at least one processor;

at least one memory including computer program code;

the at least one memory and the computer program code being configured to, with the at least one processor, cause the apparatus at least to:

obtain one or more service requests previously received by a network entity for a service which the network entity is configured to provide in a communication network, the service comprising an analytic model;

obtain an analysis of the one or more service requests previously received by the network entity for the service;

obtain an expected service usage for the service from the analysis of the one or more service requests; and

identify, based at least in part on the expected service usage, whether a distribution of service requests received by the network entity for the service comprises an abnormal service usage;

wherein the distribution of service requests is identified as abnormal service usage based at least in part on determining whether inputs of the service requests received by the network entity are associated with outputs of the analytics model that identify at least one of (i) a model architecture of the analytic model and (ii) training data utilized to train the analytic model.