Signalling protocols are responsible for fundamental tasks such as initiating and terminating communication and identifying the state of the communication in telecommunication core networks. Signalling System No. 7 (SS7), Diameter, and GPRS Tunneling Protocol (GTP) are the main protocols used in 2G to 4G, while 5G uses standard Internet protocols for its signalling. Despite their distinct features, and especially their security guarantees, they are most vulnerable to attacks in roaming scenarios: the attacks that target the location update function call for subscribers who are located in a visiting network. The literature tells us that rule-based detection mechanisms are ineffective against such attacks, while the hope lies in deep learning (DL)-based solutions. In this paper, we provide a large-scale empirical study of state-of-the-art DL models, including eight supervised and five semi-supervised, to detect attacks in the roaming scenario. Our experiments use a real-world dataset and a simulated dataset for SS7, and they can be straightforwardly carried out for other signalling protocols upon the availability of corresponding datasets. The results show that semi-supervised DL models generally outperform supervised ones since they leverage both labeled and unlabeled data for training. Nevertheless, the ensemble-based supervised model NODE outperforms others in its category and some in the semi-supervised category. Among all, the semi-supervised model PReNet performs the best regarding the Recall and F1 metrics when all unlabeled data are used for training, and it is also the most stable one. Our experiment also shows that the performances of different semi-supervised models could differ a lot regarding the size of used unlabeled data in training.

The translation of artificial intelligence into clinical practice depends, in large part, on access to data that patients are understandably reluctant to surrender. Federated learning promises to resolve this tension by training models without centralising raw records, yet virtually all deployed systems assume that each participating site holds hundreds or thousands of samples — a condition that hospitals and research consortia may satisfy, but individual patients never will. Here, we show that a fundamentally different regime is both theoretically tractable and practically viable: one in which each participant contributes a single diagnostic record, retains it entirely on their own device, and never communicates with any other participant. We introduce PrivateBoost, a federated gradient boosting framework in which clients distribute Shamir secret shares to a small set of independent shareholders, enabling an aggregator to reconstruct only the aggregate statistics required for tree construction while remaining information-theoretically blind to individual contributions. Crucially, this approach exploits a deep compatibility between gradient boosting and secret sharing: model training depends only on additive aggregates, which align naturally with secure summation, eliminating the need for coordination while maintaining efficiency. A path-hiding extension further prevents shareholders from inferring any patient’s traversal of the decision tree, eliminating a side channel that standard protocols leave exposed. Evaluated across four medical datasets encompassing up to 70,692 single-sample clients, PrivateBoost matches centralised XGBoost with identical AUC-ROC (0.818), tolerates up to 80% client dropout per round, and requires fewer than 600 KB of communication per patient over a complete training run — comfortably within the constraints of a mobile device on a standard data plan. These results establish that privacy-preserving collective learning from patient-owned records is not merely a theoretical aspiration but an achievable engineering reality, opening a path towards medical AI that improves with every consenting patient without requiring any of them to share their data.