arXiv subjects

Haitham Hassanieh

Publications and source records attributed to Haitham Hassanieh.

9 recordsLinked to original sources

arXiv2026

"Operator, can you hear me?" A Faithful Line into the UNISOC Baseband

Baseband processors are reachable over the radio at all times. Their most security-relevant logic runs deep inside protocol state machines: the control-plane handlers that gate registration, authentication, and session setup. Analyzing that logic systematically requires introspecting the firmware as it runs, which makes re-hosting the baseband necessary. Existing re-hosting work approximates the execution environment and under-approximates the SoC complexity of the baseband processor together with its surrounding components, bringing this state practically out of reach. We instead model each surrounding component, co-processors, SIM, application processor, from what a real device does, and step them in lockstep with the baseband on one shared clock. That makes faithfulness checkable at component interfaces, rather than assumed. We call this method Unislop and demonstrate it on the UNISOC UDX710, a platform in an estimated 10-15% of cellular modems and in automotive systems, not systematically analyzed before. Starting from a Quectel RM500U-CNV module, we gain code execution, defeat its firmware-integrity check, instrument the baseband, and recover its peripheral environment from the running device. The resulting re-host reaches the same control-plane states as the real device, establishes a full PDU session, and carries real IP traffic on both ingress and egress. The recovered components are shared across UNISOC's baseband lineup, so with additional reverse-engineering effort the same design extends to further targets.

cs.CR↗

arXiv2026

LatencyScope: A System-Level Mathematical Framework for 5G RAN Latency

This paper presents LatencyScope, a mathematical framework for computing one-way uplink and downlink latency in fifth-generation radio access networks across diverse system configurations. LatencyScope models latency sources across the protocol stack, including radio interfaces, scheduling decisions, processing delays, frame structures, and hardware and software constraints, while capturing dependencies among configuration parameters and stochastic sources of delay. The framework also includes a configuration analyzer that uses these models to search billions of candidate settings and identify those that satisfy latency-reliability targets under user-specified constraints. We validate LatencyScope on two open-source fifth-generation radio access network testbeds, as well as on measurements from a public commercial fifth-generation network. The results show that LatencyScope closely matches empirical latency distributions, captures observed lower and upper latency bounds, and substantially outperforms prior analytical models and widely used fifth-generation network simulators. LatencyScope can determine whether ultra-reliable low-latency communication targets are feasible for a given deployment and, when they are feasible, efficiently find satisfying configurations, helping network operators reason about latency modeling, configuration analysis, and system-level bottlenecks.

cs.NI↗

arXiv2025

5G RAN Slicing with Load Balanced Handovers

With increasing density of small cells in modern multi-cell deployments, a given user can have multiple options for its serving cell. The serving cell for each user must be carefully chosen such that the user achieves reasonably high channel quality from it, and the load on each cell is well balanced. It is relatively straightforward to reason about this without slicing, where all users can share a global load balancing criteria set by the network operator. In this paper, we identify the unique challenges that arise when balancing load in a multi-cell setting with 5G slicing, where users are grouped into slices, and each slice has its own optimization criteria, resource quota, and demand distributions, making it hard to even define which cells are overloaded vs underloaded. We address these challenges through our system, RadioWeaver, that co-designs load balancing with dynamic quota allocation for each slice and each cell. RadioWeaver defines a novel global load balancing criteria across slices, that allows it to easily determine which cells are overloaded despite the fact that different slices optimize for different criteria. Our evaluation, using large-scale trace-driven simulations and a small-scale OpenRAN testbed, show how RadioWeaver achieves 16-365% better performance when compared to several baselines.

cs.NI↗

arXiv2025

3D Object Reconstruction with mmWave Radars

This paper presents RFconstruct, a framework that enables 3D shape reconstruction using commercial off-the-shelf (COTS) mmWave radars for self-driving scenarios. RFconstruct overcomes radar limitations of low angular resolution, specularity, and sparsity in radar point clouds through a holistic system design that addresses hardware, data processing, and machine learning challenges. The first step is fusing data captured by two radar devices that image orthogonal planes, then performing odometry-aware temporal fusion to generate denser 3D point clouds. RFconstruct then reconstructs 3D shapes of objects using a customized encoder-decoder model that does not require prior knowledge of the object's bound box. The shape reconstruction performance of RFconstruct is compared against 3D models extracted from a depth camera equipped with a LiDAR. We show that RFconstruct can accurately generate 3D shapes of cars, bikes, and pedestrians.

eess.IV↗

arXiv2024

Bootstrapping Autonomous Driving Radars with Self-Supervised Learning

The perception of autonomous vehicles using radars has attracted increased research interest due its ability to operate in fog and bad weather. However, training radar models is hindered by the cost and difficulty of annotating large-scale radar data. To overcome this bottleneck, we propose a self-supervised learning framework to leverage the large amount of unlabeled radar data to pre-train radar-only embeddings for self-driving perception tasks. The proposed method combines radar-to-radar and radar-to-vision contrastive losses to learn a general representation from unlabeled radar heatmaps paired with their corresponding camera images. When used for downstream object detection, we demonstrate that the proposed self-supervision framework can improve the accuracy of state-of-the-art supervised baselines by $5.8\%$ in mAP. Code is available at \url{https://github.com/yiduohao/Radical}.

cs.CV↗

arXiv2019

High Resolution Millimeter Wave Imaging For Self-Driving Cars

Recent years have witnessed much interest in expanding the use of networking signals beyond communication to sensing, localization, robotics, and autonomous systems. This paper explores how we can leverage recent advances in 5G millimeter wave (mmWave) technology for imaging in self-driving cars. Specifically, the use of mmWave in 5G has led to the creation of compact phased arrays with hundreds of antenna elements that can be electronically steered. Such phased arrays can expand the use of mmWave beyond vehicular communications and simple ranging sensors to a full-fledged imaging system that enables self-driving cars to see through fog, smog, snow, etc. Unfortunately, using mmWave signals for imaging in self-driving cars is challenging due to the very low resolution, the presence of fake artifacts resulting from multipath reflections and the absence of portions of the car due to specularity. This paper presents HawkEye, a system that can enable high resolution mmWave imaging in self driving cars. HawkEye addresses the above challenges by leveraging recent advances in deep learning known as Generative Adversarial Networks (GANs). HawkEye introduces a GAN architecture that is customized to mmWave imaging and builds a system that can significantly enhance the quality of mmWave images for self-driving cars.

cs.CV↗

arXiv2017

Agile Millimeter Wave Networks with Provable Guarantees

There is much interest in integrating millimeter wave radios (mmWave) into wireless LANs and 5G cellular networks to benefit from their multiple GHz of available spectrum. Yet unlike existing technologies, e.g., WiFi, mmWave radios require highly directional antennas. Since the antennas have pencil-beams, the transmitter and receiver need to align their antenna beams before they can communicate. Existing solutions scan the entire space to find the best alignment. Such a process has been shown to introduce up to seconds of delay, and is unsuitable for wireless networks where an access point has to quickly switch between users and accommodate mobile clients. This paper presents Rapid-Link, a new protocol that can find the best mmWave beam alignment without scanning the space. Given all possible directions for setting the antenna beam, Rapid-Link provably finds the optimal direction in logarithmic number of measurements. Further, Rapid-Link works within the existing 802.11ad standard for mmWave LAN, and can support both clients and access points. We have implemented Rapid-Link in a mmWave radio and evaluated it empirically. Our results show that it reduces beam alignment delay by orders of magnitude. In particular, for highly directional mmWave devices operating under 802.11ad, the delay drops from over a second to 2.5 ms.

cs.NI↗

arXiv2013

Sample-Optimal Average-Case Sparse Fourier Transform in Two Dimensions

We present the first sample-optimal sublinear time algorithms for the sparse Discrete Fourier Transform over a two-dimensional sqrt{n} x sqrt{n} grid. Our algorithms are analyzed for /average case/ signals. For signals whose spectrum is exactly sparse, our algorithms use O(k) samples and run in O(k log k) time, where k is the expected sparsity of the signal. For signals whose spectrum is approximately sparse, our algorithm uses O(k log n) samples and runs in O(k log^2 n) time; the latter algorithm works for k=Theta(sqrt{n}). The number of samples used by our algorithms matches the known lower bounds for the respective signal models. By a known reduction, our algorithms give similar results for the one-dimensional sparse Discrete Fourier Transform when n is a power of a small composite number (e.g., n = 6^t).

cs.DS↗

arXiv2012

Nearly Optimal Sparse Fourier Transform

We consider the problem of computing the k-sparse approximation to the discrete Fourier transform of an n-dimensional signal. We show: * An O(k log n)-time randomized algorithm for the case where the input signal has at most k non-zero Fourier coefficients, and * An O(k log n log(n/k))-time randomized algorithm for general input signals. Both algorithms achieve o(n log n) time, and thus improve over the Fast Fourier Transform, for any k = o(n). They are the first known algorithms that satisfy this property. Also, if one assumes that the Fast Fourier Transform is optimal, the algorithm for the exactly k-sparse case is optimal for any k = n^{Ω(1)}. We complement our algorithmic results by showing that any algorithm for computing the sparse Fourier transform of a general signal must use at least Ω(k log(n/k)/ log log n) signal samples, even if it is allowed to perform adaptive sampling.

cs.DS↗