MobileInsight Extracting and Analyzing Cellular Network Information on Smartphones Yuanjie Li 1 , Chunyi Peng 2 , Zengwen Yuan 1 , Jiayao Li 1 , Haotian Deng 2 , Tao Wang 3 1 University of California, Los Angeles 2 The Ohio State University 3 Peking University
“Anytime, Anywhere” Cellular Network Service 2
Critical Cellular Operations to Users/Apps Session Management (SM) … Mobility Management (MM) Radio Resource Control (RRC) Software Link Layer (MAC/RLC/PDCP) Hardware Physical Layer (PHY) 3
But They are Closed… Session Management (SM) Mobility Management (MM) ? Radio Resource Control (RRC) Software Link Layer (MAC/RLC/PDCP) ? Hardware Physical Layer (PHY) ? ? ? 4
Can We Have Open Access to Runtime Cellular Network Operations? Why my 4G phone switches to slow 2G? … 4 signal bars, but why no data service? Why my phone drains ? ? ? battery quickly? 5
It’s Not That Simple • No approaches cover all necessary features Full Fine Analysis At scale In-phone coverage grained ✘ ✘ ✘ ✔ ✔ Android APIs External Tools ✔ ✔ ✘ ✘ ✘ (e.g., QXDM) Operator-side ✔ ✔ ✔ ✘ ✘ cellular analytics 6
Our Solution: MobileInsight • A software tool for commodity phones • A community tool that can be built and shared together Full Fine Analysis At scale In-phone coverage grained ✔ ✔ ✔ ✔ ✔ MobileInsight ✘ ✘ ✘ ✔ ✔ Android APIs External Tools ✔ ✔ ✘ ✘ ✘ (e.g., QXDM) Operator-side ✔ ✔ ✔ ✘ ✘ cellular analytics 7
MobileInsight Overview Monitor Software SM Hardware MM RRC MAC/RLC/PDCP 01101 PHY 8
MobileInsight Overview Monitor Analyzers API … State 2 State 2 State 2 State 1 State 1 State 1 State 3 State 3 State 3 Software Hardware 9
In-device Runtime Monitor How to expose runtime cellular messages to user space? 10 Monitor Analyzers API
Challenge: No Ordinary In-device Schemes … Android APIs Software Radio Interface Layer Hardware Coarse-grained cellular info 11 Monitor Analyzers API
Solution: Side-Channel Across SW-HW Boundary Parsers … Proxy via USB Raw cellular messages Android APIs Software /dev/diag Radio Interface Layer Hardware Coarse-grained cellular info 12 Monitor Analyzers API
Cellular Protocol Analytics How to unveil runtime cellular protocol behaviors? 13 Monitor Analyzers API
Two Dimensions for Each Protocol • State dynamics extraction • Operation logic inference • Network side • Device side • Non-standardized, operator-specific • Regulated by cellular standards Hando ff decision logic Monitor Analyzers API
Protocol Analytics: Tracking State Dynamics • Current protocol state, transition events and causes • RRC : Radio connectivity status and power-saving mode • MM : Device registration status • SM : Data session activity and QoS status 15 Monitor Analyzers API
Protocol Analytics: Tracking State Dynamics • Observation : regulated by the cellular standards • Reference state machine + runtime message RRC conn. setup request RRC conn. setup accept RRC conn. reconfiguration Data Data T 1 T 1 T 1 T 2 Parameters: T 1 =100ms, Data T shortDRX =20ms T 2 =2 T shortDRX Conn. release Conn. setup Conn. setup Downlink data …… 16 Monitor Analyzers API
Protocol Analytics: Inferring Operation Logic • Algorithm to determine protocol configurations and actions • Example: handoff decision logic BS 3 (3G) BS 1’s hando ff decision logic: • Switch to BS 2 (4G) if RSS 2(4G) > RSS 1(4G) + 3 dBm • Otherwise, switch to BS 3 (3G) if RSS 1(4G) < − 110 dBm and RSS 3(3G) > − 90 dBm BS 2 (4G) BS 1 (4G) 17 Monitor Analyzers API
Inferring Operation Logic is Not Simple • Challenge #1: Non-standardized, carrier-specific operations • Challenge #2: Internal logic, not visible by end device BS 3 (3G) BS 1’s hando ff decision logic: ? • Switch to BS 2 (4G) if RSS 2(4G) > RSS 1(4G) + 3 dBm • Otherwise, switch to BS 3 (3G) if RSS 1(4G) < − 110 dBm and RSS 3(3G) > − 90 dBm BS 2 (4G) BS 1 (4G) 18 Monitor Analyzers API
Observation: Operation Logic is Not Arbitrary • Many network-side operations are stateful BS 3 (3G) BS 1’s hando ff decision logic: • Switch to BS 2 (4G) if RSS 2(4G) > RSS 1(4G) + 3 dBm • Otherwise, switch to BS 3 (3G) if RSS 1(4G) < − 110 dBm and RSS 3(3G) > − 90 dBm BS 2 (4G) BS 1 (4G) RSS 1 < -110dBm Monitor 4G Monitor 3G&4G RSS 1 > -110dBm RSS 1 < -110dBm RSS 2 > RSS 1 + 3dBm RSS 3 > -90dBm Hando ff to 4G Hando ff to 3G 19 Monitor Analyzers API
Observation: Operation Logic is Not Arbitrary • Many network-side operations are stateful and interactive Solution : Online state machine inference BS 3 (3G) BS 1 (4G) Meas Control: Monitor 4G Meas Report: RSS 2 > RSS 1 +3 Handoff command: to BS2 BS 2 (4G) BS 1 (4G) RSS 1 < -110dBm Monitor 4G Monitor 3G&4G RSS 1 > -110dBm RSS 1 < -110dBm RSS 2 > RSS 1 + 3dBm RSS 3 > -90dBm Hando ff to 4G Hando ff to 3G 20 Monitor Analyzers API
State Machine Inference: Partial Recovery • Runtime sample sequence 1 BS 1 (4G) Meas Control: Monitor 4G BS 3 (3G) Meas Report: RSS 2 > RSS 1 +3 Handoff command: to BS2 BS 2 (4G) BS 1 (4G) RSS 1 < -110dBm RSS 1 < -110dBm Monitor 4G Monitor 3G&4G Monitor 4G Monitor 3G&4G RSS 1 > -110dBm RSS 1 > -110dBm RSS 1 < -110dBm RSS 1 < -110dBm RSS 2 > RSS 1 + 3dBm RSS 2 > RSS 1 + 3dBm RSS 3 > -90dBm RSS 3 > -90dBm Hando ff to 4G Hando ff to 4G Hando ff to 3G Hando ff to 3G 21 Monitor Analyzers API
State Machine Inference: Partial Recovery • Runtime sample sequence 2 BS 1 (4G) Meas Control: Monitor 4G BS 3 (3G) Meas Report: RSS 1 <-110 Meas Control: Monitor 3G&4G Meas Report: RSS 2 >-90 Handoff command: to BS3 BS 2 (4G) BS 1 (4G) RSS RSS 1 < -110dBm RSS 1 < -110dBm RSS 1 < -110dBm Monitor 4G Monitor 4G Monitor 4G Monitor 4G Monitor 3G&4G Monitor 3G&4G Monitor 3G&4G RSS RSS 1 > -110dBm RSS 1 > -110dBm RSS 1 > -110dBm RSS 1 < -110dBm RSS 1 < -110dBm RSS 1 < -110dBm RSS 2 > RSS 1 + 3dBm RSS 2 > RSS 1 + 3dBm RSS 2 > RSS 1 + 3dBm RSS 2 > RSS 1 + 3dBm RSS 3 > -90dBm RSS 3 > -90dBm RSS 3 > -90dBm Hando ff to 4G Hando ff to 4G Hando ff to 4G Hando ff to 3G Hando ff to 3G Hando ff to 4G Hando ff to 3G 22 Monitor Analyzers API
State Machine Inference: Aggregation a BS 1 (4G) Meas Control: Monitor 4G BS 3 (3G) Meas Report: RSS 1 <-110 Meas Control: Monitor 3G&4G Meas Report: RSS 2 >-90 Handoff command: to BS3 BS 2 (4G) BS 1 (4G) RSS RSS 1 < -110dBm Monitor 4G Monitor 4G Monitor 3G&4G RSS RSS 1 > -110dBm RSS 1 < -110dBm RSS 2 > RSS 1 + 3dBm RSS 2 > RSS 1 + 3dBm RSS 3 > -90dBm Hando ff to 4G Hando ff to 4G Hando ff to 3G 23 Monitor Analyzers API
MobileInsight APIs src = OnlineMonitor() lte_rrc_analyzer = LteRrcAnalyzer() wcdma_rrc_analyzer = WcdmaRrcAnalyzer() lte_rrc_analyzer.set_source(src) wcdma_rrc_analyzer.set_source(src) src.run() More tutorials: 24 Monitor Analyzers API http://metro.cs.ucla.edu/mobile_insight/tutorials.html
Showcase Examples How can MobileInsight stimulate new apps and research? 25
Example 1: Fix Our Phone’s Network Failures • How : Track protocol state dynamics • Root cause : device-side misconfiguration • Fix : disable VoLTE when device is in 3G Data service setup request Session_Active Session_Active Session_Active QoS class = 1 (voice) Software Data service setup reject Active_Pending Active_Pending Active_Pending Inactive_Pending Inactive_Pending Inactive_Pending Hardware ? Cause: QoS unsupported Data service setup request Session_Inactive Session_Inactive Session_Inactive QoS class = 1 (voice) 4 signal bars, but Data service setup reject why no data service? Cause: QoS unsupported 26 ……
Example 2: Boost Our Phone’s Data Speed • How : Analyze inferred handoff decision logic • Root cause : suboptimal FCFS strategy • Advice : disable 2G when 4G is available 2G Meas Control Monitor 2G & 4G Monitor 2G & 4G Monitor 2G & 4G Monitor 2G & 4G Software 2G Meas Report 2G Meas Report 2G Meas Report 4G Meas Report 4G Meas Report 4G Meas Report Meas Report: 2G available Hardware ? Hando ff to 2G Hando ff to 2G Hando ff to 2G Hando ff to 4G Hando ff to 4G Hando ff to 4G Meas Report: 4G available (ignored by base station) Why switch to slow 2G Handoff command: to 2G despite good 4G coverage? 27
Research Empowered by MobileInsight • Security loophole detection, failure resolution, handoff advisor, etc. • iCellular [NSDI’16] : Device-customized multi-carrier roaming • MMDiag [SIGMETRICS’16] : mobility misconfiguration detection 28
Evaluation Coverage, performance, accuracy and system overhead 29
Wide Coverage of Phone Models • Current version : rooted Android with Qualcomm chipset • MTK/Intel and iOS support : under development Mobile Mobile Chipset Chipset Feasibility Feasibility Current Version OS OS (2.1.1) Qualcomm Qualcomm ✔ ✔ ✔ MediaTek MediaTek ✔ ✔ ✘ Android Android Intel XMM Intel XMM ✔ ✔ ✘ iOS iOS All All ✔ ✔ ✘ 30
Recommend
More recommend
