Countering Mobile Signaling Storms with Counters

Abstract

Abstract. Mobile Networks are subject to signaling storms launched by misbehaving applications or malware, which result in bandwidth overload at the cell level and excessive signaling within the mobile operator, and may also deplete the battery power of mobile devices. This paper reviews the causes of signaling storms and proposes a novel technique for storm detection and mitigation. The approach is based on counting the number of successive signaling transitions that do not utilize allocated bandwidth, and temporarily blocking mobile devices that exceed a certain threshold to avoid overloading the network. Through a mathematical analysis, we derive the optimum value of the counter's threshold, which minimizes both the number of misbehaving mobiles and the signaling overload in the network. Simulation results are provided to illustrate the effectiveness of the proposed scheme.

Detecting Network-Unfriendly Mobiles With the Random Neural Network

“…First, anomaly detection and mitigation systems [19] such as [28] and the one presented in this paper. Second, air interface optimization solutions which aim to increase the number of simultaneously connected devices in the access network.…”

A Data Plane Approach for Detecting Control Plane Anomalies in Mobile Networks

“…A number of commercial solutions also started to appear in response to recent incidents of signaling storms, and can be classified into three groups: (i) Anomaly detection and mitigation tools [7] similar to the approach we suggested in [13]. (ii) Air interface optimization which aims to increase the number of simultaneously connected devices in the access network; such technologies are constantly evolving with new standards, specifications and proprietary admission/congestion control and scheduling algorithms added all the time, and our solution operates on top of and is complimentary to them.…”

“…This paper presents a random neural network (RNN) [11,12] based approach for detecting mobile devices that generate excessive radio resource control (RRC) signaling, without directly monitoring the control plane itself. In contrast to signaling based techniques [7,13], which can be more effective but require modification to cellular network equipment and/or protocols, the present approach captures packets at the edge of the mobile core network using standard switch technologies (e.g. port mirroring, fibre taps, etc.).…”

Signalling Attacks in Mobile Telephony

“…Furthermore, while work in [21,33] focuses on a general defensive approach against DoS attacks in future networks, signalling storm specific research can roughly be categorised in the following groups: problem definition and attacks classification [5,30,31,41]; measurements in real operating networks [11,40]; modelling and simulation [1,27]; impact of attacks on energy consumption [10,12]; attacks detection and mitigation, using counters [19,20,38], change-point detection techniques [32,42], IP packet analysis [28], randomisation in RRC's functions [45], software changes in the mobile terminal [8,34], monitoring terminal's bandwidth usage [39], and detection using techniques from Artificial Intelligence [2]. As we look to the future, such as the Internet of Things (IoT), various forms of attacks will also have to be considered [6,9].…”