Abstract: Methods and systems for tracking mobile communication terminals based on their identifiers. The disclosed techniques identify cellular terminals and Wireless Local Area Network (WLAN) terminals that are likely to be carried by the same individual, or cellular and WLAN identifiers that belong to the same multi-mode terminal. A correlation system is connected to a cellular network and to a WLAN. The system receives location coordinates of cellular identifiers used by mobile terminals in the cellular network, and location coordinates of WLAN identifiers used by mobile terminals in the WLAN. Based on the location coordinates, the system is able to construct routes that are traversed by the terminals having the various cellular and WLAN identifiers. The system attempts to find correlations in time and space between the routes.

Abstract: A rogue base station detection system that establishes a communication session with a suspected base station, and verifies whether the base station is rogue or innocent by testing which advanced communication features are supported by the base station. The detection system holds a definition of one or more communication features that are supported by innocent base stations and not by rogue base stations. During a communication session with a suspected base station, the detection system requests the base station to activate these communication features. If the base station does not support the features in question, it is likely to be rogue.

Abstract: A rule engine configured with at least one hash table which summarizes the rules managed by the engine. The rule engine receives rules and automatically adjusts the hash table in order to relate to added rules and/or in order to remove cancelled rules. The adjustment may be performed while the rule engine is filtering packets, without stopping. The rules may be grouped into a plurality of rule types and for each rule type the rule engine performs one or more accesses to at least one hash table to determine whether any of the rules of that type match the packet. In some embodiments, the rule engine may automatically select the rule types responsive to a set of rules provided to the rule engine and adapt its operation to the specific rules it is currently handling, while not spending resources on checking rule types not currently used.

Abstract: A monitoring system monitors authentication sessions both on the air interface between the terminals and the network, and on at least one wired network-side interface between network-side elements of the network. The monitoring system constructs a database of sets of network-side authentication parameters using network-side monitoring. Each set of network-side authentication parameters originates from a respective authentication session and is associated with the International Mobile Station Identity (IMSI) of the terminal involved in the session. In order to start decrypting the traffic of a given terminal, the system obtains the off-air authentication parameters of that terminal using off-air monitoring, and finds an entry in the database that matches the air-interface authentication parameters. From the combination of correlated network-side and off-air authentication parameters, the processor is able to extract the parameters needed for decryption.

Abstract: Systems and methods for fine-resolution mapping of cellular network coverage and capacity are described herein. An example method can include passively monitoring communication of multiple communication terminals in a cellular communication network, extracting from the monitored communication multiple data points and cell identifiers, and mapping an actual geographical coverage of at least a given cell of the cellular network based on the multiple data points. In particular, the multiple data points can comprise geographical positions that are measured and reported by the communication terminals while served by respective cells of the cellular communication network.

Abstract: Methods and systems for analyzing flows of communication packets. A front-end processor associates input packets with flows and forwards each flow to the appropriate unit, typically by querying a flow table that holds a respective classification for each active flow. In general, flows that are not yet classified are forwarded to the classification unit, and the resulting classification is entered in the flow table. Flows that are classified as requested for further analysis are forwarded to an appropriate flow analysis unit. Flows that are classified as not requested for analysis are not subjected to further processing, e.g., discarded or allowed to pass.

Abstract: Methods and systems for tracking mobile communication terminals based on their identifiers. The disclosed techniques identify cellular terminals and Wireless Local Area Network (WLAN) terminals that are likely to be carried by the same individual, or cellular and WLAN identifiers that belong to the same multi-mode terminal. A correlation system is connected to a cellular network and to a WLAN. The system receives location coordinates of cellular identifiers used by mobile terminals in the cellular network, and location coordinates of WLAN identifiers used by mobile terminals in the WLAN. Based on the location coordinates, the system is able to construct routes that are traversed by the terminals having the various cellular and WLAN identifiers. The system attempts to find correlations in time and space between the routes.

Abstract: Methods and systems for analyzing flows of communication packets. A front-end processor associates input packets with flows and forwards each flow to the appropriate unit, typically by querying a flow table that holds a respective classification for each active flow. In general, flows that are not yet classified are forwarded to the classification unit, and the resulting classification is entered in the flow table. Flows that are classified as requested for further analysis are forwarded to an appropriate flow analysis unit. Flows that are classified as not requested for analysis are not subjected to further processing, e.g., discarded or allowed to pass.

Abstract: Methods and systems for creating demographic profiles of mobile communication network users. A demographic classification system analyzes network traffic, so as to estimate the specific combination of application classes installed on a given terminal, and usage patterns of the applications over time. This combination of application classes and their respective usage patterns are a highly personalized choice made by the user, and is therefore used by the system to deduce the user's demographic profile. The demographic classification system operates on monitored network traffic, as opposed to obtaining explicit and accurate information regarding the installed applications from the terminal. The system then deduces the demographic profile of the user from the list of estimated application classes.

Abstract: Methods and systems for tracking mobile communication terminals based on their identifiers. The disclosed techniques identify cellular terminals and Wireless Local Area Network (WLAN) terminals that are likely to be carried by the same individual, or cellular and WLAN identifiers that belong to the same multi-mode terminal. A correlation system is connected to a cellular network and to a WLAN. The system receives location coordinates of cellular identifiers used by mobile terminals in the cellular network, and location coordinates of WLAN identifiers used by mobile terminals in the WLAN. Based on the location coordinates, the system is able to construct routes that are traversed by the terminals having the various cellular and WLAN identifiers. The system attempts to find correlations in time and space between the routes.

Abstract: A Candidate Isolation System (CIS) detects subscribers of phone call services as candidates to be surveillance targets. A Voice Matching System (VMS) then decides whether or not a given candidate Communication Terminals (CTs) should be tracked by determining, using speaker recognition techniques, whether the subscriber operating the candidate CT is a known target subscriber. The CIS receives from the network call event data that relate to CTs in the network. The CIS detects candidate CTs using a unique candidate isolation process, which applies predefined selection criteria to the received call events data.

Abstract: A substantially real-time graph-based rule engine that analyzes connectivities, both direct and indirect relationships, between entities stored in a database as the database is updated (e.g., with CDR or financial transaction data). The rule engine uses pre-defined rules to detect events (i.e., the database updates) that influence the relationship between entities in the database. When the database is updated with events (e.g., CDRs), the real-time rule engine compares the update to any relevant rules. If the real-time based rule engine finds a match between a rule and an update to the database, then the rule engine generates a notification, such as an alert. The alerts may be used to provide notification of, e.g, fraudulent activities.

Abstract: Systems and methods for location tracking in a communication network. Base stations transmit downlink signals to a plurality of subscriber terminals to define a mapping between geographical locations and respective sets of signal strengths of the downlink signals received from the base stations at the geographical locations. A subset of the subscriber terminals may be selected, and for each subscriber terminal in the subset, first measurements of a geographical location of the subscriber terminal irrespective of the downlink signals is made. Second measurements of the downlink signals received at the subscriber terminal at the geographical location is made and the mapping of the subscribers terminals is updated responsively to the first and second measurements. The geographical locations of the subscriber terminals is updated using the updated mapping.

Abstract: Systems and methods for accepting relationship indications based on interaction among entities, where each relationship indication specifies that a respective pair of the entities may be related. A single entity record may be constructed that indicates all the linked entities that have been identified as being related to the entity. The entities may include an individual, a set of individuals, a communication terminal, a plurality of communication terminals, an organization, an e-mail address, a Web-site, a bank account and a home address. An analytics operation may performed, such as identifying a shortest sequence of interrelated entities that relate a first entity with a second entity, and acting upon the identified sequence.

Abstract: Systems and methods for fine-resolution mapping of cellular network coverage and capacity are described herein. An example method can include passively monitoring communication of multiple communication terminals in a cellular communication network, extracting from the monitored communication multiple data points and cell identifiers, and mapping an actual geographical coverage of at least a given cell of the cellular network based on the multiple data points. In particular, the multiple data points can comprise geographical positions that are measured and reported by the communication terminals while served by respective cells of the cellular communication network.

Abstract: Methods and systems related to keyword searching processes. A list of keywords may be first represented by a set of short substrings. The substrings are selected such that an occurrence of a substring indicates a possible occurrence of one or more of the keywords. Input data may be initially pre-processed, so as to identify locations in the input data in which the substrings occur. Then, the identified locations are searched for occurrences of the actual keywords. The pre-processing scheme enables the keyword search process to search only in the identified locations of the substrings instead of over the entire input data.

Abstract: A rogue base station detection system that establishes a communication session with a suspected base station, and verifies whether the base station is rogue or innocent by testing which advanced communication features are supported by the base station. The detection system holds a definition of one or more communication features that are supported by innocent base stations and not by rogue base stations. During a communication session with a suspected base station, the detection system requests the base station to activate these communication features. If the base station does not support the features in question, it is likely to be rogue.

Abstract: Embodiments that are described herein provide improved methods and systems for analyzing network traffic. The disclosed embodiments enable an analytics system to perform complex processing to only new, first occurrences of received content, while refraining from processing duplicate instances of that content. In a typical embodiment, the analytics results regarding the first occurring content are reported and cached in association with the content. For any duplicate instance of the content, the analytics results are retrieved from the cache without re-processing of the duplicate content. When using the disclosed techniques, the system still processes all first occurring content but not duplicate instances of content that was previously received and processed. In the embodiments described herein, input data comprises communication packets exchanged in a communication network.

Abstract: Methods and systems for finding search phrases in a body of data that is encoded using any of multiple possible character encoding schemes. An analytics system accepts an input search phrase for searching in a certain body of data. The system identifies two or more candidate character encoding schemes, which may have been used for encoding the body of data. Having determined the candidate encoding schemes, the system translates the input search phrase into multiple encoding-specific search phrases that represent the input search phrase in the respective candidate encoding schemes. The system then searches the body of data for occurrences of the input search phrase using the multiple encoding-specific search phrases.

Abstract: Methods and systems for tracking mobile communication terminals based on their identifiers. The disclosed techniques identify cellular terminals and Wireless Local Area Network (WLAN) terminals that are likely to be carried by the same individual, or cellular and WLAN identifiers that belong to the same multi-mode terminal. A correlation system is connected to a cellular network and to a WLAN. The system receives location coordinates of cellular identifiers used by mobile terminals in the cellular network, and location coordinates of WLAN identifiers used by mobile terminals in the WLAN. Based on the location coordinates, the system is able to construct routes that are traversed by the terminals having the various cellular and WLAN identifiers. The system attempts to find correlations in time and space between the routes.