We present IDAMN (intrusion detection architecture for mobile networks), a distributed system whose main functionality is to track and detect mobile intruders in real time. IDAMN includes two algorithms which model the behavior of users in terms of both telephony activity and migration pattern. The main novelty of our architecture is its ability to perform intrusion detection in the visited location and within the duration of a typical call, as opposed to existing designs that require the reporting of all call data to the home location in order to perform the actual detection. The algorithms and the components of IDAMN have been designed in order to minimize the overhead incurred in the fixed part of the cellular network.

User mobilityis a feature that raises many new security-related issues and concerns.One of them is the disclosure of a mobile user's reai identity during the authentication process, or other procedures specific to mobile networks.Such disclosure allows an unauthorized third-party to track the m.obile user's movements and current whereabouts.Depending ou the context, access to auy information related to a mobile user's location without his consent can be a serious violation of his privacy.This new issue might be seen as a conflicting requirement with respect to authentication: untraceability requires hiding the user's identity while authentication requires the user's identity to be revealed in order to be proved.What is needed is a single mechanism reconciling both authentication and privacy of a mobile user's identification.The basic :solution to this problem is the use of uliases.Aliases insure untraceability by hiding the user's real identity as well as his relationship with domain authorities.In this paper, we present a classification scheme to identify the various degrees of untraceability requirements.We then present an efficient method for the computation of aliases and apply It to a new set of inter-domain authentication protocols.We demonstrate that these protocols can be designed to meet various degrees of untraceability requirements.In designing these protocols, we try to avoid the drawbacks of authentication protoc:ols in existing mobile network architectures such as CDPD and GSM.