SYSTEM AND METHOD FOR MONITORING THE SECURITY OF CELLULAR DEVICE COMMUNICATION

• US 20120329426A1
• Filed: 06/27/2012
• Published: 12/27/2012
• Est. Priority Date: 06/27/2011
• Status: Abandoned Application

• Current Assignee: Daniel Kario, Nir Levy
• Original Assignee: Daniel Kario, Nir Levy
• Inventors: Levy, Nir, KARIO, Daniel
• Application Number:
  US13/534,069
• Publication Number:
  US 20120329426A1
• Time in Patent Office: Days
• US Class Current: 455/410
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/73 Access point logical identity

Abstract

System and method for monitoring security status of an inspected cellular device engaged in a cellular network are disclosed. Status parameters related to the inspected cellular device are gathered and analyzed. A security status of the inspected cellular device is determined based on the analysis.

Claims

1. A method for monitoring security status of a cellular device engaged in a cellular network, the method comprising:

gathering status parameters related to the cellular device;

analyzing the status parameters; and

determining the security status of the cellular device based on the analysis.

2. The method of claim 1, wherein the status parameters are selected form the list consisting of:

cell identification, cell label network identification, cell signal strength, primary scrambling code, location of the cell, Location Area Code, position of the cellular device, status of an operating system of the cellular device and link status and kernel hooks.

3. The method of claim 1, wherein analyzing the status parameters is performed using at least one analysis and machine decision making methods, the analysis and machine decision making methods are selected from the list consisting of:

rule based system and machine learning methods.

4. The method of claim 3, wherein determining the security status comprises integrating results of the at least one analysis and machine decision making methods to a unified indication.

5. The method of claim 3, wherein the machine learning methods are selected from the list consisting of:

support vector machines and hidden Markov models.

6. The method of claim 3, wherein analyzing the status parameters comprises:

analyzing the status parameters using a rule based system;

analyzing the status parameters using a support vector machine; and

analyzing the status parameters using a hidden Markov model.

7. The method of claim 6, wherein determining a security status comprises integrating the results of the rule based system, the support vector machine and the hidden Markov model to a unified indication.

8. The method of claim 6, wherein the rules of the rules based system are selected from the list consisting of:

rule 1;

a cell is faked if its “

Cell Identification”

parameter contains a known identification of a faked cell,

rule 2;

a cell is faked if its signal strength is higher than signal strength of other cells,

rule 3;

a cell is faked if its “

Cell Identification”

parameter contains a known identification of a true cell and its Location parameter does not match a known area in which the true cell having that “

Cell Identification”

is known to be, and

rule 4;

a cell is faked if its “

a-normal”

score is more than C2 times the “

a-normal”

score of other cells, where the “

a-normal”

score is calculated as a weighted sum of the indicators from the rules 1 to 3.

9. The method of claim 6, wherein analyzing the status parameters using the support vector machine comprises:

obtaining a runtime support vector engine comprising a decision file generated during a learning phase;

converting the status parameters into feature matrices using a set of rules; and

feeding the feature matrices into the runtime support vector engine.

10. The method of claim 6, wherein analyzing the status parameters using the hidden Markov model comprises:

obtaining a hidden Markov model module comprising a decision file generated during a learning phase;

converting the status parameters into feature matrices using a set of rules;

feeding the feature matrices into hidden Markov model module as runtime observations; and

determining a current state of the hidden Markov model module.

11. A data processing system comprising:

a processor; and

a computer usable medium connected to the processor, wherein the computer usable medium contains a set of instructions for monitoring security status of a cellular device engaged in a cellular network, wherein the processor is designed to carry out a set of instructions to;

gather status parameters related to the cellular device;

analyze the status parameters; and

determine a security status of the cellular device based on the analysis.

12. The data processing system of claim 11 wherein the status parameters are selected form the list consisting of:

cell identification, cell label network identification, cell signal strength, primary scrambling code, location of the cell, Location Area Code, position of the cellular device, status of an operating system of the cellular device and link status and kernel hooks.

13. The data processing system of claim 11, wherein the processor is designed to carry out a set of instructions to analyze the status parameters using at least one analysis and machine decision making methods, the analysis and machine decision making methods are selected from the list consisting of:

rule based system and machine learning methods.

14. The data processing system of claim 13, wherein the processor is designed to carry out a set of instructions to determine the security status by integrating results of the at least one analysis and machine decision making methods to a unified indication.

15. The data processing system of claim 13, wherein the machine learning methods are selected from the list consisting of:

support vector machines and hidden Markov models.

16. The data processing system of claim 13, wherein the processor is designed to carry out a set of instructions to analyze the status parameters by:

analyzing the status parameters using a rule based system;

analyzing the status parameters using a support vector machine; and

analyzing the status parameters using a hidden Markov model.

17. The data processing system of claim 16, wherein the processor is designed to carry out a set of instructions to determine a security status by integrating the results of the rule based system, the support vector machine and the hidden Markov model to a unified indication.

18. The data processing system of claim 16, wherein the rules of the rules based system are selected from the list consisting of:

rule 1;

a cell is faked if its “

Cell Identification”

parameter contains a known identification of a faked cell,

rule 2;

a cell is faked if its signal strength is higher than signal strength of other cells,

rule 3;

a cell is faked if its “

Cell Identification”

parameter contains a known identification of a true cell and its Location parameter does not match a known area in which the true cell having that “

Cell Identification”

is known to be, and

rule 4;

a cell is faked if its “

a-normal”

score is more than C2 times the “

a-normal”

score of other cells, where the “

a-normal”

score is calculated as a weighted sum of the indicators from the rules 1 to 3.

19. The data processing system of claim 16, wherein the processor is designed to carry out a set of instructions to analyze the status parameters using the support vector machine by:

obtaining a runtime support vector engine comprising a decision file generated during a learning phase;

converting the status parameters into feature matrices using a set of rules; and

feeding the feature matrices into the runtime support vector engine.

20. The data processing system of claim 16, wherein the processor is designed to carry out a set of instructions to analyze the status parameters using the hidden Markov model by:

obtaining a hidden Markov model module comprising a decision file generated during a learning phase;

converting the status parameters into feature matrices using a set of rules;

feeding the feature matrices into hidden Markov model module as runtime observations; and

determining a current state of the hidden Markov model module.