Method and network node for detecting abnormal access behavior

Embodiments of the present disclosure provide a method, a network node and a computer program product for detecting abnormal access behavior in a plurality of network nodes in a communication network (100). The method is performed in a network node (10) in a communication network. The method comprises obtaining (S11) session logs associated with a plurality of network nodes (10a-10n) in the communication network (100). The method comprises extracting (S12) session features for each session by evaluating session logs associated with a plurality of network nodes (10a-10n). Furthermore, the method comprises determining (S13) an access behavior associated with each session based on the extracted session characteristics, the access behavior associated with each session comprising a representation indicative of one or more of a session characteristic, a user access characteristic, a network node access characteristic and a command usage characteristic. The method further comprises detecting (S14) an abnormal access