Loading
Initializing quantum state...
Initializing quantum state...
Passive broadband RF monitoring for detecting IMSI catchers, rogue access points, and unknown transmitters — using commodity SDR hardware and probabilistic spectral baseline analysis.
Four threat detection modules, each using a different RF characterisation approach.
Tracks GSM/LTE base station identity (LAC, CID, MCC, MNC) across time. Scores anomalies: unexpected identifiers, stronger-than-expected signal, rapid appearance after silence, absence from carrier maps.
Passive 802.11 monitoring builds a profile of expected APs (BSSID, SSID, channel, signal). Flags access points impersonating known networks on unexpected hardware or unexpected locations.
Two-week learning window computes per-frequency-band baseline power distributions. Deviations above configurable sigma thresholds trigger alerts — catching unknown RF transmitters across 10 MHz–6 GHz.
Mobile deployment mode: GPS timestamps correlate detections with physical location. Builds heatmaps of anomalous RF activity across a patrol route or building survey.
Detectable threats, primary indicators, confidence level, and effective detection range.
| Threat | Primary Indicator | Confidence | Detection Range |
|---|---|---|---|
| IMSI Catcher (Stingray) | Unexpected LAC/CID, elevated signal, no carrier map entry | High | 0–500m |
| Evil Twin AP | Known SSID on unknown BSSID, channel mismatch | High | 0–100m |
| GSM Bug | Narrowband GSM transmitter not matching registered base stations | Medium | 0–200m |
| Active RF Transmitter | Spectral deviation above baseline in unknown frequency band | Low–Medium | 0–50m |
From raw I/Q samples to analyst-reviewable threat alerts.
RTL-SDR hardware captures raw I/Q samples across configurable frequency ranges
GNU Radio flowgraph demodulates and extracts per-band power and protocol identity frames
Python pipeline classifies frames: GSM/LTE beacons, 802.11 beacons, unknown narrowband
Baseline comparator scores each observation against learned spectral profile
Multi-signal IMSI catcher heuristic combines LAC/CID, signal, timing, and map correlation
Alert engine routes findings to REST API and dashboard with confidence scoring
Analyst review interface: acknowledge, tag, export, add to watchlist
Core RF pipeline and IMSI catcher heuristics are functional in lab testing against simulated targets. Rogue AP detection is active. Geolocation correlation and the React dashboard are in active development.