A method performed by a a network element (160, 310, 450, 460, 1216, 1316, 1416, 1516, 1616, 1710) for monitoring user plane traffic for a user equipment (410, 1900), the method comprising: configuring (714, 814, 914) a set of characteristics and a range of values for each of the set of characteristics for user plane traffic between the user equipment and the network element; monitoring user plane traffic for the user equipment at the network element, the monitoring determining whether at least one characteristic of the user plane traffic falls outside of the configured range of values (716, 816, 916), resulting in a characteristic violation; and if the at least one characteristic of the user plane traffic falls outside the configured range of values (716, 816, 916), performing an action (718, 818) resulting from the characteristic violation; wherein the action comprises at least one of: triggering a secure message (1122, 1124, 1126) to the user equipment containing information associated with the characteristic violation; performing a connection re-establishment by performing DETACH (1534, 1540) procedure on the user equipment and further by performing an ATTACH procedure from the user equipment; triggering an authentication procedure (1430, 1432, 1440, 1442, 1444) for the user equipment; and if the user plane traffic is transmitted without at least one of integrity and encryption protection, the action comprises turning on (1634, 1640) at least one of encryption or integrity protection. configuring (714, 814, 914) a set of characteristics and a range of values for each of the set of characteristics for user plane traffic between the user equipment and the network element; monitoring user plane traffic for the user equipment at the network element, the monitoring determining whether at least one characteristic of the user plane traffic falls outside of the configured range of values (716, 816, 916), resulting in a characteristic violation; and if the at least one characteristic of the user plane traffic falls outside the configured range of values (716, 816, 916), performing an action (718, 818) resulting from the characteristic violation; wherein the action comprises at least one of: triggering a secure message (1122, 1124, 1126) to the user equipment containing information associated with the characteristic violation; performing a connection re-establishment by performing DETACH (1534, 1540) procedure on the user equipment and further by performing an ATTACH procedure from the user equipment; triggering an authentication procedure (1430, 1432, 1440, 1442, 1444) for the user equipment; and if the user plane traffic is transmitted without at least one of integrity and encryption protection, the action comprises turning on (1634, 1640) at least one of encryption or integrity protection. triggering a secure message (1122, 1124, 1126) to the user equipment containing information associated with the characteristic violation; performing a connection re-establishment by performing DETACH (1534, 1540) procedure on the user equipment and further by performing an ATTACH procedure from the user equipment; triggering an authentication procedure (1430, 1432, 1440, 1442, 1444) for the user equipment; and if the user plane traffic is transmitted without at least one of integrity and encryption protection, the action comprises turning on (1634, 1640) at least one of encryption or integrity protection.