Angelo Coluccia

Review: A review of DoS attack models for 3G cellular networks from a system-design perspective

Third-generation cellular networks are exposed to novel forms of denial-of-service attacks that only recently have started to be recognized and documented by the scientific community. In this contribution, we review some recently published attack models specific for cellular networks. We review them collectively in order to identify the main system-design aspects that are ultimately responsible for the exposure to the attack. The goal of this contribution is to build awareness about the intrinsic weaknesses of 3G networks from a system-design perspective. In doing that we hope to inform the design practice of future generation networks, motivating the adoption of randomization, adaptation and prioritization as central ingredients of robust system design.

Distribution-based anomaly detection in 3G mobile networks: from theory to practice

The design of anomaly detection (AD) methods for network traffic has been intensively investigated by the research community in recent years. However, less attention has been devoted to the issues which eventually arise when deploying such tools in a real operational context. We designed a statistical based change detection algorithm for identifying deviations in distribution time series. The proposed method has been applied to the analysis of a large dataset from an operational 3G mobile network, in the perspective of the adoption of such a tool in production. Our algorithm is designed to cope with the marked non-stationarity and daily/weekly seasonality that characterize the traffic mix in a large public network. Several practical issues emerged during the study, including the need to handle incompleteness of the collected data, the difficulty in drilling down the cause of certain alarms, and the need for human assistance in resetting the algorithm after a persistent change in network configuration (e.g. a capacity upgrade). We report on our practical experience, highlighting the key lessons learned and the hands-on experience gained from such an analysis. Finally, we propose a novel methodology based on semisynthetic traces for tuning and performance assessment of the proposed AD algorithm. Copyright

Reduced-Bias ML-Based Estimators with Low Complexity for Self-Calibrating RSS Ranging

The paper deals with the problem of distance estimation (ranging) between nodes of a wireless system, relevant e.g. to range-based localization. The case of Received Signal Strength (RSS) measurements is addressed, where the Path Loss model (PLM) is adopted to infer the unknown distance via Maximum Likelihood (ML) estimation. In the paper it is shown that, although the ML-based approach can provide unbiased estimates when the PLM parameters are known, it may be severely biased in the real case of self-calibration via estimated parameters. The bias is characterized in detail, and nonlinear effects depending on system aspects are highlighted through the analysis. Novel reduced-bias estimators with low complexity are then derived, and their effectiveness is demonstrated via Monte Carlo simulations and illustrative experimental results by GNU Radio IEEE 802.15.4 receiver and COTS ZigBee nodes.

A Distribution-Based Approach to Anomaly Detection and Application to 3G Mobile Traffic

In this work we present a novel scheme for statistical-based anomaly detection in 3G cellular networks. The traffic data collected by a passive monitoring system are reduced to a set of per-mobile user counters, from which time-series of unidimensional feature distributions are derived. An example of feature is the number of TCP SYN packets seen in uplink for each mobile user in fixed-length time bins. We design a changedetection algorithm to identify deviations in each distribution time-series. Our algorithm is designed specifically to cope with the marked non-stationarities, daily/weekly seasonality and longterm trend that characterize the global traffic in a real network. The proposed scheme was applied to the analysis of a large dataset from an operational 3G network. Here we present the algorithm and report on our practical experience with the analysis of real data, highlighting the key lessons learned in the perspective of the possible adoption of our anomaly detection tool on a production basis.

RSS-Based Localization via Bayesian Ranging and Iterative Least Squares Positioning

In the framework of range-based localization from {Received Signal Strength} (RSS) measurements, we propose a novel Bayesian formulation of the ranging problem alternative to the common approach of inverting the Path-Loss formula. Additionally, we consider an alternative to the conventional lateration stage based on an Iterative Least Squares (ILS). Numerical results show that the combination of the proposed approaches improves considerably the accuracy of range-based localization with only a slight increase of computational complexity, thus reducing the gap with the more complex range-free methods.

A methodological overview on anomaly detection

In this Chapter we give an overview of statistical methods for anomaly detection (AD), thereby targeting an audience of practitioners with general knowledge of statistics. We focus on the applicability of the methods by stating and comparing the conditions in which they can be applied and by discussing the parameters that need to be set.

A Software-Defined Radio Tool for Experimenting with RSS Measurements in IEEE 802.15.4: Implementation and Applications

This paper presents an open source Software-Defined Radio tool compliant with IEEE 802.15.4, which incorporates features for the collection and processing of Received Signal Strength (RSS) measurements from incoming packets. The implementation includes RSS Indicator (RSSI) feature, data handling and application code for channel estimation, ranging and localization. The tool can be used for experimenting with RSSI measurements from over-the-air IEEE 802.15.4 packets. To illustrate the tool usage, we present experimental results on packets sniffed from commercial ZigBee nodes. Moreover, we highlight some issues in the RSSI calculation, showing how different aspects of the RSS computation can be investigated at the finest granularity, hence allowing researchers and practitioners to experiment down to the PHY layer.

A Cognitive Algorithm for Received Signal Strength Based Localization

In this paper, we propose a method to localize a wireless and stationary blind node based on received signal strength measurements; the positioning scheme relies on the statistical path loss model. The operating environment is either non-homogeneous, i.e., the attenuation factors of the various links are different, or homogeneous, i.e., all links share one and the same attenuation factor. We introduce a cognitive procedure to circumvent the a priori uncertainty on the actual scenario being in force: the first stage is a properly designed hypothesis test, fed by measurements between anchors, moving along known trajectories, to decide whether or not the environment is homogeneous. Based upon the output of the test, a model-dependent maximum-likelihood localization algorithm is adopted using the measurements made by the blind node and the parameters estimated by the anchors at previous stage. The performance assessment shows that the proposed approach could be a viable means to handle localization in uncertain scenarios.

Positioning Based on Signals of Opportunity

A novel approach to opportunistic positioning based on timing measurements is presented. The asynchronous radio transmissions from fixed stations and from mobile GPS-equipped nodes are jointly exploited to cooperatively localize a blind node. To this end, a weighted least-squares (WLS) estimator is proposed; its effectiveness is illustrated via simulations in a realistic scenario.

On the Role of Flows and Sessions in Internet Traffic Modeling: An Explorative Toy-Model

In this work we present a simple toy-model that is able to explain certain empirical observations reported in a set of previous papers by Hohn et al. [1]-[3] about the wavelet spectrum of real traffic traces. Therein, the authors found that the wavelet spectrum is substantially invariant to flow scrambling and truncation. Such finding suggested that super-flow structures above the transport layer -- i.e., sessions -- can be ignored for modeling the packet arrival process. Based on the proposed toymodel, we offer an interpretation framework that goes in the opposite direction, indicating that sessions, not transport-layer flows, should be taken as the main structural entities in simplified on/off models.