Nowadays, the 3G network plays a very important role in mobile communication system. But the security concern of such network, especially the core network, is far from being satisfied. With the continuously development in the security enhancement in RAN, core network would become the future target of attackers. GPRS Tunnel Protocol (GTP), which is one of the key protocols in the core network, is quite vulnerable to attacks in the flat, full IP environment. Therefore solving such problem properly is very urgent and important for the operation of 3G network. In this paper, the security challenges in the 3G core network and the security issues in GTP are discussed, a defense solution for these security threats and an event-based description language are proposed. The experiment result shows the potential of our solution.