Cell Site Analysis Project ideas

How about the forensic implications of multipath propagation and the effects of the process of random signal strength variation impacting on MS/UE in the idle-mode state when determining cell selection/re-selection in GSM/3G networks.

This definitely sounds like an interesting subject. That being said I believe that the data you acquire has the possibility of changing somewhat based upon call volume, terrain (foliage attenuation/Urban/Rural setting), distance from antenna and scheduled/unscheduled maintenance of the cellular antennas.

I have very little experience with this, but it is my understanding that GSM providers have the ability to capture additional ranging data which I have been told is called timing advance. It is also my understanding that it is difficult to obtain this data in the US and I don’t know the cans and cant’s overseas.

If you could obtain this data you might consider making a call, stationary at different locations. You could choose urban and rural settings. Inside and out. Then you might try placing a call and walk a specified distance (maybe 1 K?) and then drive the same distance. You could mark all of your locations with a GPS and then check the accuracy of the ranging data if you can get it.

I’m sure Greg will have some good ideas when he sees this post.

Good luck!

How about the forensic implications of multipath propagation and the effects of the process of random signal strength variation impacting on MS/UE in the idle-mode state when determining cell selection/re-selection in GSM/3G networks.

Yeah, what he said.LOL

I believe that the data you acquire has the possibility of changing somewhat based….terrain (foliage attenuation/Urban/Rural setting), distance from antenna……

…..I have been told is called timing advance.

You may wish to include for Ed's list clutter, interference, temperature, indoor coverage, height, probability density function, etc etc etc. That is to say just because the mobile operator is pumping coverage into the ether (so to speak) it is no guarantee location problems have been solved. That is because the world into which radio coverage is propagated is hostile and dynamic. You can only really get to appreciate the beauty of radio and her ability to survive against natural and manmade phenomenon when she can still produce a glimmer of life at -120dBm against a hostile background, which in rare cases has aided mountain rescue workers, so I understand, to trace a person from an extremely weak radio signal. This is why I say with radio she is beauty but a mistress to none. Just when you think you have her corraled up she'll jump and kick you right in the backside when you least expect it.

The calculated data processed from the returned timing advance (TA) at the base station will be formed based upon the surroundings in which the receiver/transmitter is sited. The calculation of TA can be misleading as to precise location and therefore it is only used as part of an "estimate" along with Cell ID as to could be/might be location.

I have been told is called timing advance. It is also my understanding that it is difficult to obtain this data in the US and I don’t know the cans and cant’s overseas.

TA has always been available it is largely dependent upon the operator to extrapolate the data into a meaningful form for location. TA became an issue for location approximately in 2000 and thereafter remains as an element for consideration but cannot be used alone for precision location determination.

TA has always been available it is largely dependent upon the operator to extrapolate the data into a meaningful form for location. TA became an issue for location approximately in 2000 and thereafter remains as an element for consideration but cannot be used alone for precision location determination.

Greg,
Is timing advance data easily accessible by LE on your side of the pond? I have heard it is difficult to get from the GSM service providers here in the US, but the next time the opportunity presents itself I will be checking to see if that is accurate.

TA has always been available it is largely dependent upon the operator to extrapolate the data into a meaningful form for location. TA became an issue for location approximately in 2000 and thereafter remains as an element for consideration but cannot be used alone for precision location determination.

Greg,
Is timing advance data easily accessible by LE on your side of the pond? I have heard it is difficult to get from the GSM service providers here in the US, but the next time the opportunity presents itself I will be checking to see if that is accurate.

Dependent upon which law enforcement agency is relevant to making a request or indeed which department (shall we say) of the Police is requesting it, it is available. The retention period of this data by the operator is another factor, in addition to extrapolating the meaningful data from the switch raw data. The question is do you need it and under what circumstances do you seek this data e.g. petty and other low level crimes may be unlikely to succeed.

One other point, as an observation, a service provider is not what I would call a mobile network operator. For instance, the Carphone Warehouse is a service provider in the UK enabling their customers to gain access, under contract, to varying mobile networks, but CW is not a mobile operator itself. If this analogy holds true for the US then really could the service provider really provide the technical data captured at the switch?

How about the forensic implications of multipath propagation and the effects of the process of random signal strength variation impacting on MS/UE in the idle-mode state when determining cell selection/re-selection in GSM/3G networks.

Koppite, it depends what your discipline your masters is in. I would suggest you do something like you initially suggested - mapping cell coverage and the factors that affect it.

You will need to obtain equipment to take RF measurements; lots of data is key. My basic advice is set out a number of hypothesis that you can go about testing. Also look at trends etc. This makes for a good dissertation with lots of scatter graphs etc. It should also let you define your scientific method etc

TA has always been available it is largely dependent upon the operator to extrapolate the data into a meaningful form for location. TA became an issue for location approximately in 2000 and thereafter remains as an element for consideration but cannot be used alone for precision location determination.

Greg,
Is timing advance data easily accessible by LE on your side of the pond? I have heard it is difficult to get from the GSM service providers here in the US, but the next time the opportunity presents itself I will be checking to see if that is accurate.

Dependent upon which law enforcement agency is relevant to making a request or indeed which department (shall we say) of the Police is requesting it, it is available. The retention period of this data by the operator is another factor, in addition to extrapolating the meaningful data from the switch raw data. The question is do you need it and under what circumstances do you seek this data e.g. petty and other low level crimes may be unlikely to succeed.

One other point, as an observation, a service provider is not what I would call a mobile network operator. For instance, the Carphone Warehouse is a service provider in the UK enabling their customers to gain access, under contract, to varying mobile networks, but CW is not a mobile operator itself. If this analogy holds true for the US then really could the service provider really provide the technical data captured at the switch?

I've only ever seen TA being used for live investigations. If we were able to get TA data from the networks this would greatly help us in CSA. We could therefore tell the maximum distance a MS was from a BTS.

What do you mean by "extrapolating" the data? Are you referring to TA? TA is recorded in a very simple format which is easy to understand.

Your definition of a service provider is horribly wrong within a telecoms context.