Despite their widespread adoption, cellular networks face growing vulnerabilities due to their inherent complexity and the integration of advanced technologies.One of the major threats in this landscape is Voice over IP (VoIP) to GSM gateways, known as SIMBox devices.These devices use multiple SIM cards to route VoIP traffic through cellular networks, enabling international bypass fraud with losses of up to $3.11 billion annually.Beyond financial impact, SIMBox activity degrades network performance, threatens national security, and facilitates eavesdropping on communications.Existing detection methods for SIMBox activity are hindered by evolving fraud techniques and implementation complexities, limiting their practical adoption in operator networks.This paper addresses the limitations of current detection methods by introducing SigN , a novel approach to identifying SIMBox activity at the cellular edge.The proposed method focuses on detecting remote SIM card association, a technique used by SIMBox appliances to mimic human mobility patterns.The method detects latency anomalies between SIMBox and standard devices by analyzing cellular signaling during network attachment.Extensive indoor and outdoor experiments demonstrate that SIMBox devices generate significantly higher attachment latencies, particularly during the authentication phase, where latency is up to 23 times greater than that of standard devices.We attribute part of this overhead to immutable factors such as LTE authentication standards and Internet-based communication protocols.Therefore, our approach offers a robust, scalable, and practical solution to mitigate SIMBox activity risks at the network edge.

Mobility is a fundamental aspect of human life, and mobility data offers valuable insights into user behavior. Yet, this data also exposes users to privacy risks given pattern unicity in their trajectories, i.e., the singularity in the displacements made by users. Existing strategies to quantify such user exposure either focus only on the sequences of places visited by each user, as the widely used uniqueness measure, or are tied to specific attack models. We here introduce MoBES, a novel, scalable, customizable and highly interpretable measure of user exposure in mobility data. MoBES leverages multiple existing metrics to build a multi-dimensional space, which in turn is used to capture each user's mobility signature behavior. MoBES quantifies user exposure based on how distinct a user's signature is from her neighbors in the defined metric space. As such, MoBES is designed to be a fundamental expression of user behavior, and not tied to any specific attack model. We evaluate MoBES on a real mobility dataset, showing that it effectively captures user exposure within the behavioral metric space. We also compare MoBES with the uniqueness measure, showing that MoBES is able to uncover users who, even though visiting the same places as others in the crowd, are still at risk of exposure due to the unicity of their mobility behavior.

Motion sensors in mobile devices enable device fingerprinting through hardware-induced variations in sensed data. Although the feasibility of this identification technique has been demonstrated across numerous studies, the literature remains fragmented in terms of experimental setups and evaluation metrics—hindering a comprehensive understanding of its effectiveness and limitations. In this work, we provide the first systematization of the motion sensor fingerprinting landscape, structuring the pipeline into distinct stages and identifying key design parameters and countermeasures. Building on this, we develop a unified evaluation framework to assess each parameter in isolation under realistic conditions. Our results show that motion-based fingerprinting remains effective across diverse settings and classifier architectures, yet current countermeasures fail to provide reliable protection and often degrade data utility. We release our dataset to foster reproducibility and future work in this underexplored yet persistent privacy threat.

Understanding mobile-user behavior requires joint modeling of mobility and traffic, as data consumption is shaped by where, when, and how users travel. Despite this clear intuition, most studies still treat the two in isolation, missing the intricate dependencies between them at the individual level. This paper propose a novel approach that explicitly captures the interplay between traffic and mobility behaviors using fine-grained mobile datasets. Using week-long eXtended Data Records (XDRs), we identify 13 interpretable features and pinpoint the mobility traits that truly drive traffic variation. These insights support a privacy-preserving user abstraction that represents each timeline as a sequence of discrete mobility–traffic states, capturing temporal dynamics and heterogeneity while generalizing across regions. We then introduce a probabilistic likelihood model that scores any mobility–traffic pairing, enabling cross-modality prediction and statistically sound fusion of fragmented logs. Experiments on four provincial datasets covering 1.3 million Chilean users show that the model reliably separates plausible from implausible behavior and generalizes from dense urban cores to mixed rural–urban contexts. The framework is descriptive, generative, and transferable, paving the way for anomaly detection, personalized QoE adaptation, and realistic network simulation.

International bypass fraud, also known as SIMBox fraud, involves diverting international cellular voice traffic from regulated routes and rerouting it as local calls in the destination country. It has significantly affected cellular networks worldwide, generating $3.11 Billion of losses annually and threats to national security. Yet, SIMBox fraud remains an ongoing challenge, eluding operators detection due to the continual refinement of fraudulent behavior that is often overlooked in the design and validation of detection methods.

Domain-wide recognized by their high value in human activity and network monitoring studies, cellular network traffic (i.e., Charging Data Records, named CDRs), however, present accessibility and usability issues, restricting their exploitation and research reproducibility. This paper tackles such challenges by modeling CDRs that fulfill real-world data attributes. Our designed framework, named Zen leverages LSTM to realistically model network users’ traffic behavior through a 4-stage generative pipeline. Results show that Zen’s models accurately capture individual and global distributions of a fully anonymized real-world traffic CDRs dataset. Finally, we validate Zen CDRs ability of reproducing daily cellular behaviors of the urban population and its usefulness in practical networking applications such as Radio Access Network’s power savings, and anomaly detection as compared to real-world CDRs.

Cloud applications based on the "Functions as a Service" (FaaS) paradigm have become very popular. Yet, due to their stateless nature, they must frequently interact with an external data store, which limits their performance. To mitigate this issue, we introduce OFC, a transparent, vertically and horizontally elastic in-memory caching system for FaaS platforms, distributed over the worker nodes. OFC provides these benefits cost-effectively by exploiting two common sources of resource waste: (i) most cloud tenants overprovision the memory resources reserved for their functions because their footprint is non-trivially input-dependent and (ii) FaaS providers keep function sandboxes alive for several minutes to avoid cold starts. Using machine learning models adjusted for typical function input data categories (e.g., multimedia formats), OFC estimates the actual memory resources required by each function invocation and hoards the remaining capacity to feed the cache. We build our OFC prototype based on enhancements to the OpenWhisk FaaS platform, the Swift persistent object store, and the RAM-Cloud in-memory store. Using a diverse set of workloads, we show that OFC improves by up to 82 % and 60 % respectively the execution time of single-stage and pipelined functions.