Deviating Behaviour of a User Terminal

A device in a network node of a communication network for determining deviating behaviour of a user terminal and comprising:

• at least one communication interface for communicating with other devices related to the communication network, and
• a deviating behaviour determining unit configured to:
• obtain a first group of event data sets including at least one event data set and where each event data set in this first group includes user terminal generated event data related to events in a specific user terminal,
• obtain a second group of event data sets including at least one event data set and where each event data set in this second group includes network generated event data related to said specific user terminal,
• perform a comparison involving the first group of event data sets and the second group of event data sets, and
• determine the existence of deviating behaviour of said specific user terminal based on the comparison.

A computer program product comprising a computer program for determining deviating behaviour of a user terminal in a communication network and a computer readable medium on which the computer program is stored, the computer program comprising computer program code which when run on a device causes said device to:

• obtain a first group of event data sets including at least one event data set and where each event data set in this first group includes user terminal generated event data related to events in a specific user terminal,
• obtain a second group of event data sets including at least one event data set and where each event data set in this second group includes network generated event data related to said specific user terminal,
• perform a comparison involving the first group of event data sets and the second group of event data sets, and
• determine the existence of deviating behaviour of said specific user terminal based on the comparison.