Profiling and Validation: Knowing What Belongs on the Air
An alert is only useful if your team can judge it. Kingfisher profiles the cellular environment quickly and across every generation, so an unusual signal arrives with the detail your team needs to decide what it means.
Kingfisher detects. Kingfisher Watch shows.
2G–5G Profiling in Under Two Minutes
Kingfisher performs full tower and configuration profiling across 2G, 3G, 4G and 5G in under two minutes.
That speed matters because the cellular environment keeps changing, and a useful system has to keep up with what is actually on the air.
Every Generation, Not Just the Newest
Depending on the equipment, a rogue system can identify phones, push them onto weaker networks, cut service or deliver fraudulent messages. Not every rogue system does all of this.
Because a rogue system can push phones onto weaker networks, the older generations need watching as closely as the newest one. Kingfisher profiles all of them, 2G through 5G.
What a Profile Gives Your Team
Kingfisher flags infrastructure and behavior that don't fit. The work of identifying suspicious cellular infrastructure is done by Kingfisher's own code.
Each finding goes to Kingfisher Watch with the technical detail needed to judge it. Kingfisher Watch puts that detail in front of your team, on your own systems, so your operators can judge whether activity is expected and whether it needs a response.
Kingfisher monitors cellular infrastructure, not individual phones.
Detection and Validation Are Different Problems
Detection asks:
Is suspicious infrastructure present?
Validation asks:
Is that signal truly out of place?
Legitimate networks change all the time. Towers are added, removed and reconfigured. Temporary systems appear. Signals vary by place, network and time of day.
So a credible system has to do more than say, "this signal is unusual."
Kingfisher profiles cellular towers and their configurations across 2G–5G, so an unusual signal arrives with the technical detail needed to judge it. Your team makes the call in Kingfisher Watch.
Kingfisher treats detection, validation and localization as separate problems. Localization, finding where a signal is coming from, is covered on Kingfisher Network.
Frequently Asked Questions
Kingfisher performs full tower and configuration profiling across 2G, 3G, 4G and 5G in under two minutes.
Depending on the equipment, a rogue system can push phones onto weaker networks. That is why Kingfisher profiles every generation, 2G through 5G, and not just the newest.
Not necessarily. Legitimate networks change all the time, and an unusual signal is not always a rogue one. Kingfisher profiles towers and their configurations, so your team has the technical detail needed to judge each event in Kingfisher Watch.
Detection asks whether suspicious infrastructure is present. Validation asks whether that signal is truly out of place. Kingfisher treats them as separate problems.
A 2017 DHS sensor pilot in the National Capital Region observed anomalous activity that appeared consistent with IMSI-catcher technology. DHS said it had neither validated nor attributed that activity, and reported that later law-enforcement and counterintelligence investigation found some detected signals came from legitimate cell towers.1 Detection alone isn't enough.
Kingfisher's own code. Kingfisher profiles the cellular environment, flags infrastructure and behavior that don't fit and sends its findings to Kingfisher Watch, where your team decides what they mean.
Your team does. Kingfisher profiles what it finds, and Kingfisher Watch puts that detail in front of your operators, on your own systems, so they can decide what it means.
See Profiling in Your Own Environment
Test Kingfisher against your real environment, with your team at the screen.
Public Sources
- U.S. Department of Homeland Security, Christopher C. Krebs, Letter to Senator Ron Wyden, May 22, 2018.