within the meaning of the TCP / IP protocol, for example the TCP / IP version 4 or version 6 protocol.

The detection of this precursor event is particularly advantageous for protecting a network, since it suffices to implement means for detecting this precursor event, in the form of a scenario, in order to detect the imminence of an attempt to intrusion.

In the previous example, by detecting that small-scale tests, preceding a massive attack, are carried out by a particular internet address or by an internet address in the same city, it suffices to implement a detection of the 20 requests coming from this internet address to anticipate a massive attack.

Additionally, if the request is made on a public holiday, there is a good chance that it will be a vulnerability test before a massive attack.

It is also possible to detect the time between the first request and the massive attack, generally corresponding to the time necessary for the hacker to prepare his massive attack.

For example, if the average time between the first request from an internet address and the massive attack associated with that internet address is one week.

It is possible to anticipate the day of a massive attack by detecting a first request from the internet address detected as a precursor event.

30 On the day of the anticipated massive attack, it is possible to limit the number of requests or block requests from a list of addresses, cities, regions, countries or a digital whole defined as a community of connected objects.

Alternatively, if the day of the massive attack is not detected, it is possible to block these requests for a predetermined period of time, for example for a week.

In doing so, the invention makes it possible to anticipate a planned massive attack by a hacker or a group of hackers in order to minimize or cancel out the effects of this massive attack.

To do this, it is important to form efficient groupings of symbolic data classes.

Upstream, it is therefore necessary to form relevant symbolic data classes for these groupings.

To obtain exploitable results, the invention proposes forming the following classes: at least one class linked to a first detection time information item for each originating internet address, for example a first class representing the 15th day of said first detection of each originating internet address, a second class representing the month of said first detection of each originating internet address, a third class representing the quarter of said first detection of each originating internet address, a fourth class representing the time of said first detection of each originating internet address, and a fifth class 20 representing the presence or absence of a public holiday, in the country of the target internet address, on the day of said first detection of each originating internet address; at least one class linked to recurrence information for each originating internet address, for example a class representing the number of data items linked to a specific country or city of said originating internet address, and a class representing, in the form histograms, said data linked to a specific country or city of said originating internet address; - at least one class linked to recurrence information for each target internet address, for example a first class representing the number of data linked to a target internet address and / or a sector of activity, and a second class representing, 30 sub in the form of histograms, said data linked to a target internet address and / or a sector of activity; and - at least one class linked to recurrence information for each port of each data item, for example a first class representing the evolution of the recurrence interval 7 of the data associated with the port, and a second class representing, in the form of 'histograms, said evolutions of said first class.

As a variant, it is possible to select only one or more of the classes described as long as all of the classes have a class linked to time information of the first detection of each internet address of origin, a class linked to recurrence information. of each originating internet address, a class linked to recurrence information for each target internet address and a class linked to recurrence information for each port of each data.

10 It is also possible to link the originating internet address with a subnet, such as a neighborhood, region or geographic continent.

Thus, it is possible to determine symbolic data classes linked to a specific subnet of the originating internet address.

For the purposes of the invention, a subnetwork is understood with reference to the 15 layers of the TCP / IP protocol, for example the TCP / IP version 4 or version 6 protocol.

When the classes are defined, a dynamic cloud algorithm performs groupings based on initial conditions.

This algorithm is an iterative method which, whatever its starting point, converges towards a solution.

For example, for a first iteration, a first starting point aims to associate the center of the classes with objects.

In a second iteration, the distance between objects and centers is calculated and the objects are assigned to the centers to which they are closest.

In a third iteration, the centers are redefined from the objects that have been assigned to the different classes.

In a fourth iteration, the objects are reassigned based on their distance to the new centers and so on until convergence is reached.

The solution obtained is not necessarily the same regardless of the starting point.

For this reason, the grouping calculations are carried out for several initial conditions in order to retain only the most optimal solution for the chosen criterion.

These starting points can be a timestamp over a given period, a originating internet address in a given range, a port in a given list, and a target internet address and / or industry in a given list.

BRIEF DESCRIPTION OF THE FIGURES 8 The manner of carrying out the invention as well as the advantages which result therefrom will emerge clearly from the following embodiment, given by way of indication but not limiting, in support of the appended figures in which FIGS. 1 and 2 represent: 5 - Figure 1: a schematic representation of a set of servers protected by a computer intrusion anticipation device; and - Figure 2: a flowchart of the steps of the computer intrusion anticipation method according to one embodiment of the invention.

DETAILED DESCRIPTION OF THE INVENTION In the present description which follows, the complete mathematical theory of symbolic data analysis will not be described in detail due to its complexity.

However, as described above, the invention relates to the technical field of symbolic data analysis and a person skilled in the art is familiar with the mathematical theories related to symbolic data analysis.

More particularly, as illustrated in FIG. 1, the invention requires the use of a dynamic cloud algorithm 23 to perform groupings R1-R5 from initial conditions Ci.

There are several methods to physically implement this dynamic cloud algorithm 23.

For example, three of these methods are described in the scientific publication "Three new methods of automatic classification of symbolic interval-type data", Rev.

Applied Statistics, 2003, LI (4), 529, M.

Chavent & co.

Either of these methods can be used to carry out the invention.

In addition, the SYR software from the SYMBAD® company can be used to form these R1-R5 groupings from classes Cx and from predefined initial conditions Ci.

Before obtaining coherent classes, as illustrated in FIG. 2, a first step consists in aggregating 50 of the intrusion data.

As in many statistical analysis systems, the greater the number of intrusion data, the more it is possible to characterize phenomena.

To this end, the data 14a-14e of intrusions 9 and / or attempted intrusions of multiple servers 13a-13e connected to the internet 11 are retrieved by a module 20.

These servers 13a-13e generally include a request filter device 12a-12e and each request can be listed at the level of this request filter device 12a-12e or at the level of the server 13a-13e.

After an intrusion by a hacker or, more generally, an intrusion attempt, the information 14a-14e contained in the hacker's requests can be distinguished from other requests received by the server 13a-13e.

10 To perform a request on a server 13a-13e, the software transmitting the request must provide an internet address IP_D corresponding to the targeted servers 13a-13e as well as a port number P of this server 13a-13e on which the request must be executed.

At the level of the server 13a-13e, when a request is received, the internet address IP_A of the computer on which the request was generated appears.

The request storage directory classically lists, in a chronological and time-stamped manner, all the requests received by the server 13a-13e, indicating, on each line, the date and time of the request as well as the internet address of from IP_A and the port P on which the request was made.

The aggregation module 20 retrieves all of the requests identified as coming from a hacker and, for each request, associates the internet address IP_D of the server 13a-13e on which the request was presented.

Over time, the aggregation module 20 lists a large number of requests from 25 computer hackers with, for each request, at least the attacker's internet address [P_A, the destination internet address EP D on which the request has been presented, the port P on which the request has been presented, and timestamp information Dt of the request, typically the date and time at which the request was presented.

Other information can also be aggregated at the level of the module 20.

For example, it is possible to detect a time before an Internet address IP_A of a hacker is referenced in a blacklist.

As illustrated in FIG. 2, when the data Dx is collected, the method comprises a step 51 aimed at enriching its data Dx.

Indeed, by analyzing an internet address, it is possible to deduce from it the city, the country, the region, the district as well as a large number of geographical and structural information of the network through which the internet address 5 is. contained.

This enrichment step aims to determine at least the country and / or the city associated with the Internet IP address A of a hacker.

Likewise, the internet address IP_D of the targeted server can be referenced in a database associating the internet address of each server with information on the nature of the company using the server 13a-13e.

For example, each internet address of the different 13a-13e servers can correspond to an APE code, used in France to categorize the products and services of a company.

By using the data Dx associated with the port P mentioned in the request, it is possible to determine the type of attack perpetrated by the hacker.

For example, when a request is presented on a specific port, it can be interpreted that the hacker seeks to carry out an intrusion attempt according to a specific operating mode, such as the remote takeover or the attempt to overwork. an Internet site.

It is thus possible to obtain enriched data Dx corresponding to the data aggregated in step 50 associated with certain data deduced from the aggregated data.

On the basis of these enriched data generated by a module 21, the invention proposes to generate symbolic data classes.

For the purposes of the invention, the word “class” takes on a mathematical meaning, that is to say that it corresponds to a subset of individuals endowed with a common property.

Various kinds of variability are described within classes.

In the analysis of symbolic data, two types of variables are used: 30 - “initial” variables, so called because they are defined on the initial population of individuals and 11 - so-called “symbolic” variables, whose first characteristic is to be defined on classes of individuals of the initial population, and the second characteristic is to take symbolic values not reducible to numbers or to categories.

In the context of the invention, the initial variables correspond to the enriched data.

The symbolic data classes can correspond to the day Jd of the first detection of the Internet address IP_A of the pirate on all the servers as well as to the quarter Td, the month Md and the hour Hd of this first detection.

In addition, a class of binary symbolic data Jf can indicate, for each internet address IP_A, whether the day Jd of the first detection corresponds to a public holiday.

To form a symbolic data class, it is possible to analyze and extract information in an initial file grouping together all the enriched data Dx.

15 Other symbolic data classes can correspond to the number of lines of the initial file comprising an identical country nb_pays_IP_A.

This type of class is called an interval in the field of symbolic data analysis.

On the basis of this number of lines of the initial file presenting an identical country nb_pays_IP_A, it is possible to create a new symbolic data class nb_pays_IP_A_h5 representing this first symbolic data class in the form of a discretized histogram.

For example, by using a level 5 discretization, the first column of the histogram can contain only the countries which are present only once on all the attacks, the second column of the histogram can contain the countries which are represented two to four times out of the set of attacks, the third column of the histogram can contain countries that are present between five and nine times in the set of attacks, the fourth column of the histogram can contain the countries present between 10 and 20 times while the fifth column can contain countries present more than 20 times.

These classes can be formed in an identical manner on the cities nb_ville_IP_A, nb_ville_IP_A_h5 of the pirate's IP_A internet address or on the nb_IP_tr, nb_IP_tr _h5 subnet used by the pirate.

Likewise, it is possible to group together the attacks targeting the same sector of activity by identifying the number of lines of the initial file 12 corresponding to an identical activity.

From this class nb_act_IP_D, it is possible to discretize the number of lines of the initial file in the form of a histogram nb_act_IP_D_h5.

Another class of symbolic data can correspond to the number of lines of the initial file relating to an identical port P nb_port or else a class di secretized nb_port_h5 on this class corresponding to the P ports used by the hackers.

These symbolic data classes correspond only to examples of interpretation of the enriched data Dx.

Depending on the nature of the attacks the prediction of which is desired, it is possible to modify or add symbolic data classes.

For example, it is possible to detect the date on which an internet address of the hacker is entered in a blacklist of each server 13a-13e and to detect a period during which the hacker always uses this address to carry out requests before making evolve its attacks, typically by using a new internet address.

Using this information, it is possible to track the activity of a specific hacker in order to trace their identity or, at the very least, their country of origin.

It is also possible to integrate into the symbolic data classes the number of attacks carried out from the same internet address IP_A or on the same targeted server 13a-13e.

As for the previous classes, this number of attacks can be obtained by associating with each internet address of the hacker detected in the initial file the number of lines of the initial file corresponding to this internet address.

Another symbolic data class can also discretize these values.

For example, by discretizing this value in 7 columns, it is possible to form a first column in which the internet address IP_A has carried out less than 10 attacks, a second column in which the internet address IP_A has carried out between 11 and 50 attacks, a third column in which the internet address IP_A carried out between 51 and 200 attacks, a fourth column in which the internet address IP_A carried out between 200 and 1000 attacks, a fifth column in which the internet address IP_A carried out between 1001 and 10,000 attacks, a sixth column in which the internet address IP_A carried out between 10,001 and 100,000 attacks, and a seventh column in which the internet address IP_A carried out more than 100,000 attacks.

13 By using the detection time of the hacker's internet addresses before they are blacklisted, it is possible to form a symbolic data class on this detection time in order to obtain information on the responsiveness of the security of the hacker. server 13a-13e.

Once again, a discretized class of this detection duration 5 can be formed on 8 distinct columns, a first column in which the duration of the blacklisting of the internet address is less than 20 seconds, a second column in which the duration is between 20 seconds and one minute, a third column in which the duration is between one minute and 10 minutes, fourth column in which the duration is between 10 minutes and one hour, a fifth column in which the duration is between between one hour and 24 hours, a sixth column in which the duration comprised between one day and 10 days, a seventh column in which the duration comprised between 10 days and 60 days, and an eighth column in which the duration greater than 60 days.

It is also possible to form symbolic data classes by operations between previously defined classes.

For example, it is possible to form a symbolic data class which multiplies the duration before the blacklisting of an internet address by the number of attacks associated with this internet address.

Thus, a large number of symbolic data classes can be formed on the enriched data Dx by a module 22 for creating the classes Cx.

These classes Cx are then transmitted to the algorithm 23 described above.

This algorithm 23 will use initial conditions Ci to group together the different classes of symbolic data Cx.

It is therefore appropriate to define, in a step 53, an initial condition Ci in order to carry out a particular grouping, in a step 54.

When the grouping is carried out, as illustrated in FIG. 1, one or more groupings R1-R5 of symbolic data classes Cx can be detected.

These R1-R5 groupings are stored and new groupings are sought for other initial conditions Ci.

The initial conditions Ci, can correspond to a time stamp over a given period, an Internet address of origin in a given interval, a port in a given list and a targeted address or a sector of activity in a given list.

For each of these initial conditions Ci, identical or distinct R1-R5 groupings may appear.

At the end of the determination of these multiple R1-R5 groupings, recurring Rx groupings are detected in a step 55.

Thus, the recurring groupings Rx show that one of the symbolic data classes is directly related to another symbolic data class.

For example, a hacker's internet address can be linked to a class illustrating the length of time before an internet address is stored in a blacklist.

This grouping may indicate that a particular hacker is used to detecting servers that do not quickly update internet addresses detected in the blacklist.

The hacker may then have the habit of using this information to carry out a massive attack with internet addresses known to the server but which have not yet been blacklisted.

By doing this type of grouping, it is possible, in a step 56, to search for a precursor element Ep in a previously detected recurring grouping Rx.

For example, this precursor element Ep can correspond to a first attack on a specific internet address or to a precise time at which a hacker conventionally carries out these vulnerability tests.

When this precursor element Ep is detected by a module 24, a module 25 implements, in a step 55, means for detecting this precursor element Ep.

Typically, a piece of information 15a-15e is propagated on the various servers 13a-13e so that they implement the necessary counter reactions.

The invention thus makes it possible to anticipate a computer intrusion on the basis of a previously observed modus operandi of a hacker or of a set of hackers.

Indeed, hackers are increasingly using malware with a specific algorithm.

By studying the nature, frequency and type of request, it is possible to detect a recurring operation resulting from a malware algorithm.

Even if a hacker 15 is using this software for the first time, the intrinsic behaviors of the software may have been previously observed and the hacker's actions can be anticipated because previous groupings have shown how a hacker would act through this malware. .

5 These malware can be sold to hackers through trading platforms.

The invention therefore makes it possible to neutralize malicious software used by a community, thus neutralizing several hackers.

10 More generally, the invention makes it possible to improve the computer security of a

Claims (10)

CLAIMS 1. Computer intrusion anticipation method characterized in that it comprises the following steps: - aggregation (50) of intrusion data or past intrusion attempts (14a-14e), each data item (Dx) comprising at least a timestamp indication (Dt), an originating internet address (IP A), a target internet address (IP D) and a port (P) linked to the intrusion or the past intrusion attempt; - enrichment (51) of each datum (Dx) so as to associate said originating internet address (IP_A) with at least one geographic item of information (villelP_A, payslP_A) and said target internet address (IP_D) with at least one sector of activity (act IP D); - creation (52) of symbolic data classes (Cx) on said enriched data (Dx), said symbolic data classes (Cx) comprising: - at least one class (Jd, Jf, Hd, Md, Td) linked to time information of the first detection of each originating internet address (IP_A); at least one class (number of IP country A, number of IP country A h5, number of city IP A, number of city _ IP A h5) linked to recurrence information for each originating internet address (IP_A); - at least one class (nb act IP D nb act IP D h5) linked to recurrence information for each target internet address (IP_D); and - at least one class (nbport, nb_port h5) linked to recurrence information for each port (P) of each data item; - for several initial conditions (Ci), grouping (54) of said symbolic data classes (Cx) from an initial condition (Ci) by means of a dynamic cloud algorithm (23); - determination (55) of the most recurring groupings (R1-R5) forming sets of concomitant intrusions or attempts at past intrusions; 30 - search (56) for at least one precursor element (Ep) linked to a set; and - implementation (57) of detection means (15a-15e) of said at least one precursor element (Ep) so as to anticipate the occurrence of a computer intrusion attempt. 17 2. Anticipation method according to claim 1, wherein the grouping step (54) of said symbolic data classes (Cx) is carried out on the basis of four initial conditions (Ci): - a timestamp (Dt) over a period. given; 5 - a originating internet address (IP A) within a given interval; - a port (P) in a given list; and - a target internet address (IP D) and / or a sector of activity (act IP D) in a given list. 3. Anticipation method according to claim 2, in which said symbolic data classes comprise at least two classes linked to recurrence information for each port (P) of each data: a first class (nb_port) representing the evolution of the recurrence interval of the data associated with the port; and - a second class (nb_port_h5) representing, in the form of histograms, said evolutions of said first class. 4. Anticipation method according to one of claims 1 to 3, in which, said symbolic data classes comprising at least five classes linked to time information 20 of the first detection of each originating internet address (IP A): - a first class (Jd) representing the day of said first detection of each originating internet address; a second class (Md) representing the month of said first detection of each originating internet address; - a third class (Td) representing the quarter of said first detection of each originating internet address; a fourth class (Hd) representing the time of said first detection of each originating internet address; and - a fifth class (7f) representing the presence or not of a public holiday, in the country of the target internet address (IP D), on the day of said first detection of each originating internet address (IP A) . 18 5. Anticipation method according to one of claims 1 to 4, wherein said at least one geographic information item of said originating internet address (IP A) comprises information (villelP A) on the city of said internet address of provenance and information (payslP_A) on the country of said internet address of origin. 5 6. Anticipation method according to claim 5, in which said symbolic data classes (Cx) comprise: a class (nb_pays IP A) representing the number of data linked to a specific country of said originating internet address (IP A ); and 10 - a class (nb_pays IP A h5) representing, in the form of histograms, said data linked to a specific country of said originating internet address (IP_A). 7. Anticipation method according to claim 5 or 6, wherein said symbolic data classes (Cx) comprise: - a class (nb city _IP_A) IP _A) representing the number of data linked to a specific city of said. originating internet address (IP A); and - a class (nb _ city _ IP _ A_ h5) representing, in the form of histograms, said data linked to a specific city of said originating internet address (IP A). 8. Anticipation method according to one of claims 1 to 7, wherein said at least one geographic information item of said originating internet address (IP_A) comprises information on the sub-network (SR_IP_A) of said internet address of 25 provenance (IP_A). 9. Anticipation method according to claim 8, in which said symbolic data classes (Cx) comprise: a class (nb 1P tr) representing the number of data linked to the specific sub-network of said originating internet address ( IP A); and - a class (nb IP tr h5) representing, in the form of histograms, said data linked to a specific sub-network of said originating internet address (IP_A). 19 10. Anticipation method according to one of claims 1 to 9, wherein said symbolic data classes (Cx) include at least two classes linked to recurrence information for each target internet address (IP D): - a first class (nb_act_IP_D) representing the number of data items linked to a target internet address (WD) and / or a sector of activity (act WD); and a second class (nb _ act _ IP D _h5) representing, in the form of histograms, _ said data linked to a target internet address (IP D) and / or a sector of activity (act IP D).