AI-Assisted Anomaly Detection for Cybersecurity in IMS Core Networks: A KPI-Driven Study Based on Real-World Telecom Data
AI-Assisted Anomaly Detection for Cybersecurity in IMS Core Networks: A KPI-Driven Study Based on Real-World Telecom Data

Author(s): Bianca-Ștefania VĂDUVA
Subject(s): Politics / Political Sciences, Politics, Economy, Security and defense, ICT Information and Communications Technologies
Published by: Asociatia Romana pentru Asigurarea Securitatii Informatiei
Keywords: anomaly detection; artificial intelligence; cybersecurity; IMS core networks; KPI monitoring
Summary/Abstract: In modern IP Multimedia Subsystem (IMS) core networks, the detection and prevention of cybersecurity threats remain a critical challenge due to the dynamic nature of signaling traffic and the increasing complexity of infrastructure. This paper proposes an AI-assisted anomaly detection approach based on statistical modeling of key performance indicators (KPIs) collected from real-world telecom networks over a one-month period. The analysis targets multiple IMS elements across two major network regions, focusing on Call Setup Success Rate and Total Traffic (Erlang). A contextual z-score model was implemented in MATLAB to monitor these KPIs per hour, enabling the identification of time-based deviations without relying on static thresholds. An alert logic was added to mark days with excessive anomaly rates (>5%) as potentially suspicious. A major traffic spike detected on March 1st is analyzed as a case study, suggesting a possible signaling flood or operational event. The results demonstrate the feasibility of unsupervised anomaly detection in IMS environments, providing early warning signals for cybersecurity-related incidents. This KPI-driven methodology can be extended with advanced AI models for predictive alerting and integration with network management systems.

• Details
• Contents