An electronic device configured to perform a radio access network function, the electronic device comprising: a communication interface comprising communication circuitry; a processor operatively connected with the communication interface; and a memory operatively connected with the processor, wherein the memory stores instructions which, when executed, cause the processor to: receive, via the communication interface, wireless communication data transmitted via a radio access network, process the received wireless communication data based on a radio access network protocol by at least one first virtualized module (541, 542, 543) of the electronic device corresponding to at least one function of the radio access network, identify a wireless communication data abnormal sign based on the received wireless communication data or a result of processing of the wireless communication data by the at least one first virtualized module (541, 542, 543), transfer security information indicating the wireless communication data abnormal sign to a second virtualized module of the electronic device by the at least one first virtualized module (541, 542, 543), and determine a security threat on the radio access network based on the security information indicating the wireless communication data abnormal sign by identifying payload information for the wireless communication data determined to have the wireless communication data abnormal sign by the second virtualized module. a communication interface comprising communication circuitry; a processor operatively connected with the communication interface; and a memory operatively connected with the processor, wherein the memory stores instructions which, when executed, cause the processor to: receive, via the communication interface, wireless communication data transmitted via a radio access network, process the received wireless communication data based on a radio access network protocol by at least one first virtualized module (541, 542, 543) of the electronic device corresponding to at least one function of the radio access network, identify a wireless communication data abnormal sign based on the received wireless communication data or a result of processing of the wireless communication data by the at least one first virtualized module (541, 542, 543), transfer security information indicating the wireless communication data abnormal sign to a second virtualized module of the electronic device by the at least one first virtualized module (541, 542, 543), and determine a security threat on the radio access network based on the security information indicating the wireless communication data abnormal sign by identifying payload information for the wireless communication data determined to have the wireless communication data abnormal sign by the second virtualized module. receive, via the communication interface, wireless communication data transmitted via a radio access network, process the received wireless communication data based on a radio access network protocol by at least one first virtualized module (541, 542, 543) of the electronic device corresponding to at least one function of the radio access network, identify a wireless communication data abnormal sign based on the received wireless communication data or a result of processing of the wireless communication data by the at least one first virtualized module (541, 542, 543), transfer security information indicating the wireless communication data abnormal sign to a second virtualized module of the electronic device by the at least one first virtualized module (541, 542, 543), and determine a security threat on the radio access network based on the security information indicating the wireless communication data abnormal sign by identifying payload information for the wireless communication data determined to have the wireless communication data abnormal sign by the second virtualized module.