A method of detecting an unauthorised communication from a network node in a telecommunication network, comprising the steps of: generating a first statistical pattern inherent to a sequence of network messages, from a plurality of identifier values associated with a legitimate network node, wherein each identifier value has been encoded by the legitimate network node in a respective network message and the first statistical pattern comprises an invariant based on a subset of a bitmask in the plurality of identifier values associated with the sequence of network messages; comparing an identifier value encoded in a subsequent network message of a signalling network node with the first statistical pattern; and when the comparison against the first pattern outputs a mismatch, declaring communication from the signalling network node as unauthorised; and generating a second statistical pattern inherent to the sequence of network messages by: translating each of the plurality of identifier values into a respective bit string si; sampling the translated bit strings si 1-N; identifying a field of n non-fixed bits in the sequence of samples; converting the identified n non-fixed bits to a decimal integer di; and calculating transition counts between successive decimal values di 1-N in the sequence of samples to form the second statistical pattern; and comparing the identifier value encoded in the subsequent network message with the second statistical pattern; and when the comparison against the first and second pattern outputs a mismatch, declaring the signalling network node as unauthorised; and wherein the second statistical pattern is a state-transition probability matrix Mopt of the sequence of decimal values. generating a first statistical pattern inherent to a sequence of network messages, from a plurality of identifier values associated with a legitimate network node, wherein each identifier value has been encoded by the legitimate network node in a respective network message and the first statistical pattern comprises an invariant based on a subset of a bitmask in the plurality of identifier values associated with the sequence of network messages; comparing an identifier value encoded in a subsequent network message of a signalling network node with the first statistical pattern; and when the comparison against the first pattern outputs a mismatch, declaring communication from the signalling network node as unauthorised; and generating a second statistical pattern inherent to the sequence of network messages by: translating each of the plurality of identifier values into a respective bit string si; sampling the translated bit strings si 1-N; identifying a field of n non-fixed bits in the sequence of samples; converting the identified n non-fixed bits to a decimal integer di; and calculating transition counts between successive decimal values di 1-N in the sequence of samples to form the second statistical pattern; and comparing the identifier value encoded in the subsequent network message with the second statistical pattern; and when the comparison against the first and second pattern outputs a mismatch, declaring the signalling network node as unauthorised; and wherein the second statistical pattern is a state-transition probability matrix Mopt of the sequence of decimal values. translating each of the plurality of identifier values into a respective bit string si; sampling the translated bit strings si 1-N; identifying a field of n non-fixed bits in the sequence of samples; converting the identified n non-fixed bits to a decimal integer di; and calculating transition counts between successive decimal values di 1-N in the sequence of samples to form the second statistical pattern; and comparing the identifier value encoded in the subsequent network message with the second statistical pattern; and when the comparison against the first and second pattern outputs a mismatch, declaring the signalling network node as unauthorised; and wherein the second statistical pattern is a state-transition probability matrix Mopt of the sequence of decimal values.