Measures for detecting unusual communication session events in a telecommunications network. A Markov model for events occurring in communication sessions conducted in the network is maintained. The maintaining includes assigning a probability of occurrence metric to a plurality of event sequences in the conducted communication sessions. In response to a given sequence of communication session events being assigned a probability of occurrence metric which exceeds a predetermined threshold, an unusual communication session event alert in association with the given sequence is triggered.