Abstract: Method(s) and apparatus are provided for detecting anomalous application message sequences in an application communication session between a user device and a network node. The application communication session associated with an application executing on the user device. This involves receiving an application message sent between the user device and the network node, where the received application message is associated with a received application message sequence comprising application messages that have been received so far. An estimate of the next application message to be received is generated using traffic analysis based on techniques in the field of deep learning on the received application message sequence. The estimated next application message forms part of a predicted application message sequence. The received application message sequence is classified as normal or anomalous based the received application message sequence and a corresponding predicted application message sequence.