summaryrefslogtreecommitdiffstats
path: root/Tex
diff options
context:
space:
mode:
authorTom2012-04-03 16:44:56 +0200
committerTom2012-04-03 16:44:56 +0200
commit9112a2214ffe5875996bc8830ca2448555b57428 (patch)
tree845f07ae4ef44255bd9f0db40589fd582ab3407a /Tex
parentframework part finished (diff)
downloadimsi-catcher-detection-9112a2214ffe5875996bc8830ca2448555b57428.tar.gz
imsi-catcher-detection-9112a2214ffe5875996bc8830ca2448555b57428.tar.xz
imsi-catcher-detection-9112a2214ffe5875996bc8830ca2448555b57428.zip
finished architecture part
Diffstat (limited to 'Tex')
-rw-r--r--Tex/Content/Appendix.tex3
-rw-r--r--Tex/Content/Detection.tex266
-rw-r--r--Tex/Content/GSM.tex2
-rw-r--r--Tex/Images/ICDS.pngbin0 -> 258790 bytes
-rw-r--r--Tex/Master/Glossary.tex3
-rw-r--r--Tex/Master/Master.acn26
-rw-r--r--Tex/Master/Master.aux65
-rw-r--r--Tex/Master/Master.ist2
-rw-r--r--Tex/Master/Master.lof6
-rw-r--r--Tex/Master/Master.log165
-rw-r--r--Tex/Master/Master.lot2
-rw-r--r--Tex/Master/Master.pdfbin7368893 -> 9107765 bytes
-rw-r--r--Tex/Master/Master.synctex.gzbin377399 -> 431393 bytes
-rw-r--r--Tex/Master/Master.tex1
-rw-r--r--Tex/Master/Master.toc33
-rw-r--r--Tex/Master/Titlepage.tex3
16 files changed, 443 insertions, 134 deletions
diff --git a/Tex/Content/Appendix.tex b/Tex/Content/Appendix.tex
index b982674..c0b66ac 100644
--- a/Tex/Content/Appendix.tex
+++ b/Tex/Content/Appendix.tex
@@ -7,7 +7,8 @@
\label{sec:osmo_serial_schematics}
\chapter{IMSI Catcher Detection System}
-
+\section{Extextions}
+\label{sec:extensions}
\section{Example Configuration}
\chapter{System Information}
diff --git a/Tex/Content/Detection.tex b/Tex/Content/Detection.tex
index 61efcd2..b29b210 100644
--- a/Tex/Content/Detection.tex
+++ b/Tex/Content/Detection.tex
@@ -192,7 +192,8 @@ The parameters harvested are:
%TODO: find out exactly how this is done
To not become active and connect to the station, this is harvested by tuning in to something and capture the packages that set the encryption for another mobile subscriber.
\end{itemize}
-Since the \texttt{catcher} program is spawned inside the \gls{icds} application as a subprocess, information forwarding is done via stdout so new parameters could be implemented with minimal overhead.
+Note that there are different formats for the Neighbouring Cell List since the original number of 17 bytes could only present a bit mask for 124 neighbouring \glspl{arfcn}.
+This works for the 900 MHz band but for the 900 extended and the 1800 MHz band the System Information Type 2 bis and System Information Type 2 ter have to be harvested additionally to construct the Neighbouring Cell List.
\subsection{Information Evaluation}
\label{sec:info_evaluation}
@@ -201,40 +202,259 @@ Additionally when a new \gls{bts} has been found and added all formerly discover
As mentioned above, evaluation is done based on constructs called rules.
Each rule represents one check that can be performed on a base station and yields a result based on its findings.
-Possible results are:
-\begin{itemize}
- \item Critical: This means that the base station evaluated has a critical configuration error or critical settings that are not found on normal base stations, \eg unknown provider names or encryption is turned off.
- This station should not be trusted.
- \item Warning: The \gls{bts} at hand has some concerning features but it could not be said whether this really is a hint to a catcher or sheer coincidence.
- An example would be a base station having a neighbouring cell list of which none of the cells therein have actually be found up to that point.
- The list could either be a fake or it could simply be coincidence that scan has not found any up to that point.
- \item Ok: The result is as expected.
- \item Ignore: In some cases the rule cannot yield a finding.
- In that case the state is explicitly to 'ignore' so the evaluator knows that this rule should have no influence on the final outcome.
- This is the case for example when trying to find whether the base station uses encryption or not and no other subscriber connects until a set timeout is reached.
-\end{itemize}
+\emph{Critical} result means that the base station evaluated has a critical configuration error or critical settings that are not found on normal base stations, \eg unknown provider names or encryption that is turned off.
+This station should not be trusted.
+If a \emph{Warning} status is yielded the \gls{bts} at hand has some concerning features but it could not be said whether this really is a hint to a catcher or sheer coincidence.
+An example would be a base station having a neighbouring cell list of which none of the cells therein have actually be found up to that point.
+The list could either be a fake or it could simply be coincidence that scan has not found any up to that point.
+In some cases the rule cannot yield a finding.
+That is when the state is explicitly set to \emph{Ignore} so the evaluator knows that this rule should have no influence on the final outcome.
+This is the case for example when trying to find whether the base station uses encryption or not and no other subscriber connects until a set timeout is reached.
Rules can be divided into two categories depending on what they do.
-The first category are 'Configuration Rules' while the second are 'Context Rules'.
-An overview as well as details on the rules implemented for each category can be found in the next two sections.
+If everything went as expected, \emph{Ok} is returned.
+
+These rules can be divided into two different categories depending on how they work and which situations they are tailored to.
+Most of the rules are parametrised so they can be tweaked to different environments.
-\subsubsection{Configuration Rules}
-This set of rules targets the base station itself.
+The first set of rules called \emph{Configuration Rules} targets the base station itself.
Rules in this category are meant to check the parameters that concern the \gls{bts} and check them for integrity and configuration mistakes that could have been made by an IMSI catcher operator.
+These rules are mainly meant to filter out some base cases fast.
+An overview of which Context Rules are currently implemented inside the \gls{icds} is given in Table \ref{tab:config_rules}.
+\begin{table}
+\centering
+\begin{tabular}{ll}
+\toprule
+Rule &Functionality\\
+\midrule
+Provider Known &Checks whether the provider is in a list of known \\
+ &providers.\\
+Country/Provider Map &Checks whether the given provider is a valid provider\\
+ &for the given country.\\
+LAC/Provider Map &Checks whether the LAC of the station is in the normal\\
+ &LAC range for that provider given the area.\\
+ARFCN/Provider Map &Checks whether the ARFCN is in the officially registered\\
+ &range of the provider.\\
+Encryption Algorithm &Checks which encryption algorithm is used.\\
+\bottomrule
+\end{tabular}
+\caption{Configuration Rules implemented inside the ICDS.}
+\label{tab:config_rules}
+\end{table}
+Since there is no official listing or rule how the \gls{lac} is derived the LAC/Provider Mapping Rule need knowledge of the area in the the \gls{icds} is used.
+The \gls{icds} itself can be used to gather that knowledge but it has to be done prior to using the rule for base station evaluation.
+The \gls{arfcn} range each provider has registered can be looked up at the website of the Bundesnetzagentur\footnote{\url{http://www.bundesnetzagentur.de/}} which is needed for the ARFCN /Provider Mapping Rule.
+
+The second set of rules is called \emph{Context Rules}.
+As the name suggests these rules serve the purpose of checking how well a given \gls{bts} fits into its neighbourhood.
+Table \ref{tab:context_rules} shows which rules have been implemented.
+The Neighbourhood Structure Rule will be explained in a bit more detail in the next section.
+\begin{table}
+\centering
+\begin{tabular}{ll}
+\toprule
+Rule &Functionality\\
+\midrule
+LAC Median Deviation &Checks whether the LAC of the given BTS deviates\\
+ &more than a certain threshold from the median LAC of\\
+ &that provider.\\
+Pure Neighbourhoods &Checks whether all found stations in the Neighbouring\\
+ &Cell List share the same provider.\\
+Neighbourhood Structure &Checks the structure of the Neighbouring Cell List for\\
+ &certain patterns.\\
+Fully Discovered Nbhds. &Checks whether all the cells in the Neighbouring Cell\\
+ &List have actually been found.\\
+Cell ID Uniqueness &Checks whether there are other cells with the same\\
+ &Cell ID.\\
+\bottomrule
+\end{tabular}
+\caption{Context Rules implemented inside the ICDS.}
+\label{tab:context_rules}
+\end{table}
+For the LAC the median was chosen over the average since if an extreme value (ill configured IMSI catcher) exists it would have a too strong impact on the average to which all the \gls{bts} are compared.
+It could even have such a strong effect on the average that legitimate base stations would fall below the threshold and be recognised as catchers.
+\subsubsection{Neighbourhood Structure}
+The neighbourhood structure is the graph that is described by the Neighbouring Cell List located in the System Inforamtion 2/bis/ter constructs.
+Figure \ref{fig:neighbourhood_example} shows an example of the neighbourhood graphs from Vodafone and T-Mobile at the Technische Fakult\"at of the University of Freiburg\footnote{Georges Koehler Allee, Freiburg}.
+\begin{figure}
+\centering
+\includegraphics[width=.9\textwidth]{../Images/neighbourhoods_fak}
+\caption{T-Mobile and Vodafone stations at the Technische Fakult\"at.}
+\label{fig:neighbourhood_example}
+\end{figure}
+It can be seen that for each provider, the neighbourhood forms a isolated, nearly fully connected subgraph.
+The bordering grey-blue nodes have not yet been discovered therefore they have no outgoing edges.
+This could be the case because they are too far away for the Motorola to receive them or because of signal damping due to shadowing and reflection effects.
+In the \gls{icds} the aspect of isolated subgraphs for neighbourhoods is captured inside the Pure Neighbourhoods Rule.
+
+Some of the attacks discussed in Section \ref{sec:attacks} imply a certain structure of the neighbourhood graph.
+Since the IMSI catcher tries keep \glspl{ms} that have connected from switching back to a normal cell the neighbourhood list of such a catcher cell would either be empty or would only host neighbour cells that have a bad reception.
+An empty neighbourhood list is represented in a graph by a node that has been discovered and has only incoming edges.
+\begin{figure}
+\centering
+\subfigure[Normal neighbourhood]{
+\begin{tikzpicture}[->,>=stealth',shorten >=1pt,auto,node distance=3cm,
+ thick,main node/.style={circle,fill=blue!10,draw,font=\sffamily\Large\bfseries}]
-\subsubsection{Contextual Rules}
+ \node[main node] (1) {A};
+ \node[main node] (2) [below left of=1] {B};
+ \node[main node] (3) [below right of=1] {C};
-\subsubsection{Rule Evaluation}
+ \path[every node/.style={font=\sffamily\small}]
+ (1) edge node {} (2)
+ edge node {} (3)
+ (2) edge node {} (1)
+ edge node {} (3)
+ (3) edge node {} (1)
+ edge node {} (2);
+\end{tikzpicture}
+}
+\subfigure[Tainted neighbourhood]{
+\begin{tikzpicture}[->,>=stealth',shorten >=1pt,auto,node distance=3cm,
+ thick,main node/.style={circle,fill=blue!10,draw,font=\sffamily\Large\bfseries}]
-\subsection{Fake Parameters}
+ \node[main node] (1) {A};
+ \node[main node] (2) [below left of=1] {B};
+ \node[main node] (3) [below right of=1] {C};
+ \node[main node] (4) [right of=1] {D};
+
+ \path[every node/.style={font=\sffamily\small}]
+ (1) edge node {} (2)
+ edge node {} (3)
+ (2) edge node {} (1)
+ edge node {} (3);
+\end{tikzpicture}
+}
+\caption{Comparison between a normal neighbourhood subgraph and a tainted one.}
+\label{fig:structure_comparison}
+\end{figure}
+Figure \ref{fig:structure_comparison} shows a simplified regular neighbourhood graph compared to a graph with a catcher node inside.
+In this case catcher C chose the attack where it replaces a previously existent \gls{bts} whereas catcher D opened up a new cell.
+Replacing has several advantages, one being already integrated in the neighbourhood of other nodes and thus being able to catch subscribers by handover.
+For catcher D it is the other way around, it has only outgoing edges.
+This means that this cell is not known by any other node of the same provider (of course the catchers provider is fake!).
+Nevertheless it has some outgoing edges to nodes with significantly less transmission strength to not stick out too much as a completely isolated node.
+Combinations of these two approaches are also possible.
+These thoughts are basically what is captured in the Neighbourhood Structure Rule.
+
+\subsubsection{Base Station Evaluation}
+As mentioned at the beginning, all the rules are evaluated for each base station.
+Aggregation of these rule results into a single result is done by modules called \emph{Evaluators}.
+Currently there are three different evaluators implemented inside the \gls{icds}, with varying degrees of customisability.
+\begin{itemize}
+ \item Conservative Evaluator: This is a worst-case evaluator.
+ It iterates over all the rule findings and yields the most concerning finding as its result.
+ By default this evaluator is enabled in the system.
+ \item Weighted Evaluator: Using this evaluator the user can give a weight to each rule.
+ This way rules that are more important to the user can have a higher impact on overall evaluation.
+ \item Grouped Evaluator: With this evaluator rules can be grouped together.
+ Inside each group the result for the group is found by majority vote whereas the final result is conservatively found by comparing all the group results.
+\end{itemize}
+The different kinds of evaluators can be used to tweak the whole system more to a specific environment or purpose, if specific rules or groups of rules are given more weight.
+After a finding has been determined for each station, all the results are again aggregated into a final result.
+This result is always found in a conservative manner since the subscriber cannot choose to which \gls{bts} to connect to.
+If one base station seems to be compromised it cannot be guaranteed that the subscriber will not connect to it, thus the final result needs to reflect that fact.
+
+\subsection{Forged Parameters}
\label{sec:fake_parameters}
+All of the parameters that have been looked at in this project so far are parameters that can be directly set by the operator of the \gls{bts} or IMSI catcher.
+This is a major problem since how can an IMSI catcher be found that sends exactly the same information as a regular base station?
+To further investigate this issue we will analyse based on the three attack types presented in Section \ref{sec:attacks} which parameters can be forged and which cannot.
+For all three attack types presented it is possible to find a parameter configuration that does not raise suspicion, if the operator chooses a compatible \gls{lac}, \gls{arfcn}, \etc for the imitated provider.
+The Neighbouring Cell List is a bit different.
+Since the catcher wants to keep lured subscribers it will normally have an empty list or a list pointing only \glspl{bts} that have a lower reception level.
+Both of these cases can be detected.
+However the operator \emph{may} also choose to set a list consistent with the neighbouring cells.
+This would lower the chances of success for the catcher but also make it blend better in its environment and thus harder to detect.
+A sure criterion is the absence of an encryption algorithm which is needed by the catcher to record and monitor phone calls.
+The main problem here is that it cannot be guaranteed that this parameter can be harvested.
+Since this is a semi passive approach to harvesting it needs another subscriber to connect to the base station in question during the time the \gls{icds} is scanning it.
+
+For the Cell ID there are basically two possibilities depending on which attack is used.
+In the second case parameters can be chosen in a consistent way although a new Cell ID has to be chosen, as the Cell ID needs to be unique.
+The second possibility is that the IMSI catcher replaces a formerly existent cell and the second one is that it opens up a new cell.
+In the first case all parameters can be copied from the original cell.
+These cases can be resolved by adding outside knowledge to the \gls{icds}.
+This is also done by certain rules called \emph{Database Rules}.
+
+\subsubsection{Database Rules}
+There are to different rules that each handles one of the cases separately.
+The first case is the easier of both.
+We know that the catcher cell has a new Cell ID that has not been there before.
+Therefore the \emph{Cell ID Databse Rule} has three different approaches to exploit this fact:
+\begin{itemize}
+ \item A database of Cell IDs can be learned by the \gls{icds} beforehand.
+ Each cell that was seen more often over longer periods of time receives a higher rating.
+ This can be used to detect new Cell IDs that have not been seen before.
+ The better way to receive a Cell ID database is to use a commercially build one since it is always possible to overlook a cell when learning the surroundings.
+ \item A web service also offered by most providers of Cell ID databases can be used to see whether a cell actually exists and check whether it should be situated in the neighbourhood it is in.
+\end{itemize}
+The three largest Cell ID databases are the two commercial ones by Ericson\footnote{\url{https://labs.ericsson.com/apis/mobile-location/}} and combain\footnote{\url{http://location-api.com/}} as well as the free alternative OpenCellID\footnote{\url{http://www.opencellid.org/}} \cite{wiki_cells}.
+Ericson and combain have trial modes, where the first 1000 requests are free for developers afterwards a subscription or a fee per request must be paid.
+By adding this information new cells can be identified.
+
+The second where an existing cell is replaced is a bit more complicated since its parameters are an exact copy of the old cell.
+Attacking by replacing a cell works in a way that the cell with the worst reception is targeted.
+That way when the IMSI catcher finished replacing it, the reception goes up a significant amount and the mobile phone will initiate a handover to that cell.
+The difference in reception can be used to identify this kind of attack.
+In general the reception cannot be well used as a parameter because shadowing and reflection can substantially change the reception from one moment to the other.
+However when reception intervals are logged for a fixed location like a bureau, important calls made from that specific location can be protected against this kind of attack.
+To that end the \emph{Location Area Databse Rule} can augment a Cell ID Database with information about the reception of the particular cells in different locations and find out if reception for a particular station and location have changed significantly.
\section{IMSI Catcher Detection System}
\label{sec:icds}
+This section will give a short overview over some technical aspects of the \gls{icds} software itself.
+The first section will focus on architectural aspects and how the architecture can be extended.
+The second and third section will then explain how to configure and operate the application.
+
\subsection{Implemetation}
-\subsubsection{Architecture}
-\subsubsection{Extensions}
+\begin{figure}
+\centering
+\includegraphics{../Images/Architecture_software}
+\caption{System architecture of the ICDS. The arrows indicate the flow of data.}
+\label{fig:architecture}
+\end{figure}
+Figure \ref{fig:architecture} shows a diagram describing the system architecture, modules in light blue have been implemented for this project.
+The application consists of two main parts.
+One part, the \texttt{catcher} is implemented inside the OscmocomBB framework, the other part \texttt{PyCatcher} is a Python application that uses \texttt{catcher} to harvest information and evaluate it afterwards.
+Since the way \texttt{catcher} works has already been described in Section \ref{sec:info_gathering} this section will focus on the Python application part.
+
+As mentioned before layer 1 of the \gls{gsm} stack is implemented in the firmware running on the Motorola C123.
+Layer 2 and 3 are implemented on the computer and are used by the \texttt{catcher} software to harvest information from the \gls{bcch}.
+
+The \texttt{PyCatcher} application was designed with a \gls{mvc} approach in mind to make it easy to implement new functionality.
+The \gls{mvc} pattern is used to separate the data model of an application form the logic as well as from the way it is presented to the user.
+That way each of the different components can be exchanged without affecting the other two.
+An additional module has been added, the \texttt{OsmoConnector} that is loaded by the controller and spawns \texttt{catcher} as a child process.
+It takes the output back in and transforms it into an object oriented representation of the discovered base stations.
+These are then handed over and update the data model.
+This way it can be ensured that only coherent and complete information is incorporated in the data model.
+Another benefit is that the parsing module is separated from the main program logic.
+
+The \texttt{Controller} is the main part of the program and instantiates all the other modules.
+It loads data from the model, triggers the evaluation and sends the results to the view to be displayed.
+As discussed before there are several rules that can be evaluated for each base station.
+These rules are stored within the controller and can be enabled or disabled by using the view that in turn calls the respective functions for enabling or disabling rules respectively from the controller.
+Whenever a new evaluation is requested the controller evaluates the active rules and gives the results to the active evaluator, afterwards the results are send to the view for display to the user.
+Note that all the structures used are view independent, this way the current view could easily be exchanged with a web interface for example.
+
+The \texttt{View} in this project consists of a GTK3 window with several forms for user input.
+It is bound to the controller using PyGTK.
+Details on the \texttt{View} and how to use it will be explained in Section \ref{sec:icds_operation}.
+
+Rules and Evaluators were designed in a plugin fashion, since these are the main points where the program can be enhanced and new ideas can be realised.
+Implementing a new rule or a new evaluator works by extending the rule or evaluator base class and implementing one method that does the actual checking.
+After that they only need to be added to the list of included evaluators and rules inside the \texttt{controller}.
+This process is also shown in Appendix \ref{sec:extensions} in more detail.
+
\subsection{Configuration}
+\label{sec:configuration}
\subsection{Operation}
-\label{sec:icds_operation} \ No newline at end of file
+\label{sec:icds_operation}
+\begin{figure}
+\centering
+\includegraphics[width=.9\textwidth]{../Images/ICDS}
+\caption{The ICDS main window.}
+\label{fig:icds}
+\end{figure} \ No newline at end of file
diff --git a/Tex/Content/GSM.tex b/Tex/Content/GSM.tex
index 402e6e6..975690a 100644
--- a/Tex/Content/GSM.tex
+++ b/Tex/Content/GSM.tex
@@ -967,4 +967,4 @@ This threshold can often be overcome easily, since it is hard for courts to chec
Technically it would even be possible for the authorities to use a catcher without prior authentication by a judge since it is hard to proof that a catcher was used at a specific point in time.
This fact makes is hard to prosecute or even unveil the illegal operation of an \gls{imsi}-catcher used by third parties or criminals.
-These loose regulations, the hardness of detection together with the face that third parties can buy or build catchers poses a grave threat to privacy of each individual person. \ No newline at end of file
+These loose regulations, the hardness of detection together with the fact that third parties can buy or build catchers poses a grave threat to privacy of each individual person. \ No newline at end of file
diff --git a/Tex/Images/ICDS.png b/Tex/Images/ICDS.png
new file mode 100644
index 0000000..9529898
--- /dev/null
+++ b/Tex/Images/ICDS.png
Binary files differ
diff --git a/Tex/Master/Glossary.tex b/Tex/Master/Glossary.tex
index 72a425b..9648a83 100644
--- a/Tex/Master/Glossary.tex
+++ b/Tex/Master/Glossary.tex
@@ -97,4 +97,5 @@
\newacronym{lac}{LAC}{Location Area Code}
\newacronym{ncc}{NCC}{Network Color Code}
\newacronym{bcc}{BCC}{Base Station Color Code}
-\newacronym{bsic}{BSIC}{Base Station Identification Code} \ No newline at end of file
+\newacronym{bsic}{BSIC}{Base Station Identification Code}
+\newacronym{mvc}{MVC}{Model View Controller} \ No newline at end of file
diff --git a/Tex/Master/Master.acn b/Tex/Master/Master.acn
index 7cc01b8..fc07749 100644
--- a/Tex/Master/Master.acn
+++ b/Tex/Master/Master.acn
@@ -512,8 +512,32 @@
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{45}
\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{45}
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{45}
-\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{45}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{45}
\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{45}
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{45}
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{46}
\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{46}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{46}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{46}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{46}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{46}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{46}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{47}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{47}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{47}
+\glossaryentry{MS?\glossaryentryfield{ms}{\glsnamefont{MS}}{Mobile Station}{\relax }|setentrycounter{page}\glsnumberformat}{49}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{49}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{49}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{50}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{50}
+\glossaryentry{LAC?\glossaryentryfield{lac}{\glsnamefont{LAC}}{Location Area Code}{\relax }|setentrycounter{page}\glsnumberformat}{50}
+\glossaryentry{ARFCN?\glossaryentryfield{arfcn}{\glsnamefont{ARFCN}}{Absolute Radio Frequency Number}{\relax }|setentrycounter{page}\glsnumberformat}{50}
+\glossaryentry{BTS?\glossaryentryfield{bts}{\glsnamefont{BTS}}{Base Station Transceiver}{\relax }|setentrycounter{page}\glsnumberformat}{50}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{50}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{50}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{51}
+\glossaryentry{ICDS?\glossaryentryfield{icds}{\glsnamefont{ICDS}}{IMSI Catcher Detection System}{\relax }|setentrycounter{page}\glsnumberformat}{51}
+\glossaryentry{GSM?\glossaryentryfield{gsm}{\glsnamefont{GSM}}{Global System for Mobile Communications}{\relax }|setentrycounter{page}\glsnumberformat}{52}
+\glossaryentry{BCCH?\glossaryentryfield{bcch}{\glsnamefont{BCCH}}{Broadcast Channel}{\relax }|setentrycounter{page}\glsnumberformat}{52}
+\glossaryentry{MVC?\glossaryentryfield{mvc}{\glsnamefont{MVC}}{Model View Controller}{\relax }|setentrycounter{page}\glsnumberformat}{52}
+\glossaryentry{MVC?\glossaryentryfield{mvc}{\glsnamefont{MVC}}{Model View Controller}{\relax }|setentrycounter{page}\glsnumberformat}{52}
diff --git a/Tex/Master/Master.aux b/Tex/Master/Master.aux
index c58e328..220474b 100644
--- a/Tex/Master/Master.aux
+++ b/Tex/Master/Master.aux
@@ -254,35 +254,54 @@
\newlabel{fig:sysinfo2}{{3.3}{44}}
\@writefile{toc}{\contentsline {subsection}{\numberline {3.2.2}Information Evaluation}{45}}
\newlabel{sec:info_evaluation}{{3.2.2}{45}}
-\@writefile{toc}{\contentsline {subsubsection}{Configuration Rules}{46}}
-\@writefile{toc}{\contentsline {subsubsection}{Contextual Rules}{46}}
-\@writefile{toc}{\contentsline {subsubsection}{Rule Evaluation}{46}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {3.2.3}Fake Parameters}{46}}
-\newlabel{sec:fake_parameters}{{3.2.3}{46}}
-\@writefile{toc}{\contentsline {section}{\numberline {3.3}IMSI Catcher Detection System}{46}}
-\newlabel{sec:icds}{{3.3}{46}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {3.3.1}Implemetation}{46}}
-\@writefile{toc}{\contentsline {subsubsection}{Architecture}{46}}
-\@writefile{toc}{\contentsline {subsubsection}{Extensions}{46}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {3.3.2}Configuration}{46}}
-\@writefile{toc}{\contentsline {subsection}{\numberline {3.3.3}Operation}{46}}
-\newlabel{sec:icds_operation}{{3.3.3}{46}}
-\FN@pp@footnotehinttrue
-\FN@pp@footnotehinttrue
-\@writefile{toc}{\contentsline {chapter}{\numberline {4}Evaluation}{47}}
+\@writefile{lot}{\contentsline {table}{\numberline {3.3}{\ignorespaces Configuration Rules implemented inside the ICDS.}}{46}}
+\newlabel{tab:config_rules}{{3.3}{46}}
+\@writefile{lot}{\contentsline {table}{\numberline {3.4}{\ignorespaces Context Rules implemented inside the ICDS.}}{47}}
+\newlabel{tab:context_rules}{{3.4}{47}}
+\FN@pp@footnote@aux{12}{47}
+\@writefile{toc}{\contentsline {subsubsection}{Neighbourhood Structure}{47}}
+\FN@pp@footnote@aux{13}{47}
+\@writefile{lof}{\contentsline {figure}{\numberline {3.4}{\ignorespaces T-Mobile and Vodafone stations at the Technische Fakult\"at.}}{48}}
+\newlabel{fig:neighbourhood_example}{{3.4}{48}}
+\@writefile{lof}{\contentsline {figure}{\numberline {3.5}{\ignorespaces Comparison between a normal neighbourhood subgraph and a tainted one.}}{49}}
+\@writefile{lof}{\contentsline {subfigure}{\numberline{(a)}{\ignorespaces {Normal neighbourhood}}}{49}}
+\@writefile{lof}{\contentsline {subfigure}{\numberline{(b)}{\ignorespaces {Tainted neighbourhood}}}{49}}
+\newlabel{fig:structure_comparison}{{3.5}{49}}
+\@writefile{toc}{\contentsline {subsubsection}{Base Station Evaluation}{49}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {3.2.3}Forged Parameters}{50}}
+\newlabel{sec:fake_parameters}{{3.2.3}{50}}
+\citation{wiki_cells}
+\@writefile{toc}{\contentsline {subsubsection}{Database Rules}{51}}
+\FN@pp@footnote@aux{14}{51}
+\FN@pp@footnote@aux{15}{51}
+\FN@pp@footnote@aux{16}{51}
+\@writefile{toc}{\contentsline {section}{\numberline {3.3}IMSI Catcher Detection System}{51}}
+\newlabel{sec:icds}{{3.3}{51}}
+\@writefile{lof}{\contentsline {figure}{\numberline {3.6}{\ignorespaces System architecture of the ICDS. The arrows indicate the flow of data.}}{52}}
+\newlabel{fig:architecture}{{3.6}{52}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {3.3.1}Implemetation}{52}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {3.3.2}Configuration}{53}}
+\newlabel{sec:configuration}{{3.3.2}{53}}
+\@writefile{toc}{\contentsline {subsection}{\numberline {3.3.3}Operation}{53}}
+\newlabel{sec:icds_operation}{{3.3.3}{53}}
+\FN@pp@footnotehinttrue
+\@writefile{lof}{\contentsline {figure}{\numberline {3.7}{\ignorespaces The ICDS main window.}}{54}}
+\newlabel{fig:icds}{{3.7}{54}}
+\FN@pp@footnotehinttrue
+\@writefile{toc}{\contentsline {chapter}{\numberline {4}Evaluation}{55}}
\@writefile{lof}{\addvspace {10\p@ }}
\@writefile{lot}{\addvspace {10\p@ }}
\@writefile{lol}{\addvspace {10\p@ }}
-\@writefile{toc}{\contentsline {section}{\numberline {4.1}Example Scenarios}{47}}
-\@writefile{toc}{\contentsline {section}{\numberline {4.2}Test Period}{47}}
+\@writefile{toc}{\contentsline {section}{\numberline {4.1}Example Scenarios}{55}}
+\@writefile{toc}{\contentsline {section}{\numberline {4.2}Test Period}{55}}
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
-\@writefile{toc}{\contentsline {chapter}{\numberline {5}Conclusion}{49}}
+\@writefile{toc}{\contentsline {chapter}{\numberline {5}Conclusion}{57}}
\@writefile{lof}{\addvspace {10\p@ }}
\@writefile{lot}{\addvspace {10\p@ }}
\@writefile{lol}{\addvspace {10\p@ }}
-\@writefile{toc}{\contentsline {section}{\numberline {5.1}Related Projects}{49}}
-\@writefile{toc}{\contentsline {section}{\numberline {5.2}Future Work}{49}}
+\@writefile{toc}{\contentsline {section}{\numberline {5.1}Related Projects}{57}}
+\@writefile{toc}{\contentsline {section}{\numberline {5.2}Future Work}{57}}
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
@@ -358,7 +377,9 @@
\@writefile{lof}{\addvspace {10\p@ }}
\@writefile{lot}{\addvspace {10\p@ }}
\@writefile{lol}{\addvspace {10\p@ }}
-\@writefile{toc}{\contentsline {section}{\numberline {B.1}Example Configuration}{IX}}
+\@writefile{toc}{\contentsline {section}{\numberline {B.1}Extextions}{IX}}
+\newlabel{sec:extensions}{{B.1}{IX}}
+\@writefile{toc}{\contentsline {section}{\numberline {B.2}Example Configuration}{IX}}
\FN@pp@footnotehinttrue
\FN@pp@footnotehinttrue
\@writefile{toc}{\contentsline {chapter}{\numberline {C}System Information}{XI}}
diff --git a/Tex/Master/Master.ist b/Tex/Master/Master.ist
index 9547320..c9df8e0 100644
--- a/Tex/Master/Master.ist
+++ b/Tex/Master/Master.ist
@@ -1,5 +1,5 @@
% makeindex style file created by the glossaries package
-% for document 'Master' on 2012-3-29
+% for document 'Master' on 2012-4-3
actual '?'
encap '|'
level '!'
diff --git a/Tex/Master/Master.lof b/Tex/Master/Master.lof
index 664ee67..b2ffaa2 100644
--- a/Tex/Master/Master.lof
+++ b/Tex/Master/Master.lof
@@ -22,6 +22,12 @@
\contentsline {figure}{\numberline {3.1}{\ignorespaces Interaction of the OsmocomBB components with the ICDS software.}}{40}
\contentsline {figure}{\numberline {3.2}{\ignorespaces Circuit board of the Motorola C123 with its components \cite {osmo_wiki_c123}.}}{43}
\contentsline {figure}{\numberline {3.3}{\ignorespaces System Information 2 Message with annotations \cite {protocols1999}.}}{44}
+\contentsline {figure}{\numberline {3.4}{\ignorespaces T-Mobile and Vodafone stations at the Technische Fakult\"at.}}{48}
+\contentsline {figure}{\numberline {3.5}{\ignorespaces Comparison between a normal neighbourhood subgraph and a tainted one.}}{49}
+\contentsline {subfigure}{\numberline {(a)}{\ignorespaces {Normal neighbourhood}}}{49}
+\contentsline {subfigure}{\numberline {(b)}{\ignorespaces {Tainted neighbourhood}}}{49}
+\contentsline {figure}{\numberline {3.6}{\ignorespaces System architecture of the ICDS. The arrows indicate the flow of data.}}{52}
+\contentsline {figure}{\numberline {3.7}{\ignorespaces The ICDS main window.}}{54}
\addvspace {10\p@ }
\addvspace {10\p@ }
\addvspace {10\p@ }
diff --git a/Tex/Master/Master.log b/Tex/Master/Master.log
index a1d3dae..f67d5c5 100644
--- a/Tex/Master/Master.log
+++ b/Tex/Master/Master.log
@@ -1,4 +1,4 @@
-This is pdfTeX, Version 3.1415926-1.40.10 (TeX Live 2009/Debian) (format=pdflatex 2012.1.7) 29 MAR 2012 14:35
+This is pdfTeX, Version 3.1415926-1.40.10 (TeX Live 2009/Debian) (format=pdflatex 2012.1.7) 3 APR 2012 16:40
entering extended mode
%&-line parsing enabled.
**Master.tex
@@ -860,37 +860,45 @@ File: tikzlibraryplotmarks.code.tex 2008/01/09 v2.10 (rcs-revision 1.1)
(/usr/share/texmf/tex/generic/pgf/libraries/pgflibraryplotmarks.code.tex
File: pgflibraryplotmarks.code.tex 2010/10/15 v2.10 (rcs-revision 1.12)
)))
+(/usr/share/texmf/tex/generic/pgf/frontendlayer/tikz/libraries/tikzlibraryarrow
+s.code.tex
+File: tikzlibraryarrows.code.tex 2008/01/09 v2.10 (rcs-revision 1.1)
+
+(/usr/share/texmf/tex/generic/pgf/libraries/pgflibraryarrows.code.tex
+File: pgflibraryarrows.code.tex 2008/10/27 v2.10 (rcs-revision 1.9)
+\arrowsize=\dimen206
+))
(/usr/share/texmf-texlive/tex/latex/ltxmisc/url.sty
\Urlmuskip=\muskip11
Package: url 2006/04/12 ver 3.3 Verb mode for urls, etc.
)
(/usr/share/texmf-texlive/tex/latex/booktabs/booktabs.sty
Package: booktabs 2005/04/14 v1.61803 publication quality tables
-\heavyrulewidth=\dimen206
-\lightrulewidth=\dimen207
-\cmidrulewidth=\dimen208
-\belowrulesep=\dimen209
-\belowbottomsep=\dimen210
-\aboverulesep=\dimen211
-\abovetopsep=\dimen212
-\cmidrulesep=\dimen213
-\cmidrulekern=\dimen214
-\defaultaddspace=\dimen215
+\heavyrulewidth=\dimen207
+\lightrulewidth=\dimen208
+\cmidrulewidth=\dimen209
+\belowrulesep=\dimen210
+\belowbottomsep=\dimen211
+\aboverulesep=\dimen212
+\abovetopsep=\dimen213
+\cmidrulesep=\dimen214
+\cmidrulekern=\dimen215
+\defaultaddspace=\dimen216
\@cmidla=\count162
\@cmidlb=\count163
-\@aboverulesep=\dimen216
-\@belowrulesep=\dimen217
+\@aboverulesep=\dimen217
+\@belowrulesep=\dimen218
\@thisruleclass=\count164
\@lastruleclass=\count165
-\@thisrulewidth=\dimen218
+\@thisrulewidth=\dimen219
)
(/usr/share/texmf-texlive/tex/latex/subfigure/subfigure.sty
Package: subfigure 2002/03/15 v2.1.5 subfigure package
\subfigtopskip=\skip65
\subfigcapskip=\skip66
-\subfigcaptopadj=\dimen219
+\subfigcaptopadj=\dimen220
\subfigbottomskip=\skip67
-\subfigcapmargin=\dimen220
+\subfigcapmargin=\dimen221
\subfiglabelskip=\skip68
\c@subfigure=\count166
\c@lofdepth=\count167
@@ -915,35 +923,35 @@ File: lstlang1.sty 2004/09/05 1.3 listings language file
\glo@main@file=\write6
\openout6 = `Master.glo'.
-Package glossaries Info: Writing glossary file Master.glo on input line 93.
+Package glossaries Info: Writing glossary file Master.glo on input line 94.
\glo@acronym@file=\write7
\openout7 = `Master.acn'.
-Package glossaries Info: Writing glossary file Master.acn on input line 93.
+Package glossaries Info: Writing glossary file Master.acn on input line 94.
(./Glossary.tex)
(./Master.aux)
\openout1 = `Master.aux'.
-LaTeX Font Info: Checking defaults for OML/cmm/m/it on input line 110.
-LaTeX Font Info: ... okay on input line 110.
-LaTeX Font Info: Checking defaults for T1/cmr/m/n on input line 110.
-LaTeX Font Info: ... okay on input line 110.
-LaTeX Font Info: Checking defaults for OT1/cmr/m/n on input line 110.
-LaTeX Font Info: ... okay on input line 110.
-LaTeX Font Info: Checking defaults for OMS/cmsy/m/n on input line 110.
-LaTeX Font Info: ... okay on input line 110.
-LaTeX Font Info: Checking defaults for OMX/cmex/m/n on input line 110.
-LaTeX Font Info: ... okay on input line 110.
-LaTeX Font Info: Checking defaults for U/cmr/m/n on input line 110.
-LaTeX Font Info: ... okay on input line 110.
-LaTeX Font Info: Try loading font information for T1+ptm on input line 110.
+LaTeX Font Info: Checking defaults for OML/cmm/m/it on input line 111.
+LaTeX Font Info: ... okay on input line 111.
+LaTeX Font Info: Checking defaults for T1/cmr/m/n on input line 111.
+LaTeX Font Info: ... okay on input line 111.
+LaTeX Font Info: Checking defaults for OT1/cmr/m/n on input line 111.
+LaTeX Font Info: ... okay on input line 111.
+LaTeX Font Info: Checking defaults for OMS/cmsy/m/n on input line 111.
+LaTeX Font Info: ... okay on input line 111.
+LaTeX Font Info: Checking defaults for OMX/cmex/m/n on input line 111.
+LaTeX Font Info: ... okay on input line 111.
+LaTeX Font Info: Checking defaults for U/cmr/m/n on input line 111.
+LaTeX Font Info: ... okay on input line 111.
+LaTeX Font Info: Try loading font information for T1+ptm on input line 111.
(/usr/share/texmf-texlive/tex/latex/psnfss/t1ptm.fd
File: t1ptm.fd 2001/06/04 font definitions for T1/ptm.
)
Package scrbase Info: No captions found for `german'
-(scrbase) --> skipped on input line 110.
+(scrbase) --> skipped on input line 111.
Package scrbase Info: No captions found for `ngerman'
-(scrbase) --> skipped on input line 110.
+(scrbase) --> skipped on input line 111.
(/usr/share/texmf-texlive/tex/latex/ucs/ucsencs.def
File: ucsencs.def 2003/11/29 Fixes to fontencodings LGR, T3
@@ -951,13 +959,13 @@ File: ucsencs.def 2003/11/29 Fixes to fontencodings LGR, T3
(/usr/share/texmf-texlive/tex/context/base/supp-pdf.mkii
[Loading MPS to PDF converter (version 2006.09.02).]
\scratchcounter=\count171
-\scratchdimen=\dimen221
+\scratchdimen=\dimen222
\scratchbox=\box51
\nofMPsegments=\count172
\nofMParguments=\count173
\everyMPshowfont=\toks51
\MPscratchCnt=\count174
-\MPscratchDim=\dimen222
+\MPscratchDim=\dimen223
\MPnumerator=\count175
\everyMPtoPDFconversion=\toks52
)
@@ -1001,17 +1009,17 @@ Non-PDF special ignored!
{/var/lib/texmf/fonts/map/pdftex/updmap/pdftex.map} <../Images/unisiegel.pdf>])
LaTeX Font Info: Font shape `T1/ptm/bx/n' in size <10.95> not available
-(Font) Font shape `T1/ptm/b/n' tried instead on input line 120.
+(Font) Font shape `T1/ptm/b/n' tried instead on input line 121.
(../Content/Abstract.tex) [2]
-LaTeX Font Info: Try loading font information for T1+phv on input line 134.
+LaTeX Font Info: Try loading font information for T1+phv on input line 135.
(/usr/share/texmf-texlive/tex/latex/psnfss/t1phv.fd
File: t1phv.fd 2001/06/04 scalable font definitions for T1/phv.
)
LaTeX Font Info: Font shape `T1/phv/bx/n' in size <10.95> not available
-(Font) Font shape `T1/phv/b/n' tried instead on input line 134.
+(Font) Font shape `T1/phv/b/n' tried instead on input line 135.
LaTeX Font Info: Font shape `T1/ptm/bx/n' in size <20.74> not available
-(Font) Font shape `T1/ptm/b/n' tried instead on input line 134.
+(Font) Font shape `T1/ptm/b/n' tried instead on input line 135.
(./Master.toc
Class scrbook Info: You've told me to use the font selection of the element
(scrbook) `sectioning' that is an alias of element `disposition'
@@ -1024,10 +1032,10 @@ Class scrbook Info: You've told me to use the font selection of the element
(scrbook) on input line 39.
Class scrbook Info: You've told me to use the font selection of the element
(scrbook) `sectioning' that is an alias of element `disposition'
-(scrbook) on input line 58.
+(scrbook) on input line 56.
Class scrbook Info: You've told me to use the font selection of the element
(scrbook) `sectioning' that is an alias of element `disposition'
-(scrbook) on input line 61.
+(scrbook) on input line 59.
[1
@@ -1037,32 +1045,32 @@ Class scrbook Info: You've told me to use the font selection of the element
]
Class scrbook Info: You've told me to use the font selection of the element
(scrbook) `sectioning' that is an alias of element `disposition'
-(scrbook) on input line 64.
+(scrbook) on input line 62.
Class scrbook Info: You've told me to use the font selection of the element
(scrbook) `sectioning' that is an alias of element `disposition'
-(scrbook) on input line 65.
+(scrbook) on input line 63.
Class scrbook Info: You've told me to use the font selection of the element
(scrbook) `sectioning' that is an alias of element `disposition'
-(scrbook) on input line 69.
+(scrbook) on input line 67.
Class scrbook Info: You've told me to use the font selection of the element
(scrbook) `sectioning' that is an alias of element `disposition'
-(scrbook) on input line 71.
+(scrbook) on input line 70.
Class scrbook Info: You've told me to use the font selection of the element
(scrbook) `sectioning' that is an alias of element `disposition'
-(scrbook) on input line 76.
+(scrbook) on input line 75.
-Overfull \hbox (1.87224pt too wide) detected at line 77
+Overfull \hbox (1.87224pt too wide) detected at line 76
[]\T1/ptm/m/n/10.95 XIII
[]
-Overfull \hbox (1.87224pt too wide) detected at line 78
+Overfull \hbox (1.87224pt too wide) detected at line 77
[]\T1/ptm/m/n/10.95 XIII
[]
Class scrbook Info: You've told me to use the font selection of the element
(scrbook) `sectioning' that is an alias of element `disposition'
-(scrbook) on input line 79.
+(scrbook) on input line 78.
)
\tf@toc=\write8
\openout8 = `Master.toc'.
@@ -1216,18 +1224,42 @@ LaTeX Warning: Citation `osmo_wiki_c123' on page 41 undefined on input line 99.
LaTeX Warning: Citation `osmo_wiki_c123' on page 41 undefined on input line 99.
-[41] [42] [43 <../Images/c123_pcb.jpg>] [44] [45]) (../Content/Evaluation.tex
-[46]
+[41] [42] [43 <../Images/c123_pcb.jpg>] [44] [45]
+Underfull \vbox (badness 10000) has occurred while \output is active []
+
+ [46]
+<../Images/neighbourhoods_fak.png, id=201, 3155.79pt x 2726.185pt>
+File: ../Images/neighbourhoods_fak.png Graphic file (type png)
+
+<use ../Images/neighbourhoods_fak.png>
+LaTeX Font Info: Font shape `T1/phv/bx/n' in size <14.4> not available
+(Font) Font shape `T1/phv/b/n' tried instead on input line 311.
+ [47] [48 <../Images/neighbourhoods_fak.png (PNG copy)>] [49]
+Underfull \vbox (badness 4303) has occurred while \output is active []
+
+ [50]
+
+LaTeX Warning: Citation `wiki_cells' on page 51 undefined on input line 393.
+
+[51] <../Images/Architecture_software.png, id=219, 341.8371pt x 183.78261pt>
+File: ../Images/Architecture_software.png Graphic file (type png)
+
+<use ../Images/Architecture_software.png> [52 <../Images/Architecture_software.
+png (PNG copy)>] <../Images/ICDS.png, id=223, 1136.245pt x 784.9325pt>
+File: ../Images/ICDS.png Graphic file (type png)
+
+<use ../Images/ICDS.png>) (../Content/Evaluation.tex [53] [54 <../Images/ICDS.p
+ng>]
Chapter 4.
-) (../Content/Conclusion.tex [47
+) (../Content/Conclusion.tex [55
-] [48
+] [56
]
Chapter 5.
-) [49] [50
+) [57] [58
@@ -1361,11 +1393,11 @@ LaTeX Warning: There were undefined references.
)
Here is how much of TeX's memory you used:
- 24089 strings out of 493848
- 452254 string characters out of 1152824
- 660017 words of memory out of 3000000
- 26735 multiletter control sequences out of 15000+50000
- 73495 words of font info for 100 fonts, out of 3000000 for 9000
+ 24421 strings out of 493848
+ 460807 string characters out of 1152824
+ 669735 words of memory out of 3000000
+ 27057 multiletter control sequences out of 15000+50000
+ 79697 words of font info for 104 fonts, out of 3000000 for 9000
714 hyphenation exceptions out of 8191
69i,13n,72p,1076b,1342s stack positions out of 5000i,500n,10000p,200000b,50000s
{/usr/share/texmf-texlive/fonts/enc/dvips/base/8r.enc}</usr/share/texmf-texli
@@ -1376,13 +1408,14 @@ cmr10.pfb></usr/share/texmf-texlive/fonts/type1/public/amsfonts/cm/cmr8.pfb></u
sr/share/texmf-texlive/fonts/type1/public/amsfonts/cm/cmsy10.pfb></usr/share/te
xmf-texlive/fonts/type1/public/amsfonts/cm/cmsy8.pfb></usr/share/texmf-texlive/
fonts/type1/public/eurosym/feymr10.pfb></usr/share/texmf-texlive/fonts/type1/ur
-w/courier/ucrr8a.pfb></usr/share/texmf-texlive/fonts/type1/urw/times/utmb8a.pfb
-></usr/share/texmf-texlive/fonts/type1/urw/times/utmr8a.pfb></usr/share/texmf-t
-exlive/fonts/type1/urw/times/utmr8a.pfb></usr/share/texmf-texlive/fonts/type1/u
-rw/times/utmri8a.pfb>
-Output written on Master.pdf (71 pages, 7368893 bytes).
+w/courier/ucrr8a.pfb></usr/share/texmf-texlive/fonts/type1/urw/helvetic/uhvb8a.
+pfb></usr/share/texmf-texlive/fonts/type1/urw/times/utmb8a.pfb></usr/share/texm
+f-texlive/fonts/type1/urw/times/utmr8a.pfb></usr/share/texmf-texlive/fonts/type
+1/urw/times/utmr8a.pfb></usr/share/texmf-texlive/fonts/type1/urw/times/utmri8a.
+pfb>
+Output written on Master.pdf (79 pages, 9107765 bytes).
PDF statistics:
- 311 PDF objects out of 1000 (max. 8388607)
+ 346 PDF objects out of 1000 (max. 8388607)
0 named destinations out of 1000 (max. 500000)
- 113 words of extra memory for PDF output out of 10000 (max. 10000000)
+ 128 words of extra memory for PDF output out of 10000 (max. 10000000)
diff --git a/Tex/Master/Master.lot b/Tex/Master/Master.lot
index 08c83cf..e1c156f 100644
--- a/Tex/Master/Master.lot
+++ b/Tex/Master/Master.lot
@@ -9,6 +9,8 @@
\addvspace {10\p@ }
\contentsline {table}{\numberline {3.1}{\ignorespaces Technical specifications for the Motorola C123.}}{42}
\contentsline {table}{\numberline {3.2}{\ignorespaces Type Codes and the corresponding System Information Types \cite {GSM2009}.}}{44}
+\contentsline {table}{\numberline {3.3}{\ignorespaces Configuration Rules implemented inside the ICDS.}}{46}
+\contentsline {table}{\numberline {3.4}{\ignorespaces Context Rules implemented inside the ICDS.}}{47}
\addvspace {10\p@ }
\addvspace {10\p@ }
\addvspace {10\p@ }
diff --git a/Tex/Master/Master.pdf b/Tex/Master/Master.pdf
index ba00299..db2a201 100644
--- a/Tex/Master/Master.pdf
+++ b/Tex/Master/Master.pdf
Binary files differ
diff --git a/Tex/Master/Master.synctex.gz b/Tex/Master/Master.synctex.gz
index 43f7dab..93fbb0c 100644
--- a/Tex/Master/Master.synctex.gz
+++ b/Tex/Master/Master.synctex.gz
Binary files differ
diff --git a/Tex/Master/Master.tex b/Tex/Master/Master.tex
index 51de97f..e03d694 100644
--- a/Tex/Master/Master.tex
+++ b/Tex/Master/Master.tex
@@ -46,6 +46,7 @@
\usepackage{glossaries}
\usepackage{pgfplots}
\usepackage{tikz}
+\usetikzlibrary{arrows}
\usepackage{url}
\usepackage{booktabs}
\usepackage{subfigure}
diff --git a/Tex/Master/Master.toc b/Tex/Master/Master.toc
index b3def15..3040069 100644
--- a/Tex/Master/Master.toc
+++ b/Tex/Master/Master.toc
@@ -45,29 +45,28 @@
\contentsline {section}{\numberline {3.2}Procedure}{42}
\contentsline {subsection}{\numberline {3.2.1}Information Gathering}{43}
\contentsline {subsection}{\numberline {3.2.2}Information Evaluation}{45}
-\contentsline {subsubsection}{Configuration Rules}{46}
-\contentsline {subsubsection}{Contextual Rules}{46}
-\contentsline {subsubsection}{Rule Evaluation}{46}
-\contentsline {subsection}{\numberline {3.2.3}Fake Parameters}{46}
-\contentsline {section}{\numberline {3.3}IMSI Catcher Detection System}{46}
-\contentsline {subsection}{\numberline {3.3.1}Implemetation}{46}
-\contentsline {subsubsection}{Architecture}{46}
-\contentsline {subsubsection}{Extensions}{46}
-\contentsline {subsection}{\numberline {3.3.2}Configuration}{46}
-\contentsline {subsection}{\numberline {3.3.3}Operation}{46}
-\contentsline {chapter}{\numberline {4}Evaluation}{47}
-\contentsline {section}{\numberline {4.1}Example Scenarios}{47}
-\contentsline {section}{\numberline {4.2}Test Period}{47}
-\contentsline {chapter}{\numberline {5}Conclusion}{49}
-\contentsline {section}{\numberline {5.1}Related Projects}{49}
-\contentsline {section}{\numberline {5.2}Future Work}{49}
+\contentsline {subsubsection}{Neighbourhood Structure}{47}
+\contentsline {subsubsection}{Base Station Evaluation}{49}
+\contentsline {subsection}{\numberline {3.2.3}Forged Parameters}{50}
+\contentsline {subsubsection}{Database Rules}{51}
+\contentsline {section}{\numberline {3.3}IMSI Catcher Detection System}{51}
+\contentsline {subsection}{\numberline {3.3.1}Implemetation}{52}
+\contentsline {subsection}{\numberline {3.3.2}Configuration}{53}
+\contentsline {subsection}{\numberline {3.3.3}Operation}{53}
+\contentsline {chapter}{\numberline {4}Evaluation}{55}
+\contentsline {section}{\numberline {4.1}Example Scenarios}{55}
+\contentsline {section}{\numberline {4.2}Test Period}{55}
+\contentsline {chapter}{\numberline {5}Conclusion}{57}
+\contentsline {section}{\numberline {5.1}Related Projects}{57}
+\contentsline {section}{\numberline {5.2}Future Work}{57}
\contentsline {chapter}{Bibliography}{I}
\contentsline {chapter}{\numberline {A}OsmocomBB}{VII}
\contentsline {section}{\numberline {A.1}Installation}{VII}
\contentsline {section}{\numberline {A.2}Usage}{VII}
\contentsline {section}{\numberline {A.3}Serial Cable Schematics}{VII}
\contentsline {chapter}{\numberline {B}IMSI Catcher Detection System}{IX}
-\contentsline {section}{\numberline {B.1}Example Configuration}{IX}
+\contentsline {section}{\numberline {B.1}Extextions}{IX}
+\contentsline {section}{\numberline {B.2}Example Configuration}{IX}
\contentsline {chapter}{\numberline {C}System Information}{XI}
\contentsline {section}{\numberline {C.1}Type 1}{XI}
\contentsline {section}{\numberline {C.2}Type 2}{XI}
diff --git a/Tex/Master/Titlepage.tex b/Tex/Master/Titlepage.tex
index 044a95f..e0329e8 100644
--- a/Tex/Master/Titlepage.tex
+++ b/Tex/Master/Titlepage.tex
@@ -28,7 +28,8 @@
\begin{flushright} \large
\emph{Supervisor:} \\
Prof. Dr. Schneider\\
- Dennis Wehrle
+ Dennis Wehrle\\
+ Konrad Meier
\end{flushright}
\end{minipage}