git clone https://github.com/sage-s11/sigcorr.git
cd sigcorr
mvn clean package -DskipTests

java -jar target/sigcorr-0.1.0.jar analyze capture.pcap

./test.sh

┌─────────────────────────────────────────────────────────────────┐
│                         SigCorr                                  │
├─────────────────────────────────────────────────────────────────┤
│  ┌─────────────┐   ┌─────────────┐   ┌─────────────┐            │
│  │   SS7/MAP   │   │  Diameter   │   │   GTPv2-C   │            │
│  │   Parser    │   │   Parser    │   │   Parser    │            │
│  └──────┬──────┘   └──────┬──────┘   └──────┬──────┘            │
│         │                 │                 │                    │
│         └────────────┬────┴────────────────┘                    │
│                      ▼                                           │
│            ┌─────────────────────┐                              │
│            │  Identity Resolver  │  IMSI ↔ MSISDN correlation   │
│            └──────────┬──────────┘                              │
│                       ▼                                          │
│            ┌─────────────────────┐                              │
│            │ Correlation Engine  │  Temporal windowing          │
│            └──────────┬──────────┘                              │
│                       ▼                                          │
│            ┌─────────────────────┐                              │
│            │   Pattern Matcher   │  22 attack signatures        │
│            └──────────┬──────────┘                              │
│                       ▼                                          │
│                   ALERTS                                         │
└─────────────────────────────────────────────────────────────────┘

════════════════════════════════════════════════════════════════
 SigCorr v0.1.0 - Cross-Protocol Signaling Security Correlator
════════════════════════════════════════════════════════════════

Analyzing: full_multi_protocol_attack.pcap

Events decoded:
  SS7/MAP:     2
  Diameter:    2
  GTPv2-C:     1
  Total:       5

Alerts:
  ALERT[CRITICAL] ATK-001 | Silent Location Tracking
    subscriber=IMSI:234101234567890
    confidence=95%
    events=2

  ALERT[CRITICAL] ATK-003 | Multi-Protocol Reconnaissance
    subscriber=IMSI:234101234567890
    confidence=90%
    cross-protocol=true
    events=5

Summary: 2 alerts generated

sigcorr:
  tshark:
    path: /usr/bin/tshark
    timeout: 30s

  correlation:
    temporal_window: 30s
    inference_window: 10s

  detection:
    min_confidence: 70
    enabled_patterns:
      - ATK-001
      - ATK-002
      - ATK-003
      # ... or 'all'

  output:
    evidence_dir: ./evidence
    extract_pcap: true

./test.sh

# Download public samples first (see test-pcaps/public-samples/DOWNLOAD_GUIDE.md)
bash ./test-pcaps/test_public_samples.sh

sigcorr/
├── src/main/java/io/sigcorr/
│   ├── core/              # Core models (SignalingEvent, SubscriberIdentity)
│   ├── ingest/            # Protocol parsers (TsharkBridge)
│   ├── correlation/       # Identity resolution, temporal windowing
│   └── detection/         # Attack patterns, alerting
├── test-pcaps/
│   ├── attack-samples/    # Generated attack pcaps
│   ├── public-samples/    # Real-world validation samples
│   └── generate_*.py      # Pcap generators
├── evidence/              # Extracted evidence pcaps (runtime)
├── pom.xml
├── sigcorr-config.yaml
└── test.sh

@software{sigcorr2025,
  author    = {Shreyas S},
  title     = {SigCorr: Passive Cross-Protocol Attack Detection for Mobile Core Networks},
  year      = {2025},
  url       = {https://github.com/sage-s11/sigcorr},
  doi       = {10.5281/zenodo.19439509}
}