Abstract: A method of detecting an unauthorised communication from a network node in a telecommunication network is disclosed, and a network node implementing the method. Network messages are received in the telecommunication network, and statistical patterns inherent to a sequence of received network messages are generated from a plurality of identifier values associated with a legitimate network node, wherein each identifier value has been encoded by the legitimate network node in a respective network message. An identifier value encoded in a subsequently-received network message of a signalling network node is then compared with one or more of the statistical patterns and one or more unsuccessful comparisons cause the signalling network node to be detected as an unauthorised network node.