Method for filtering attack flows targeting a connectivity module of a motor vehicle receiving a plurality of connection inflows, the method comprising the following steps: - determining a plurality of aggregates, each aggregate resulting from the combination of the plurality of connection inflows received during a predefined time period (δt i), said time period (δt i) considered to determine each aggregate being different from that considered to determine the other aggregates, and the time periods (δt i) considered to determine the plurality of aggregates all being comprised in a first observation time window (Δt), - determining a plurality of first measurement vectors (X i) that are each associated with one of said aggregates and that contain values of first characteristic parameters of the aggregate with which it is associated, - projecting the plurality of first measurement vectors (X i) into at least one sub-space defined by said first characteristic parameters, - determining another aggregate resulting from the combination of a plurality of connection inflows received during another time period (δt N+1), said other time period (δt N+1) following the first observation time window (Δt), - determining another first measurement vector (X N+1) that is associated with the other aggregate and that contains values of first characteristic parameters of the other aggregate, - projecting the other first measurement vector (X N+1) into at least one sub-space defined by said first characteristic parameters, - determining an abnormality score (S) depending on the result of the projection of the other first measurement vector (X N+1) and of the projection of the plurality of first measurement vectors (X i), then, if the abnormality score (S) is comprised in a zone of doubt as to the presence of attack flows: - determining a plurality of second measurement vectors (Y i) that are each associated with one of said aggregates and that contain values of other characteristic parameters of the aggregate with which it is associated, said other characteristic parameters being distinct from said first characteristic parameters, - determining another second measurement vector (Y N+1) that is associated with the other aggregate and that contains values of other characteristic parameters of the other aggregate, and - detecting the presence or absence of an attack by analyzing the other second measurement vector (Y N+1). - determining a plurality of aggregates, each aggregate resulting from the combination of the plurality of connection inflows received during a predefined time period (δt i), said time period (δt i) considered to determine each aggregate being different from that considered to determine the other aggregates, and the time periods (δt i) considered to determine the plurality of aggregates all being comprised in a first observation time window (Δt), - determining a plurality of first measurement vectors (X i) that are each associated with one of said aggregates and that contain values of first characteristic parameters of the aggregate with which it is associated, - projecting the plurality of first measurement vectors (X i) into at least one sub-space defined by said first characteristic parameters, - determining another aggregate resulting from the combination of a plurality of connection inflows received during another time period (δt N+1), said other time period (δt N+1) following the first observation time window (Δt), - determining another first measurement vector (X N+1) that is associated with the other aggregate and that contains values of first characteristic parameters of the other aggregate, - projecting the other first measurement vector (X N+1) into at least one sub-space defined by said first characteristic parameters, - determining an abnormality score (S) depending on the result of the projection of the other first measurement vector (X N+1) and of the projection of the plurality of first measurement vectors (X i), - determining a plurality of second measurement vectors (Y i) that are each associated with one of said aggregates and that contain values of other characteristic parameters of the aggregate with which it is associated, said other characteristic parameters being distinct from said first characteristic parameters, - determining another second measurement vector (Y N+1) that is associated with the other aggregate and that contains values of other characteristic parameters of the other aggregate, and - detecting the presence or absence of an attack by analyzing the other second measurement vector (Y N+1).