Patent ID: 8918876

Claim:
A method for determining deviating behaviour of a user terminal being performed in at least one network node of a communication network and comprising the steps of: obtaining a first group of event data sets including at least one event data set, where each event data set in this first group includes user terminal generated event data related to events in a specific user terminal, obtaining a second group of event data sets including at least one event data set, where each event data set in this second group includes network generated event data related to said specific user terminal, storing each event data set in an event data base, wherein each event data set comprises a plurality of characteristics relating to a specific communication session, performing a comparison involving the first group of event data sets and the second group of event data sets, determining the existence of deviating behaviour of said specific user terminal based on the comparison, wherein one of the event data sets in the second group of event data sets indicates a specific communication session from said specific user terminal for which there is no corresponding event data in the first group of event data sets, determining a service for said specific user terminal that is linked to said deviating behavior, and performing a change influencing action for obtaining a change in activities that involve both said specific user terminal and said service, wherein the plurality of characteristics relating to a specific communication session includes data identifying a service associated with the event, communication session identifying data associated with the event and including at least one communication identifier identifying the user terminal, at least one communication session bearer identifier and time data related to the communication session.