Customer Onboarding Guide
Welcome to LTE S1 Analyser
Thank you for choosing the Melrose Networks LTE S1 Analyser – a cutting-edge platform for detecting UAV/drone activity and anomalous behaviour in LTE networks using real-time signalling analysis.
This high-level onboarding guide provides a quick overview to help your team begin effectively using the platform. A detailed onboard guide will be created that is specific to your deployment. LTE S1 Analyser builds are customised to each customer.
System Overview
LTE S1 Analyser monitors and analyses S1AP signalling between eNodeBs (base stations) and the MME in LTE networks. It is designed to:
- Detect UAVs/drones using the LTE network for C2 and/or video uplink
- Identify anomalous device mobility or usage patterns
- Support defence, telecom, law enforcement, intelligence and critical infrastructure operations
Note: No subscriber payload data is accessed or required by the standard LTE S1 Analyser. The analyser uses only control-plane signalling. Deployments that require data traffic identification and interception can be supported.
Deployment Options
The Analyser can be deployed in one of the following configurations:
- Self-hosted: Installed on your infrastructure (on-premises or private cloud)
- AWS AMI: Pre-installed, ready-to-use image managed by Melrose Networks
- Simulated Demo Mode: Use our Population & UAV Simulator for proof-of-concept demonstrations
Please refer to the deployment documentation provided or contact support for provisioning assistance.
Deployment Sizing Note – Based on S1AP Signalling Volume
The LTE S1 Analyser processes S1AP signalling in real time. To ensure reliable performance, deployments must be dimensioned according to the expected signalling load, measured in S1AP events per second (including InitialUEMessage, etc).
Sizing Recommendations
| S1AP Events/sec | Deployment Scale | Suggested Compute (Total) | Recommended Architecture |
|---|---|---|---|
| 500 - 2000 | Small / Tactical | 4-8 vCPU, 16 GB RAM | Single-node or lightweight container deployment |
| 2000 - 10000 | Medium / Regional | 8-16 vCPU, 32–64 GB RAM | Single-node or dual-service containerised deployment |
| 10000 - 25000 | National / Tier 1 | 64+ vCPU, 128–256 GB RAM | Clustered architecture with horizontal scaling of workers |
| 50000 | Strategic / Defence-Grade | Contact us for architectural support | Fully distributed, horizontally scalable, multi-site resilience |
Component Guidance:
- Decoder Nodes: Scale with raw message ingress rate (recommend 1 per ~5,000 msgs/sec)
- Analysis Workers: Parallelisable; scale based on concurrent UE count and ML inference volume
- API Layer: Stateless; auto-scalable under orchestration (e.g., Kubernetes, Nomad)
- Data Persistence: Use SSD-backed TSDB (e.g. Prometheus) + indexed event store (e.g. Elasticsearch) for observability
For redundancy, observability, and operational integration (e.g. defence C2 systems, telco NOC platforms), we recommend:
- High-availability mode with failover routing
- Load balancing via ingress gateway or proxy layer
- Prometheus and Grafana for internal metrics and alerting
Melrose Networks provides architectural design assistance based on your specific signalling profile and operational context.
Input Requirements
To function, the LTE S1 Analyser requires access to real-time S1AP signalling, typically via:
- mirrored S1 interface traffic from your mobile core network, or
- a simulated feed (provided for demo/testing purposes)
The S1AP signalling can be from only one mobile network or multiple networks.
Input must include at least the following S1AP procedures:
- HandoverPreparation (0)
- HandoverResourceAllocation (1)
- HandoverNotification (2)
- PathSwitchRequest (3)
- HandoverCancel (4)
- E-RABSetup (5)
- E-RABModify (6)
- InitialContextSetup (9)
- downlinkNASTransport (11)
- initialUEMessage (12)
- uplinkNASTransport (13)
- UEContextReleaseRequest (18)
- UEContextModification (21)
- UEContextRelease (23)
Key Functional Modules
| Module | Description |
|---|---|
| Decoder | Parses S1AP messages and extracts UE signalling data |
| Mobility Tracker | Maintains state for each active UE |
| Anomaly Detection Engine | Applies ML models (e.g., LSTM, Isolation Forest) to detect UAV signatures and anomalies |
| API Output | Real-time alerts, metrics and historical export via RESTful API |
| Visual Dashboard (optional) | Operational UI for threat visibility and system monitoring |
Getting Started
Step-by-Step
- Install or access the analyser
- Connect a signalling feed (live or simulated)
- Verify input message parsing via logs or API endpoints
- Train models (Melrose Networks)
- Configure alert thresholds or model sensitivity (if required)
- Use API or dashboard to monitor detections and device paths
Support & Resources
- Documentation: Full system manual, deployment guide, and API reference included
- Support: Contact [email protected] or your assigned technical lead
- Updates: Feature updates and model improvements are released periodically and can be applied via scripted update
Disclaimer
The LTE S1 Analyser is designed to aid situational awareness and anomaly detection. It does not make definitive classifications of UAVs and should be used as part of a broader detection or intelligence framework.
We’re here to support your mission.
If you have any questions or require custom integration, please don’t hesitate to contact us.
melrosenetworks.com
Updated 4 days ago