We tackle the problem of estimating the spatial distribution of mobile phones from Mobile Network Operator (MNO) data, namely Call Detail Record (CDR) or signalling data. The process of transforming MNO data to a density map requires geolocating radio cells to determine their spatial footprint. Traditional geolocation solutions rely on Voronoi tes sellations and approximate cell footprints by mutually disjoint regions. Recently, some pioneering work started to consider more elaborate geolocation methods with partially overlapping (non- disjoint) cell footprints coupled with a probabilistic model for phone-to-cell association. Estimating the spatial density in such a probabilistic setup is currently an open research problem and is the focus of the present work. We start by reviewing three different estimation methods proposed in literature and provide novel analytical insights that unveil some key aspects of their mutual relationships and properties. Furthermore, we develop a novel estimation approach for which a closed-form solution can be given. Numerical results based on semi-synthetic data are presented to assess the relative accuracy of each method. Our results indicate that the estimators based on overlapping cells have the potential to improve spatial accuracy over traditional approaches based on Voronoi tessellations.

The concept of present population is gaining increasing attention in official statistics. One possible approach to measure present population exploits data collected by Mobile Network Operators (MNO), from simple Call Detail Records (CDR) to more informative and complex signalling records. Such data, collected primarily for network operation processes, can be repurposed to infer patterns of human mobility. Two decades of research literature have produced several case studies, mostly focused on to CDR data, and a variety of ad-hoc methodologies tailored to specific datasets. Moving beyond the stage of explorative research, the regular production of official statistics across different MNO requires a more systematic approach to methodological development. Towards this aim, Eurostat and other members of the European Statistical System are working towards the definition of a general Reference Methodological Framework for processing MNO data for official statistics. In this contribution we report on the methodological aspects related to the estimation of present population density, for which we present a general and modular methodological structure that generalises previous proposals found in the academic literature. Along the way, we define a number of specific research problems requiring further attention by the research community. We stress the importance of comparing different methodological options at various points in the data workflow, e.g. in the geolocation of individual observations and in the inference method. Finally, we present illustrative results from a case-study based on real signalling data from a European operational network, complemented by numerical results from a simple simulation scenario.

In recent years we are experiencing an important growth of interest for sensing the electromagnetic spectrum and making its access more agile. Emerging initiatives use low-cost receivers in large deployments for sensing the radio spectrum or collecting air-traffic signals at large scale. One of the major drawbacks of low-cost spectrum receivers is their limited sampling rate, which does not allow to decode wideband signals. In order to circumvent the hardware limitations of single receivers, we envision a scenario where non-coherent receivers sample the signal collaboratively to cover a larger bandwidth than the one of the single receiver and then, enable the signal reconstruction and decoding in the backend. We present a methodology to enable the signal reconstruction in the backend by multiplexing in frequency a certain number of noncoherent receivers in order to cover a signal bandwidth that would not otherwise be possible using a single receiver. We propose a method that does not use the knowledge of the modulation scheme, and has been designed to be transparent to the subsequent decoding process. As such, it is equivalent to the reception of the signal by a high-end receiver. We demonstrate and evaluate our approach with two non-coherent receivers which collaboratively sample an aviation signal of almost twice the bandwidth of each receiver. The experimental results show that, using two non-coherent receivers, our method is able to reconstruct and decode correctly more than 80% of data.

Precise Time-of-Arrival (TOA) estimations of aircraft and drone signals are important for a wide set of applications including aircraft/drone tracking, air traffic data verification, or self-localization. Our focus in this work is on TOA estimation methods that can run on low-cost software-defined radio (SDR) receivers, as widely deployed in Mode S / ADS-B crowdsourced sensor networks such as the OpenSky Network. We evaluate experimentally classical TOA estimation methods which are based on a cross-correlation with a reconstructed message template and find that these methods are not optimal for such signals. We propose two alternative methods that provide superior results for real-world Mode S / ADS-B signals captured with low-cost SDR receivers. The best method achieves a standard deviation error of 1.5 ns.

We tackle the problem of identifying the trajectory of a moving radio source from Time of Arrival (TOA) measurements collected by a set of cooperating receivers. The considered system is completely asynchronous: nodes clocks are affected by unknown time and frequency offsets, and no control is exerted over packet transmission times. In the proposed solution, the receiver clock offset terms are estimated from TOA measurements on packets originated by non-cooperative reference transmitters, possibly but not necessarily coincidental with reference receivers. Transmission time ambiguity is resolved by exploiting the redundancy associated to the reception of the same packet at multiple receivers. A distinguishing feature of the proposed solution is that it seeks to identify the parameters of the trajectory as a whole, rather than the individual points of transmission as done in traditional point-based approaches. This allows the effective exploitation of TOA measurements collected in lossy scenarios, where the generic packet is received by a smaller subset of the available receivers (at least two). For the problem at hand, we provide distinct estimators based on TOA and Time-Difference of Arrival (TDOA) and prove their equivalence. Numerical results from simulations and from a real WiFi testbed are provided to validate the effectiveness of the proposed method.

Multilateration techniques have been proposed to verify the integrity of unprotected location claims in wireless localization systems. A common assumption is that the adversary is equipped with only a single device from which it transmits location spoofing signals. In this paper, we consider a more advanced model where the attacker is equipped with multiple devices and performs a geographically distributed coordinated attack on the multilateration system. The feasibility of a distributed multi-device attack is demonstrated experimentally with a self-developed attack implementation based on multiple COTS software-defined radio (SDR) devices. We launch an attack against the OpenSky Network, an air traffic surveillance system that implements a time-difference-of-arrival (TDoA) multi-lateration method for aircraft localization based on ADS-B signals. Our experiments show that the timing errors for distributed spoofed signals are indistinguishable from the multilateration errors of legitimate aircraft signals, indicating that the threat of multi-device spoofing attacks is real in this and other similar systems. In the second part of this work, we investigate physical-layer features that could be used to detect multi-device attacks. We show that the frequency offset and transient phase noise of the attacker's radio devices can be exploited to discriminate between a received signal that has been transmitted by a single (legitimate) transponder or by multiple (malicious) spoofing sources. Based on that, we devise a multi-device spoofing detection system that achieves zero false positives and a false negative rate below 1%.

Mobile cellular networks can serve as ubiquitous sensors for physical mobility. We propose a method to infer vehicle travel times on highways and to detect road congestion in real-time, based solely on anonymized signaling data collected from a mobile cellular network. Most previous studies have considered data generated from mobile devices active in calls, namely Call Detail Records (CDR), an approach that limits the number of observable devices to a small fraction of the whole population. Our approach overcomes this drawback by exploiting the whole set of signaling events generated by both idle and active devices. While idle devices contribute with a large volume of spatially coarse-grained mobility data, active devices provide finer-grained spatial accuracy for a limited subset of devices. The combined use of data from idle and active devices improves congestion detection performance in terms of coverage, accuracy, and timeliness. We apply our method to real mobile signaling data obtained from an operational network during a one-month period on a sample highway segment in the proximity of a European city, and present an extensive validation study based on ground-truth obtained from a rich set of reference datasources - road sensor data, toll data, taxi floating car data, and radio broadcast messages.

This paper proposes a procedure based on time-difference of arrival measurements to localize a blind node in an asynchronous network where a set of nodes with known position is present. The proposed method computes the time-difference of arrival of each transmitted signal to any pair of receiving nodes in order to get rid of the unknown transmission time. A range-based localization procedure is implemented: first a least-squares estimator is used to compute a set of pseudo-ranges involving the blind node, then an iterative least-squares method is used to localize the blind node. The effectiveness of the proposed scheme is illustrated via simulations.

This work presents our effort in developing a complete, real-time, Software-Defined Radio implementation of an OFDM transceiver, compliant with the IEEE 802.11 Physical Layer specifications. All the baseband components in both the transmitter and the receiver are implemented with fast software functions, running on a General Purpose CPU. Real-time operation is achieved on a modern CPU by means of extensive code optimization, mostly using the SIMD instruction sets which are widely available on almost every modern CPU.

Road traffic can be monitored by means of static sensors and derived from floating car data, i.e., reports from a sub-set of vehicles. These approaches suffer from a number of technical and economical limitations. Alternatively, we propose to leverage the mobile cellular network as a ubiquitous mobility sensor. We show how vehicle travel times and road congestion can be inferred from anonymized signaling data collected from a cellular mobile network. While other previous studies have considered data only from active devices, e.g., engaged in voice calls, our approach exploits also data from idle users resulting in an enormous gain in coverage and estimation accuracy. By validating our approach against four different traffic monitoring datasets collected on a sample highway over one month, we show that our method can detect congestions very accurately and in a timely manner.

This paper presents an open source Software-Defined Radio tool compliant with IEEE 802.15.4, which incorporates features for the collection and processing of Received Signal Strength (RSS) measurements from incoming packets. The implementation includes RSS Indicator (RSSI) feature, data handling and application code for channel estimation, ranging and localization. The tool can be used for experimenting with RSSI measurements from over-the-air IEEE 802.15.4 packets. To illustrate the tool usage, we present experimental results on packets sniffed from commercial ZigBee nodes. Moreover, we highlight some issues in the RSSI calculation, showing how different aspects of the RSS computation can be investigated at the finest granularity, hence allowing researchers and practitioners to experiment down to the PHY layer.

Current Radio-Frequency Identification (RFID) technology involves two types of physical devices: tags and reader. The reader combines in a single physical device transmission (to the tags) and reception (from the tags) functions. In this paper we discuss an alternative approach, where receive functions are performed by a separate device called listener. This allows distributed tag-sensing schemes where one transmitter coexists with multiple listeners. We discuss pros and cons of both approaches and present our implementation of a passive RFID listener on GNU Radio. Our implementation is a basis for experimenting with future distributed listener-based systems, but it can be also used as a cheap and flexible protocol analyzer for currently available commercial RFID readers.

In this work we present a novel scheme for statistical-based anomaly detection in 3G cellular networks. The traffic data collected by a passive monitoring system are reduced to a set of per-mobile user counters, from which time-series of unidimensional feature distributions are derived. An example of feature is the number of TCP SYN packets seen in uplink for each mobile user in fixed-length time bins. We design a change-detection algorithm to identify deviations in each distribution time-series. Our algorithm is designed specifically to cope with the marked non-stationarities, daily/weekly seasonality and longterm trend that characterize the global traffic in a real network. The proposed scheme was applied to the analysis of a large dataset from an operational 3G network. Here we present the algorithm and report on our practical experience with the analysis of real data, highlighting the key lessons learned in the perspective of the possible adoption of our anomaly detection tool on a production basis.

In this work we present a simple toy-model that is able to explain certain empirical observations reported in a set of previous papers by Hohn et al. about the wavelet spectrum of real traffic traces. Therein, the authors found that the wavelet spectrum is substantially invariant to flow scrambling and truncation. Such finding suggested that super-flow structures above the transport layer - i.e., sessions - can be ignored for modeling the packet arrival process. Based on the proposed toy-model, we offer an interpretation framework that goes in the opposite direction, indicating that sessions, not transport-layer flows, should be taken as the main structural entities in simplified on/off models.

In this paper we present a road traffic estimation system built on top of the cellular network infrastructure. Based on the concept that many road users are also customers of a cellular operator, we show that specific road conditions map to certain signaling patterns in the cellular core network. In order to estimate the road traffic, signaling is collected from the core network of an operational mobile network. We explore the feasibility of using mobility-related signaling for pantomiming local-loop sensors, i.e. counting the number of vehicles crossing a specific road section. In this work we present the main system component and discuss a number of practical issues to be considered in the deployment of such system. Based on the explorative analysis of real signaling data, we show how normal and abnormal road conditions (e.g. accidents) map into mobility signaling in a real cellular network.

In this contribution we address the problem of using cellular network signaling for inferring real-time road traffic information. We survey and categorize the approaches that have been proposed in the literature for a cellular-based road monitoring system and identify advantages and limitations. We outline a unified framework that encompasses UMTS and GPRS data collection in addition to GSM, and prospectively combines passive and active monitoring techniques. We identify the main research challenges that must be faced in designing and implementing such an intelligent road traffic estimation system via third-generation cellular networks.

In this paper we investigate the dynamics of one-way delays in an operational mobile core network. Our final goal is to develop anomaly detection schemes for the packet delay process in order to reveal network and equipment problems. This requires a preliminary exploration of the delay distribution in the core network, which we undertake in this study. We present one-way delay measurements extracted from passive traces captured at an operational General Packet Radio System (GPRS)/Universal Mobile Telecommunications System (UMTS) network. We find that queuing is the only source of delay at Gateway GPRS Support Nodes (GGSN), while for Serving GPRS Support Nodes (SGSN) the mobility and flow-control further complicate the characterization of the ldquonormalrdquo delay behavior. Moreover, the presence of unwanted traffic has an impact on the delay statistics and should be taken into account. We find that information about actual bandwidth conditions in the Radio Network may be inferred by investigating packet delays in the core network. Our explorative results are promising about the possibility of leveraging one-way delay measurement for troubleshooting in such networks.

In this work we explore the feasibility of implementing infrastructure-to-vehicle (I2V) communication through the UMTS infrastructure. We identify the problems that arise when providing I2V services on top of legacy UMTS networks as conceived in 3GPP Release 5 and consider an I2V architecture that exploits a new feature introduced by 3GPP Release 6, namely the multimedia broadcast/multicast services (MBMS). By means of an analytical model, we quantify the performance achievable with both releases in some realistic scenarios. We show that MBMS is able to provide I2V services efficiently on top of the UMTS network.

The availability of synchronized packet-level traces captured at different links allows the extraction of one-way delays for the network section in between. Delay statistics can be used as quality indicators to validate the health of the network and to detect global performance drifts and/or localized problems. Since packet delays depend not only on the network status but also on the arriving traffic rate, the delay analysis must be coupled with the analysis of the traffic patterns at short time scales. In this work we report on the traffic and delay patterns observed at short timescales in a 3G cellular mobile network. We show that the aggregate traffic rate exhibits large impulses and investigate on their causes. Specifically, we find that high- rate sequential scanners represent a common source of traffic impulses, and identify the potential consequences of such traffic onto the underlying network. This case-study demonstrates that the microscopic analysis of delay and traffic patterns at short time-scales can contribute effectively to the task of troubleshooting IP networks. This is particularly important in the context of 3G cellular networks given their complexity and relatively recent deployment.

Passive network monitoring is required for the operation and maintenance of communication networks as well as to detect frauds and attacks. Typically, raw packet-level traffic traces are collected using suitable traffic probe devices and fed to monitoring applications (IDSs, antivirus, etc.) for analysis, with potential risks for the legitimate privacy rights of the customers. This paper aims to discuss the technical feasibility and the underlying research challenges of a two-tiered privacy-preserving network monitoring system, where carefully designed data protection mechanisms can coexist with suitably adapted monitoring applications.

In this paper we present results from a measurement campaign evaluating the web performance of different mobile Internet access technologies with and without caching. We measured in GPRS, EDGE, UMTS and HSDPA radio access networks of a mobile operator in Austria. The operator has implemented a web-proxy for performance improvement. To evaluate the impact on the different technologies we ran the setup with and without the web-proxy. We defined the download time of web pages as the performance index for our work. We developed a tool to capture this parameter and derived the index for a set of web sites frequently used by the customers in the network. Beginning with an over-all comparison we will present detailed analysis for special cases. We evaluated the impact of the proxy system to different site configurations using the performance index. Finally we compared the performance numbers for HTTP with results collected from FTP transfers.

We address the problem of inferring the presence of a bottleneck from passive measurement in a 3G core network. The work is based on two weeks of packet traces collected in the core network of Mobilkom Austria AG&CoKG, the leading mobile telecommunications provider in Austria, EU. During the measurement period a bottleneck link in the 3G core network was revealed and removed, therefore the traces enable the accurate analysis and comparison of the traffic behavior in the two network conditions. The proposed diagnosis approach is based on the marginal rate distribution of the aggregate traffic. Since TCP is the dominant component in the overall traffic mix, the presence of a bottleneck strains the aggregate rate distribution, compressing it against the bottleneck capacity limit during the peak hour. The analysis of the trajectories of the first central moments (variance, skewness) can reveal such strain without any a priori knowledge of the provisioned capacity

Securing wireless networks poses unique research challenges. In this paper, we survey the state-of-the-art approaches to providing security for three popular wireless networking paradigms, namely, IEEE 802.11 based WLANs, third-generation cellular networks, and mobile ad hoc networks. We identify the security threats as well as examine the current solutions. We further summarize lessons learned, discuss open issues, and identify future research directions.

In this work we address the problem of inferring the presence of a bottleneck from passive measurement in the UMTS core network. The study is based on one month of packet traces collected in the core network of mobilkom austria AG & Co KG, the leading mobile telecommunications provider in Austria, EU. During the measurement period a bottleneck link in the UMTS core network was revealed and removed, therefore the traces enable the accurate analysis and comparison of the traffic behavior in the two network conditions. The proposed approach exploits statistics of estimated TCP performance parameters (e.g. RTT, re-transmissions) in order to build a set of bottleneck indicators. We show that such statistics are volatile due to the presence of few top users, but this effect can be counteracted with a simple filtering method. Results show that the frequency of re-transmission events is a powerful indicator for the specific type of bottleneck under study, and it can be used to provide early warning about future occurrences of similar events. This application is particularly important for operational UMTS networks nowadays, since the traffic volumes and composition is still under evolution.

Mobile terminals are embedded systems with growing elaboration capacity, even still limited, which are continuously connected to a worldwide communication network. Thus, the idea of embedding in mobile terminals remote computing services seems attractive and it is more and more exploited. This paper evaluates a middleware platform based on the simple object access protocol (SOAP) to develop distributed applications on mobile terminals.

Networked embedded systems pose several challenges in the modeling, simulation, and design domains. The presence of the network, in particular, makes an already critical task such as HW/SW co-simulation even more complex, since a three-way (HW/SW/network) co-simulation and co-design capability is required. Modeling of networks and their interaction with hardware and software is thus key for an effective design methodology at early stages of the design flow. In this work, we present a HW/SW/network co-simulation and co-design methodology, based on the integration of heterogeneous simulation environments such as systemC and NS (network simulator). This methodology has been successfully applied to the design of a system-on-chip performing the fast path of IPv4 routing, allowing to explore different HW/SW allocation for different network configurations.

The design of state-of-the-art, complex embedded systems requires the capability of modeling and simulating the complex networked environment in which such systems operate. This implies the availability of both a networking modeling environment and traditional system-level modeling capabilities. In this paper we present a modeling and simulation methodology based on a timing accurate integration of a system-level modeling language (SystemC) and a network simulation environment (NS-2). The efficiency of the proposed design environment has been demonstrated on a description of a 802.11 MAC layer.

This paper proposes adaptive multi-path routing (AMP) as a simple algorithm for dynamic traffic engineering within autonomous systems. In contrast to related multipath routing proposals, AMP does not employ a global perspective of the network in each node. It restricts available information to a local scope, which opens the potential of reducing signaling overhead and memory consumption in routers. Having implemented AMP in ns-2, the algorithm is compared to standard routing strategies for a realistic simulation scenario. The results demonstrate the stability of AMP as well as the significant performance gains achieved.

Coupling MPLS traffic engineering on top of a wavelength-routed WDM layer offers great flexibility to operators to allocate traffic demands in their networks. We consider the problem of off-line joint configuration at both packet and optical layers. We consider time-variant offered traffic, and assume that the operator has knowledge of the traffic dynamics as a set of traffic matrices at different instants. A novel mixed integer linear programming (MILP) formulation is proposed, which takes as input this set of traffic matrices, and provides an optimal static configuration capable of accommodating the time-varying traffic. We provide a resolution strategy based on heuristics, and give numerical results for some sample cases. The proposed method is compared with a simple alternative approach for obtaining a single static solution, to show that our method utilizes much fewer resources. The solution under the proposed formulation is also compared with the set of solutions obtained by running distinct optimization problems at different instants, showing that the increase of resource is minimal. Hence our approach can provide a static configuration with about the same resources as a fully adaptable dynamical configuration.

The differentiated service architecture is proposed as a scalable approach to QoS for IP networks. Therefore it is based on the aggregate (per class) scheduling of packets, but it aims at providing QoS to single flows. In particular the expedited forwarding (EF) per hop behavior (PHB) and the related premium service have been defined in order to provide determinist QoS guarantees to IP flows: zero loss and very low delay and jitter. Hence a possible approach to characterize and to dimension a network using the EF PHB is the worst-case analysis. We propose a worst case analysis which provides bounds to the queuing delay for a class of network topologies. Our results are compared with similar available results, which provide "looser" bounds. The comparison with simulation results shows that the bound is not enough tight to be of practical use. We justify the reason for this behavior and indicate directions for further improvements.

This paper presents the integration of a proprietary hierarchical and distributed test access mechanism called HD/sup 2/BIST and a BIST insertion commercial tool. The paper briefly describes the architecture and the features of both the environments and it presents some experimental results obtained on an industrial SoC.

Proposes HD/sup 2/BIST, a complete hierarchical framework for BIST scheduling, data patterns delivering, and diagnosis of a complex system including embedded cores with different test requirements as full scan cores, partial scan cores, or BIST-ready cores. The main goal of HD/sup 2/BIST is to maximize and simplify the reuse of the built-in test architectures, giving the chip designer the highest flexibility in planning the overall SoC test strategy. HD/sup 2/BIST defines a test access method able to provide a direct "virtual" access to each core of the system, and can be conceptually considered as a powerful complement to the P1500 standard, whose main target is to make the test interface of each core independent from the vendor.