Analyzing CDR/IPDR data to find People Network from Encrypted Messaging Services

TL;DR

This paper presents a system that analyzes encrypted messaging metadata to identify social networks, aiding law enforcement in detecting criminal activities without decrypting message content.

Contribution

The authors develop a novel method for analyzing cellular GPRS metadata to infer social connections in encrypted messaging services, reducing manual effort and analysis time.

Findings

Successfully identified potential communication networks from anonymized data

Reduced analysis time significantly compared to manual methods

Enabled call graph analysis without decrypting message content

Abstract

Criminals are increasingly using mobile based communication applications, like WhatsApp, that have end-to-end encryption to connect to each other. This makes traditional analysis of call graphs, or traffic analysis, virtually impossible and so is a hindrance for law enforcement personnel. Old methods of traffic analysis have been rendered useless and criminals, including arms dealers and terrorists, are able to engage in criminal activity undetected by police. At present, law enforcement must use extensive manual effort to parse data provided by cell companies to extract information. We have built a system that analyses cellular GPRS metadata and builds a profile and finds potential call connections explicitly which are implicit in the dataset. This paper describes our approach and system in detail and includes results of our evaluation using an anonymized dataset from Delhi Police. Our system permits call graph analysis to be done, and significantly reduces the time needed from the data analysis process.