1

Mining call data to increase the robustnessof cellular networksto DoS attacks

Hui Zang and Jean BolotSprint

http://research.sprintlabs.com/

3

Better Security via Robust Paging Using Mobility Data

Hui Zang and Jean BolotSprint

http://research.sprintlabs.com/

5

Cellular networks are at risk

(650)123-7777 70.2.35.5

Paging channel

6

Threats identified

•SMS DoS attacks >Mobicom 06 (Penn State)

•Battery attacks via paging>SecureComm 2006 (UC Davis)

•Signaling DoS via data paging>Mobicom WiSe workshop 06 (Sprint)

7

Increase the robustness of the paging channel

• Increase paging channel capacity

• Reduce/block unwanted traffic

• Decrease paging channel utilization>Efficient paging schemes

8

Contributions

•Data-driven approach

•Large-scale cellular mobility data

•Efficient paging algorithms>Reduce paging utilization by 80%>Increase delay by 10%

9

Per Call Measurement Data (PCMD)

•Collected by each switch

•Record of every call>Call type (voice, data, SMS)>Start/end cell, sector>Source/destination

•Three month-long traces – Feb 2006

10

Trace statistics

Switch Nb.records Nb.cells Nb. users

Manhattan 120 M 139 1061 K

Philadelphia 140 M 150 543 K

Brisbane 50 M 144 404 K

Total 310 M 433 2 M

Size of data: 65GB

11

Mobility

96% users visit < 40 cells in a month

12

Calling activity

60% users make < 26 calls in a month

13

Joint calling and mobility

4% most mobile make 35% of calls

14

Mobility patterns over time

•Correlation between day X and Y>Mutual information I(X,Y) = H(X) + H(Y) – H(X,Y)

•Normalized by entropy of the data from a reference day

NMI(X,Y) = I(X,Y)/H(X)

15

Correlation between two days

Weekday traces are highly correlated

NMI(current day, n days ago)

2/28 – Tuesday, 2/26 – Sunday

16

How much history is needed

14 days of data is usually enough

NMI(current day, past n days)

17

Recap - what we found so far…

•96% users in < 40 cells•60% users make < 26 calls •4% most mobile users make 35% of calls•Locations are correlated across days•Higher correlation between weekday data•14 days of data is sufficient

•Use this to design better paging schemes

18

Paging – Locate the mobile

MobileSwitchingCenter

(650)123-4567

(650)123-4567

(650)123-4567

I am here

(650)123-4567 is in my cell

19

Paging – establish the channel

MobileSwitchingCenter

Channel assignme

nt

Channel

assignme

nt

20

Broadcast vs. profile-based paging

MobileSwitchingCenter

One paging/location area

Incoming call

21

Broadcast vs. Profile-based paging

MobileSwitchingCenter

Broadcast

22

Broadcast vs. Profile-based paging

MobileSwitchingCenter

Profile-based

1st step

Incoming call

23

Broadcast vs. Profile-based paging

MobileSwitchingCenter

2nd step(broadcast)

Profile-based

No replyback

24

Profile-based paging

•Fixed profile - update profile periodically+: low management cost-: up-to-date mobility data cannot be utilized

•Dynamic profile - update with every call +: more accurate predication -: high management cost

25

Performance Metrics

•Cost: number of cells paged per call

•Paging delay: call arrival until mobile responds

•Success rate of the 1st step - paging selected cells

26

Fixed-profile updated biweekly

27

Dynamic ProfileHigh success rate for data calls

28

Dynamic Profile – cost vs delay

29

Smart paging

•Dynamic profile-based >14 days of history data

•Voice/SMS: >most recently visited N cells>top X fraction of most popular cells

•Data:>most recently visited N cells

30

Success rate

Fixed profile

Dynamic profile

Smart paging N=10X=0.95

Brisbane 2/28

0.87 0.96 0.94

Manhattan 2/26

0.81 0.91 0.90

31

Cost and delay tradeoff

32

Conclusions

•Use large-scale mobility data>mobility and activity>patterns over time

•To increase paging efficiency>optimized profile-based

•And increase robustness>decrease utilization>limit cost of data pages

•Next: nationwide, data

34

http://research.sprintlabs.com/