Abstract: A method is performed by a network node for training of machine-learned models for detection of abnormal User Equipment, UE, behavior. The method comprises obtaining training data comprising a plurality of interaction logs for a respective plurality of training UEs and clustering each of the interaction logs of the training data into one or more activity clusters with a machine-learned behavior analysis model to learn one or more activities associated with at least one of the one or more activity clusters.

Abstract: It is provided a method for detecting a denial-of-service, DoS, attack on an upstream device. The method is performed in a radio network node. The method includes obtaining traffic characteristics on communication between a user equipment, UE, and the radio network node, wherein the traffic characteristics are obtained for a protocol in a protocol stack for radio access network, RAN, communication between the UE and the radio network node, and determining that a DOS attack is in progress towards the upstream device based on the traffic characteristics, wherein the upstream device is provided upstream from the radio network node.

Abstract: Detection equipment (46) detects a false cell (18) in a wireless communication network (10). The detection equipment (46) obtains a test dataset (40) that comprises one or more test datapoints (42), with each test datapoint indicating a combination (44) of values detected for a cell characteristic. The detection equipment (46) tests for the presence of a false cell (18) that is using the same cell identity as a genuine cell, based on an extent to which the test dataset (40) differs from a training dataset (26) according to a model (30) trained using the training dataset (26).

Abstract: A method performed by feature engineering equipment comprises obtaining a first dataset that comprises datapoints for features of the first dataset, wherein the features of the first dataset include cell-specific features that are specific to respective cells in a wireless communication network, wherein each datapoint of the first dataset comprises one or more cell-specific sets that are specific to one or more respective cells, wherein each cell-specific set includes one or more values for one or more respective cell-specific features that are specific to the same cell. The method further comprises forming, from the first dataset, a second dataset that comprises datapoints for features of the second dataset, and providing the second dataset, or a derivative of the second dataset, to model training equipment for training a machine learning model or to inference-making equipment for making an inference.

Abstract: A method is performed by a network node for training of machine-learned models for detection of abnormal User Equipment, UE, behavior. The method comprises obtaining training data comprising a plurality of interaction logs for a respective plurality of training UEs and clustering each of the interaction logs of the training data into one or more activity clusters with a machine-learned behavior analysis model to learn one or more activities associated with at least one of the one or more activity clusters.

Abstract: A method performed by feature engineering equipment comprises obtaining a first dataset that comprises datapoints for features of the first dataset, wherein the features of the first dataset include cell-specific features that are specific to respective cells in a wireless communication network, wherein each datapoint of the first dataset comprises one or more cell-specific sets that are specific to one or more respective cells, wherein each cell-specific set includes one or more values for one or more respective cell-specific features that are specific to the same cell. The method further comprises forming, from the first dataset, a second dataset that comprises datapoints for features of the second dataset, and providing the second dataset, or a derivative of the second dataset, to model training equipment for training a machine learning model or to inference-making equipment for making an inference.

Abstract: Detection equipment (46) detects a false cell (18) in a wireless communication network (10). The detection equipment (46) obtains a test dataset (40) that comprises one or more test datapoints (42), with each test datapoint indicating a combination (44) of values detected for a cell characteristic. The detection equipment (46) tests for the presence of a false cell (18) that is using the same cell identity as a genuine cell, based on an extent to which the test dataset (40) differs from a training dataset (26) according to a model (30) trained using the training dataset (26).