Mining call data to increase the robustness of cellular networks to DoS attacks

Hui Zang and Jean Bolot Sprint

http://research.sprintlabs.com/
0

Better Security via Robust Paging Using Mobility Data

Hui Zang and Jean Bolot Sprint

http://research.sprintlabs.com/
2

Cellular networks are at risk

(650)123-7777

70.2.35.5

Paging channel
4

Threats identified
SMS DoS attacks

>Mobicom 06 (Penn State)

Battery attacks via paging

>SecureComm 2006 (UC Davis)

Signaling DoS via data paging

>Mobicom WiSe workshop 06 (Sprint)

Increase the robustness of the paging channel

Increase paging channel capacity
Reduce/block unwanted traffic Decrease paging channel utilization >Efficient paging schemes

Contributions
Data-driven approach Large-scale cellular mobility data Efficient paging algorithms >Reduce paging utilization by 80% >Increase delay by 10%

Per Call Measurement Data (PCMD)

Collected by each switch Record of every call >Call type (voice, data, SMS) >Start/end cell, sector >Source/destination Three month-long traces Feb 2006

Trace statistics
Switch Nb.records Nb.cells Nb. users

Manhattan
Philadelphia Brisbane Total

120 M
140 M 50 M 310 M

139
150 144 433

1061 K
543 K 404 K 2M

Size of data: 65GB

Mobility

96% users visit < 40 cells in a month

10

Calling activity

60% users make < 26 calls in a month

11

Joint calling and mobility

4% most mobile make 35% of calls

12

Mobility patterns over time

Correlation between day X and Y >Mutual information I(X,Y) = H(X) + H(Y) H(X,Y) Normalized by entropy of the data from a reference day NMI(X,Y) = I(X,Y)/H(X)

13

Correlation between two days

NMI(current day, n days ago)

2/28 Tuesday, 2/26 Sunday Weekday traces are highly correlated

14

How much history is needed

NMI(current day, past n days)

14 days of data is usually enough

15

Recap - what we found so far

96% users in < 40 cells 60% users make < 26 calls 4% most mobile users make 35% of calls Locations are correlated across days Higher correlation between weekday data 14 days of data is sufficient

Use this to design better paging schemes

16

Paging Locate the mobile

Mobile Switching Center

(650)123-4567 is in my cell

I am here
17

Paging establish the channel

Mobile Switching Center

18

Broadcast vs. profile-based paging

Incoming call
Mobile Switching Center

One paging/location area

19

Broadcast vs. Profile-based paging

Mobile Switching Center

Broadcast
20

Broadcast vs. Profile-based paging

Incoming call
Mobile Switching Center

1st step

Profile-based
21

Broadcast vs. Profile-based paging

No reply back
Mobile Switching Center

2nd step (broadcast)

Profile-based
22

Profile-based paging
Fixed profile - update profile periodically +: low management cost -: up-to-date mobility data cannot be utilized Dynamic profile - update with every call +: more accurate predication -: high management cost

23

Performance Metrics
Cost: number of cells paged per call
Paging delay: call arrival until mobile responds Success rate of the 1st step - paging selected cells

24

Fixed-profile updated biweekly

25

Dynamic Profile

High success rate for data calls

26

Dynamic Profile cost vs delay

27

Smart paging
Dynamic profile-based >14 days of history data
Voice/SMS: >most recently visited N cells >top X fraction of most popular cells

Data: >most recently visited N cells

28

Success rate
Fixed profile Brisbane 2/28 0.87 Dynamic profile 0.96 Smart paging N=10 X=0.95 0.94

Manhattan 2/26

0.81

0.91

0.90

29

Cost and delay tradeoff

30

Conclusions
Use large-scale mobility data
>mobility and activity >patterns over time

To increase paging efficiency

>optimized profile-based

And increase robustness

>decrease utilization >limit cost of data pages

Next: nationwide, data

31

http://research.sprintlabs.com/

33