Abstract: A plurality of pairs of video cameras and interrogation devices may be placed in a public place along various paths that a person-of-interest might be expected to move. The person-of-interest is then located in multiple images acquired, collectively, by multiple video cameras. From each of the interrogation devices that are paired with these video cameras, a subset of the captured identifiers is obtained. Candidate identifiers are then restricted to those identifiers that are included in each of the subsets. A given identifier may be rejected as a candidate identifier. To automatically locate the person-of-interest in the images acquired by the “paired” video cameras, a processor may utilize video-tracking techniques to automatically track the person-of-interest, such that the person-of-interest is not “lost.” By virtue of utilizing such tracking techniques, the person-of-interest may be repeatedly located automatically, and with minimal chance of a false detection.

Abstract: Methods and systems for analyzing flows of communication packets. A front-end processor associates input packets with flows and forwards each flow to the appropriate unit, typically by querying a flow table that holds a respective classification for each active flow. In general, flows that are not yet classified are forwarded to the classification unit, and the resulting classification is entered in the flow table. Flows that are classified as requested for further analysis are forwarded to an appropriate flow analysis unit. Flows that are classified as not requested for analysis are not subjected to further processing, e.g., discarded or allowed to pass.

Abstract: A plurality of pairs of video cameras and interrogation devices may be placed in a public place along various paths that a person-of-interest might be expected to move. The person-of-interest is then located in multiple images acquired, collectively, by multiple video cameras. From each of the interrogation devices that are paired with these video cameras, a subset of the captured identifiers is obtained. Candidate identifiers are then restricted to those identifiers that are included in each of the subsets. A given identifier may be rejected as a candidate identifier. To automatically locate the person-of-interest in the images acquired by the “paired” video cameras, a processor may utilize video-tracking techniques to automatically track the person-of-interest, such that the person-of-interest is not “lost.” By virtue of utilizing such tracking techniques, the person-of-interest may be repeatedly located automatically, and with minimal chance of a false detection.

Abstract: Methods and systems for identifying one or more rogue devices within a wireless communication network over a particular geographic location. A rogue base station detection system receives air interface transmissions from base stations belonging to a wireless communication network, as well as from one or more rogue base stations that do not belong to the network and are used for monitoring (e.g., hacking or eavesdropping) communication terminals communicating in the network. The system typically searches for signaling channels and converts the RF signal into GSM/UMTS messages including overcoming the different encryption methods used. The system than analyzes the received transmissions so as to identify suspicious transmissions that may be transmitted by the rogue base stations.

Abstract: Methods and systems for analyzing flows of communication packets. A front-end processor associates input packets with flows and forwards each flow to the appropriate unit, typically by querying a flow table that holds a respective classification for each active flow. In general, flows that are not yet classified are forwarded to the classification unit, and the resulting classification is entered in the flow table. Flows that are classified as requested for further analysis are forwarded to an appropriate flow analysis unit. Flows that are classified as not requested for analysis are not subjected to further processing, e.g., discarded or allowed to pass.

Abstract: A rogue base station detection system that receives communication that is exchanged in accordance with a communication protocol between one or more base stations and one or more communication terminals and detects a presence of a rogue base station based on detecting a signaling message that appears more than once in the communication, even though the signaling message is expected to appear only once in accordance with the communication protocol.

Abstract: Embodiments that are described herein provide improved methods and systems for analyzing network traffic. The disclosed embodiments enable an analytics system to perform complex processing to only new, first occurrences of received content, while refraining from processing duplicate instances of that content. In an embodiment, the analytics results regarding the first occurring content are reported and cached in association with the content. For any duplicate instance of the content, the analytics results are retrieved from the cache without re-processing of the duplicate content. When using the disclosed techniques, the system still processes all first occurring content but not duplicate instances of content that was previously received and processed. In the embodiments described herein, input data comprises communication packets exchanged in a communication network.

Abstract: A plurality of pairs of video cameras and interrogation devices may be placed in a public place along various paths that a person-of-interest might be expected to move. The person-of-interest is then located in multiple images acquired, collectively, by multiple video cameras. From each of the interrogation devices that are paired with these video cameras, a subset of the captured identifiers is obtained. Candidate identifiers are then restricted to those identifiers that are included in each of the subsets. A given identifier may be rejected as a candidate identifier. To automatically locate the person-of-interest in the images acquired by the “paired” video cameras, a processor may utilize video-tracking techniques to automatically track the person-of-interest, such that the person-of-interest is not “lost.” By virtue of utilizing such tracking techniques, the person-of-interest may be repeatedly located automatically, and with minimal chance of a false detection.

Abstract: Methods for obtain identifiers, such as International Mobile Subscriber Identities (IMSIs) and International Mobile Station Equipment Identities (IMEIs), of mobile communication terminals, and associate these identifiers with other items of identifying information provided by users of the terminals. A local interrogation device may be installed that imitates a legitimate base station belonging to a cellular network, at a control checkpoint. Local interrogation devices are connected to a global interrogation device in a hierarchical network, whereby the local interrogation devices are assigned a priority that is higher than that of the global interrogation device. The global interrogation device provides cellular coverage to a larger area that contains the control checkpoints, while the local interrogation devices provide more localized cellular coverage to the control checkpoints.

Abstract: Methods and systems for analyzing flows of communication packets. A front-end processor associates input packets with flows and forwards each flow to the appropriate unit, typically by querying a flow table that holds a respective classification for each active flow. In general, flows that are not yet classified are forwarded to the classification unit, and the resulting classification is entered in the flow table. Flows that are classified as requested for further analysis are forwarded to an appropriate flow analysis unit. Flows that are classified as not requested for analysis are not subjected to further processing, e.g., discarded or allowed to pass.

Abstract: Methods and systems for identifying one or more rogue devices within a wireless communication network over a particular geographic location. A rogue base station detection system receives air interface transmissions from base stations belonging to a wireless communication network, as well as from one or more rogue base stations that do not belong to the network and are used for monitoring (e.g., hacking or eavesdropping) communication terminals communicating in the network. The system typically searches for signaling channels and converts the RF signal into GSM/UMTS messages including overcoming the different encryption methods used. The system than analyzes the received transmissions so as to identify suspicious transmissions that may be transmitted by the rogue base stations.

Abstract: Methods and systems for tracking mobile communication terminals based on their identifiers. The disclosed techniques identify cellular terminals and Wireless Local Area Network (WLAN) terminals that are likely to be carried by the same individual, or cellular and WLAN identifiers that belong to the same multi-mode terminal. A correlation system is connected to a cellular network and to a WLAN. The system receives location coordinates of cellular identifiers used by mobile terminals in the cellular network, and location coordinates of WLAN identifiers used by mobile terminals in the WLAN. Based on the location coordinates, the system is able to construct routes that are traversed by the terminals having the various cellular and WLAN identifiers. The system attempts to find correlations in time and space between the routes.

Abstract: Systems and methods for obtaining authentication vectors issued, for use by a mobile communication terminal, by a Home Location Register (HLR) that serves a cellular communication network independently of any cooperation with the cellular network. Further to obtaining the authentication vectors, a terminal is caused to communicate over a WiFi WLAN using an encryption key derived from the obtained authentication vectors, e.g., per the EAP-SIM or EAP-AKA protocol. Since the encryption key is known, communication from the terminal is decrypted. The authentication vectors may be obtained by (i) an “impersonating” Visitor Location Register (VLR) server that does not serve the cellular network; (ii) an interrogation device which, by imitating a legitimate base station serving the cellular network, solicits the mobile communication terminal to associate with the interrogation device; or (iii) an SS7 probe, which obtains authentication vectors communicated from the HLR server to other entities on the SS7 network.

Abstract: Methods and systems for identifying one or more rogue devices within a wireless communication network over a particular geographic location. A rogue base station detection system receives air interface transmissions from base stations belonging to a wireless communication network, as well as from one or more rogue base stations that do not belong to the network and are used for monitoring (e.g., hacking or eavesdropping) communication terminals communicating in the network. The system typically searches for signaling channels and converts the RF signal into GSM/UMTS messages including overcoming the different encryption methods used. The system than analyzes the received transmissions so as to identify suspicious transmissions that may be transmitted by the rogue base stations.

Abstract: Embodiments that are described herein provide improved methods and systems for analyzing network traffic. The disclosed embodiments enable an analytics system to perform complex processing to only new, first occurrences of received content, while refraining from processing duplicate instances of that content. In an embodiment, the analytics results regarding the first occurring content are reported and cached in association with the content. For any duplicate instance of the content, the analytics results are retrieved from the cache without re-processing of the duplicate content. When using the disclosed techniques, the system still processes all first occurring content but not duplicate instances of content that was previously received and processed. In the embodiments described herein, input data comprises communication packets exchanged in a communication network.

Abstract: A rule engine configured with at least one hash table which summarizes the rules managed by the engine. The rule engine receives rules and automatically adjusts the hash table in order to relate to added rules and/or in order to remove cancelled rules. The adjustment may be performed while the rule engine is filtering packets, without stopping. The rules may be grouped into a plurality of rule types and for each rule type the rule engine performs one or more accesses to at least one hash table to determine whether any of the rules of that type match the packet. In some embodiments, the rule engine may automatically select the rule types responsive to a set of rules provided to the rule engine and adapt its operation to the specific rules it is currently handling, while not spending resources on checking rule types not currently used.

Abstract: Methods and systems for tracking mobile communication terminals based on their identifiers. The disclosed techniques identify cellular terminals and Wireless Local Area Network (WLAN) terminals that are likely to be carried by the same individual, or cellular and WLAN identifiers that belong to the same multi-mode terminal. A correlation system is connected to a cellular network and to a WLAN. The system receives location coordinates of cellular identifiers used by mobile terminals in the cellular network, and location coordinates of WLAN identifiers used by mobile terminals in the WLAN. Based on the location coordinates, the system is able to construct routes that are traversed by the terminals having the various cellular and WLAN identifiers. The system attempts to find correlations in time and space between the routes.

Abstract: A rogue base station detection system that receives communication that is exchanged in accordance with a communication protocol between one or more base stations and one or more communication terminals and detects a presence of a rogue base station based on detecting a signaling message that appears more than once in the communication, even though the signaling message is expected to appear only once in accordance with the communication protocol.

Abstract: Embodiments that are described herein provide improved methods and systems for analyzing network traffic. The disclosed embodiments enable an analytics system to perform complex processing to only new, first occurrences of received content, while refraining from processing duplicate instances of that content. In a typical embodiment, the analytics results regarding the first occurring content are reported and cached in association with the content. For any duplicate instance of the content, the analytics results are retrieved from the cache without re-processing of the duplicate content. When using the disclosed techniques, the system still processes all first occurring content but not duplicate instances of content that was previously received and processed. In the embodiments described herein, input data comprises communication packets exchanged in a communication network.

Abstract: A rule engine configured with at least one hash table which summarizes the rules managed by the engine. The rule engine receives rules and automatically adjusts the hash table in order to relate to added rules and/or in order to remove cancelled rules. The adjustment may be performed while the rule engine is filtering packets, without stopping. The rules may be grouped into a plurality of rule types and for each rule type the rule engine performs one or more accesses to at least one hash table to determine whether any of the rules of that type match the packet. In some embodiments, the rule engine may automatically select the rule types responsive to a set of rules provided to the rule engine and adapt its operation to the specific rules it is currently handling, while not spending resources on checking rule types not currently used.