FlagThis

Abstract

Mobile core networks rely on several signalling protocols in parallel, such as SS7, Diameter, and GTP, hence many security-relevant problems only become visible when their interactions are analyzed jointly. Moreover, labeled examples of real attacks and cross-protocol misconfigurations are scarce, which complicates the deployment of supervised detection methods. Motivated by these constraints, we study unsupervised cross-protocol anomaly analysis on fused representations that combine SS7, Diameter, and GTP signalling. We first combine SS7, Diameter, and GTP messages for each subscriber into perminute fused records. We then serialize each fused record as text, obtain vector representations from several embedding models, and finally apply unsupervised anomaly detection. A consensus score is then assigned to each record as the number of embedding models that flag it as anomalous. For evaluation, we construct cross-protocol-plausible synthetic anomalies by swapping one chosen field group at a time between pairs of records, so that each signalling message remains valid in isolation while the fused cross-protocol view becomes contradictory. From our experiments, we observe that the fraction of flagged records decreases sharply as the required level of model agreement increases. On a corpus of 219,294 fused records, 44.15% are flagged by at least one model, yet only 0.97% reach full agreement of all six models. Across consensus levels, we find that high agreement is tightly coupled to the synthetic records that encode cross-protocol inconsistencies. For k = 1 – 4, the odds that a flagged record is synthetic are hundreds of times larger than for original records, and for k ≥ 5 all flagged records are synthetic, with extremely small p-values indicating statistical significance. To further analyze how the models structure their decisions, we measure cosine distances in embedding space between synthetic and original records. We observe that these distances increase with the consensus level, suggesting that records on which the models agree more strongly tend to be more clearly separated from original traffic in embedding space. Taken together, these results support the use of multi-embedding models consensus to enable prioritization of a much smaller candidate set of crossprotocol inconsistencies for further inspection.