💻 computer science

Unsupervised Cross-Protocol Anomaly Analysis in Mobile Core Networks via Multi-Embedding Models Consensus

This paper proposes an unsupervised framework for detecting cross-protocol anomalies in mobile core networks by aggregating SS7, Diameter, and GTP signaling into fused records and leveraging a multi-embedding model consensus to effectively distinguish synthetic inconsistencies from normal traffic, thereby prioritizing a small, high-confidence set of candidates for security inspection.

Original authors: Aayush Garg, Orlando Amaral Cejas

Published 2026-07-02

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Aayush Garg, Orlando Amaral Cejas

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a mobile network as a massive, bustling international airport. Every passenger (a phone user) interacts with three different security checkpoints simultaneously:

Checkpoint A (SS7): The old-school, analog radio system used for decades.
Checkpoint B (Diameter): The modern digital ID scanner.
Checkpoint C (GTP): The baggage and tunnel system that moves data.

Usually, each checkpoint operates in its own silo. A security guard at Checkpoint A might see a valid ticket, and a guard at Checkpoint B might see a valid ID. But what if the ticket says "Passenger is in London," the ID says "Passenger is in Paris," and the baggage system says "Passenger is in Tokyo"? Individually, every document looks real. Together, they tell a lie. This is a cross-protocol inconsistency.

The problem is that we don't have a list of "known liars" (labeled attacks) to teach a computer what to look for. So, the researchers asked: Can we build a system that spots these contradictions without needing a teacher?

The Solution: The "Six-Headed Detective"

The researchers built a system that acts like a team of six different detectives, each with a unique way of reading the airport logs. Here is how they did it:

1. Merging the Logs (The Fusion)
First, they took all the messages for one passenger within a single minute and glued them together into one giant "fused record." Think of this as taking the passenger's boarding pass, their digital ID scan, and their baggage tag and stapling them into a single file.

2. Turning Data into "Sentences" (Serialization)
Computers can't read raw code easily. So, they turned these glued-together files into long strings of text, like a story describing the passenger's journey.

3. The Six Detectives (Embedding Models)
They fed these "stories" to six different AI models (the detectives). Each model is trained differently and has a unique "brain."

Some detectives are great at spotting short, punchy details.
Others are better at understanding long, complex stories.
Some speak many languages; others focus on specific technical jargon.

4. The Consensus Score (The Vote)
Each detective looks at the story and votes: "This looks suspicious" or "This looks normal."

If one detective says "Suspicious," it's a weak alert.
If all six detectives say "Suspicious," it's a Consensus.

The researchers found that when the detectives all agree, they are almost certainly spotting a real contradiction. When they disagree, it's often just noise.

The Experiment: Creating "Fake" Liars

Since they didn't have real attack data to test on, they had to create their own "fake liars" to see if the system worked.

They took two normal passenger files and performed a "field swap." Imagine taking the "London" ticket from Passenger A and swapping it with the "Paris" ticket from Passenger B.

The Result: Passenger A now has a ticket saying "London" but an ID saying "Paris."
The Trick: To the individual checkpoints, the ticket still looks valid, and the ID still looks valid. But when you look at them together, the story makes no sense.

They created over 200,000 of these "swapped" stories to test their system.

The Results: The Power of Agreement

The experiment yielded some fascinating results, which can be summarized with a simple metaphor: The "Crowd" vs. The "Critic."

The "Crowd" (Low Agreement): When the system flagged any record that even one detective thought was weird, it caught about 44% of all records. That's a lot of noise! It's like a security guard shouting "Stop!" every time a passenger walks through the door.
The "Critic" (High Agreement): When they raised the bar and only looked at records where all six detectives agreed it was weird, the number of flagged records dropped dramatically to less than 1%.
The Magic: Here is the kicker: In that tiny 1% group where all six agreed, 100% of the records were the "fake liars" they created. The system didn't flag a single normal passenger.

What This Means (In Simple Terms)

The paper proves that you don't need to know exactly what an attack looks like to find it. You just need a team of diverse AI models to look at the data together.

Low Agreement: Lots of false alarms.
High Agreement: Almost perfect accuracy.

By waiting for the "team" to agree, the researchers can filter out the noise and focus only on the tiny handful of records that are truly contradictory. It's like having a jury of six experts; if one person thinks a suspect is guilty, you might be wrong. But if all six experts agree, you can be very confident.

The Bottom Line

This study shows that by combining different AI models to look at mobile network data from multiple angles (SS7, Diameter, and GTP), we can automatically spot "impossible" situations where the data contradicts itself. This allows network operators to ignore the thousands of false alarms and focus their human attention on the very few, highly suspicious cases where the system is screaming in unison.

Technical Summary: Unsupervised Cross-Protocol Anomaly Analysis in Mobile Core Networks

Problem Statement
Mobile core networks operate multiple signaling protocols (SS7, Diameter, and GTP) in parallel. Many security-relevant issues, such as identity inconsistencies, false roaming indications, and misrouting, only become visible when these protocols are analyzed jointly for the same subscriber and time window. However, detecting these cross-protocol anomalies is challenging because:

Data Scarcity: Labeled examples of real attacks and cross-protocol misconfigurations are rarely available in operational settings, hindering the deployment of supervised learning methods.
Limitations of Existing Approaches: Rule-driven monitoring relies on expert-crafted signatures that often miss coordinated or novel multi-step issues. Furthermore, prior unsupervised and representation-learning approaches are typically confined to single protocols, overlooking causal dependencies across the control and user planes.

Methodology
The authors propose an unsupervised framework that fuses signaling data and leverages a multi-embedding model consensus to detect inconsistencies without human labels. The methodology consists of four main stages:

Per-Subscriber, Per-Minute Fusion:
The system aggregates decoded SS7, Diameter, and GTP messages for each subscriber within a one-minute window. These messages are grouped into a single "fused record" containing raw JSON fields from all three protocols. Only windows containing messages from at least two protocol families are retained for analysis.
Synthetic Anomaly Construction (Evaluation Ground Truth):
To evaluate the system without manual labels, the authors generate "cross-protocol-plausible" synthetic anomalies. This is achieved by swapping specific field groups between pairs of fused records. The swaps are designed to keep individual protocol messages syntactically valid while creating contradictions in the joint view. Thirteen mutation families were defined, covering critical fields such as:
- SS7: Calling/Called-Party Global Titles (CGGT/CDGT), Point Codes (OPC/DPC), and Application Context.
- Diameter: User-Name, Session-Id, Origin-Host, Visited-PLMN-Id, and APN Service-Selection.
- GTP: TEIDs, APN, User Location Information, and PDN IP Addresses.
Text Serialization and Embedding:
Each fused record is serialized into a normalized, single-line JSON string. These strings are passed to six different pre-trained embedding models (including bge-m3, jina-embeddings-v2, nomic-embed-text, and snowflake-arctic-embed variants). The models generate vector representations for records that fit their specific context windows without truncation.
Unsupervised Detection and Consensus Scoring:
For each embedding model, an unsupervised detector (Isolation Forest) is trained on the background traffic (with a small 5% injection of synthetic anomalies to shape the density landscape, but without using labels for fitting). The detector assigns a binary decision (anomalous or benign) to each record.
A Consensus Score ( $S$ ) is calculated for each record, representing the number of models (out of six) that flag the record as anomalous. This score serves as a ranking mechanism to prioritize candidates for inspection.

Key Contributions

Fusion Pipeline: A method to aggregate SS7, Diameter, and GTP records per subscriber and minute while preserving raw fields necessary for cross-protocol consistency checks.
Synthetic Anomaly Generator: A mutation-based approach to create protocol-plausible inconsistencies for evaluation, avoiding the need for manual labeling of real attacks.
Unsupervised Ensemble: A consensus-based ranking system that combines multiple embedding models and per-model detectors to identify anomalies.
Evaluation Framework: A method linking consensus levels to precision on synthetic anomalies and analyzing the separation of records in embedding space.

Results
The evaluation was conducted on a corpus of 219,294 fused records (8,122 original background records and 211,172 synthetic anomalies).

Consensus Distribution: At the lowest threshold ( $S \ge 1$ ), 44.15% of records were flagged by at least one model. As the consensus requirement increased, the fraction of flagged records dropped sharply. At full agreement ( $S \ge 6$ ), only 0.97% of records were flagged.
Precision and Separation:
- For thresholds $k = 1$ to $4$, records flagged as anomalous were hundreds of times more likely to be synthetic than original (Odds Ratios ranging from 236 to 572).
- For thresholds $k \ge 5$ , zero original (background) records were flagged. All flagged records at these levels were synthetic, indicating perfect separation between the synthetic anomalies and the background traffic in the tested configuration.
- Statistical tests (Fisher's exact test and Chi-square) yielded extremely small p-values ( $< 10^{-35}$ ), confirming the strong association between high consensus and synthetic anomalies.
Embedding Space Analysis: Cosine distance measurements between synthetic records and their original counterparts showed that distances increased with the consensus level. This suggests that records with higher model agreement are more clearly separated from normal traffic in the embedding space.

Significance and Claims
The paper claims that multi-embedding model consensus is an effective mechanism for prioritizing a much smaller candidate set of cross-protocol inconsistencies for further inspection. By increasing the consensus threshold, operators can significantly reduce the volume of records requiring manual review while maintaining a high probability that the remaining candidates represent genuine cross-protocol contradictions.

The authors emphasize that their findings are specific to the synthetic anomaly design and the selected model ensemble. They do not claim that the system detects all real-world attacks, noting that real incidents might involve multiple coordinated changes or longer time scales not captured by single-field swaps. However, the results support the utility of unsupervised, joint representation learning for identifying structured inconsistencies that are invisible in single-protocol views.