Examples are disclosed for methods and mechanisms to address Base Transceiver Stations (BTSes) attempting to hijack Mobile Stations (MSes) in wireless communication networks. In some example methods, a record having values for a set of features associated with an MS and a BTS of a wireless communication net may be processed. A score for the record may be calculated, for example based on a machine-learning model pertaining to the set of features, and a determination may be made as to whether the record demonstrates an anomalous condition based upon the score. The set of features may include at least one feature based on a measured power of the BTS.