void-elf

Machine learning

7

Some initial steps: - @ynasser to contact ML researchers we collaborated with in the past - start saving binary blog pcaps Also, UW researchers suggested clustering and unsupervised learning, and...

Based on [this paper](https://arxiv.org/pdf/1510.07563.pdf), it says that one technique for tricking phones using LTE to connecting to a CSS is to exploit the "absolute priority based cell reselection" feature. Basically...

Basically, fingerprint the phy layer. We should ask for more information.

Measure time drift from cell towers

1

The idea is that a CSS's NTP will be off (probably by a few seconds). This was Dave + Jeff's idea. Great test case for some ML.

Different band scanning approaches

1

We've had a variety of different ideas for doing wider scans: 1. Separate processes to scan all the LTE bands in the background, and update the EARFCN list with anything...

Check for missing BTS features (e.g. no SIB 13)

1

It's likely that for both hobbyist and commercial ICs, they'll be missing the full range of what a normal IC is capable of. We should put in some checks to...

It's likely that for both hobbyists and commercial ICs, they won't have even bothered to change a lot of stuff from the defaults that come in the config file. We...