IL308494B2 - Mapping underground infrastructure including terror organizations tunnel systems based on cellular connectivity analysis - Google Patents

Description

MAPPING UNDERGROUND INFRASTRUCTURE INCLUDING TERROR ORGANIZATIONS’ TUNNEL SYSTEMS BASED ON CELLULAR CONNECTIVITY ANALYSIS BACKGROUND The present invention, in some embodiments thereof, relates to mapping an underground infrastructure, and, more specifically, but not exclusively, to mapping an underground infrastructure including tunnels used for terror activities based on cellular network connectivity.

On October 7, 2023, the Gaza based Hamas terror organization launched a full scale barbaric attack against Israeli army posts and civilian communities located along the border of the Gaza strip with Israel. In this attack, the Hamas murderous terrorists killed over 1,200 and kidnapped over 242 people including babies, children, men and women, as well as soldiers after committing despicable atrocities in them.

In retaliation, the Israeli Defense Force (IDF) responded with a heavy air strike against Hamas assets in the Gaza strip followed by a large scale ground maneuver of massive armored and infantry troops in order to destroy the Hamas military and government infrastructures so that any such future threat of attack from the Gaza strip will never happen again.

One of the major difficulties the IDF faces in fighting the Hamas fighters is the massive underground system the Hamas built throughout the Gaza strip and mainly under Gaza city where its headquarters are located.

This underground system, estimated to run 500 kilometers, includes logistic tunnels for moving troops, storing weapons and explosives, command centers, dwelling and rest areas, hideouts, and/or the like as well as attack tunnels and shafts from which terrorists may emerge to launch attacks.

Another underground threat also lays on Israel's north border, where the Lebanon based Hezbollah terror organization also build a huge underground tunnel system including attack tunnels which go under the Israeli border to penetrate into Israel in order to facilitate means to launch an attack against Israeli communities and IDF posts located along the Israel-Lebanon border. ^ael patent office 12. 11.23 SUMMARY According to a first aspect of the present invention there is provided a method of mapping underground infrastructure based on cellular network connectivity, the method comprising using one or more processors for: Identifying a plurality of cellular events, each of the plurality of cellular events involves communication and/or dis-communication of one of a plurality of mobile cellular devices with a cellular network.

Identifying a plurality of locations of at least some of the plurality of mobile cellular devices during at least some of their related cellular events.

- Estimating a location of one or more potential entrances to one or more underground infrastructures and/or a path of at least part of one or more underground infrastructures according to a distribution of the plurality of locations.

- Outputting one or more map records updated to map the location of the one or more potential entrances and/or the path of the one or more underground infrastructures.

According to a first aspect of the present invention there is provided a method of mapping underground infrastructure based on mobile cellular devices tracking, the method comprising using one or more processors for: Estimating a location of one or more potential entrances to one or more underground infrastructures according to a distribution of a plurality of locations of a plurality of mobile cellular devices during a plurality of connection events of a plurality of cellular events. During each of the plurality of connection events one of the plurality of mobile cellular devices disconnects from or connects to a cellular network.

- Tracking a dynamic location of at least some of the plurality of mobile cellular devices from the estimated location of the one or more potential entrances based on a plurality of dynamic location events of the plurality of cellular events, the plurality of dynamic location events are arranged in a plurality of dynamic location time series each mapping a dynamic location of a respective one of the plurality of mobile cellular devices over time.

Identifying one or more common routes travelled by at least some of the plurality of mobile cellular devices.

Comparing between the one or more common routes and above-ground locomotion paths identified in a zone of the one or more common routes.

Determining the one or more common route is indicative of at least part of a path of one or more underground infrastructure responsive to identifying there is no above-ground locomotion route matching the respective one or more common routes.

- Outputting one or more map records updated to map the at least part of the path of the one or more underground infrastructures.

In a further implementation form of the first, and/or second aspects, the plurality of cellular events comprise a plurality of connection events, during each of the plurality of connection events one of the plurality of mobile cellular devices disconnects from or connects to the cellular network. The location of the one or more potential entrances is estimated based on the distribution of a plurality of locations of network disconnecting or network connecting mobile cellular devices of the plurality of mobile cellular devices during at least some of the plurality of connection events.

In an optional implementation form of the first, and/or second aspects, the location of the of one or more potential entrances is estimated based on one or more perimeter distribution of a plurality of locations of one or more of the plurality of mobile cellular devices which actively connects to or disconnects from the cellular network.

In a further implementation form of the first, and/or second aspects, the plurality of cellular events comprise a plurality of static location events, the plurality of static location events comprise one or more static location time series of static location events mapping a static location over time of respective one or more of the plurality of mobile cellular devices which are connected to the cellular network. The location of the one or more potential entrances is estimated based on a static location distribution of locations of the one or more mobile cellular devices during the one or more static location time series.

In an optional implementation form of the first, and/or second aspects, the location of the of one or more potential entrances is estimated based on the static locations distribution when the static location events of the one or more static location time series extend over a time period exceeding a certain threshold.

In an optional implementation form of the first, and/or second aspects, the static locations distribution is adjusted to discard one or more of the plurality of mobile cellular devices associated with one or more facilities located at the location mapped by the static locations distribution.

In an optional implementation form of the first, and/or second aspects, the one or more map records are updated to map the path of the one or more underground infrastructures by: Identifying a plurality of dynamic location events of the plurality of cellular events, the plurality of dynamic location events are arranged in a plurality' of dynamic location time series each mapping a dynamic location of one of the plurality of mobile cellular devices over time.

Tracking the dynamic location of the plurality of mobile cellular devices based on analysis of the plurality of dynamic location time series.

Identifying one or more common routes travelled by at least some of the plurality of mobile cellular devices.

Comparing between each of the one or more common routes and above- ground locomotion paths identified in a zone of the one or more common routes.

Estimating the one or more common routes are indicative of at least part of the path of the one or more underground infrastructures responsive to identifying there is no above-ground locomotion path matching the respective common route. in a further implementation form of the second aspect, the above-ground locomotion paths are identified based on analysis of map data descriptive of above- ground infrastructure and/or structure at the zone of the locations of the at least some mobile cellular devices during the corresponding dynamic location time series.

In an optional implementation form of the first, and/or second aspects, the one or more map records are updated to map an estimated path of one or more underground infrastructures by associating between a first potential entrance to the one or more underground infrastructures and one or more second potential entrances to the one or more underground infrastructures and estimating the path according to the estimated location of the first entrance and the estimated location of the one or more second entrances.

In a further implementation form of the first, and/or second aspects, the first potential entrance is associated with the one or more second potential entrances based on a plurality of disconnection events of the plurality of connection events identified at the first potential entrance in which one or more of the plurality of mobile cellular devices disconnects from the cellular network and corresponding succeeding reconnection events of the plurality of connection events identified at the one or more second potential entrances in which the same one or more mobile cellular devices reconnects to the cellular network.

In an optional implementation form of the first, and/or second aspects, the first potential entrance is associated with the one or more second potential entrances based on a time interval between each of the plurality of disconnection events and its respective corresponding succeeding reconnection event.

In an optional implementation form of the first, and/or second aspects, the path of one or more underground infrastructures is adjusted according to intermittent connection of the one or more mobile cellular device between a detected disconnection event and a corresponding reconnection event of the respective one or more mobile cellular device. The intermittent connection is indicative of the one or more mobile cellular devices potentially moving in the one or more underground infrastructures where connectivity to the cellular network is degraded.

In an optional implementation form of the first, and/or second aspects, the path of one or more underground infrastructures is adjusted according to a layout of one or more above-ground landmarks, infrastructures and/or structures.

In a further implementation form of the first, and/or second aspects, the updated map records are used to initiate one or more actions relating to the one or more potential entrances and/or to the one or more underground infrastructures.

In a further implementation form of the first, and/or second aspects, the one or more underground infrastructures are members of a group consisting of: an underground tunnel, a shaft, an underground hall, an underground structure, a borrow, an excavation, and/or a cave.

In a further implementation form of the first, and/or second aspects, the plurality of cellular events are identified based on analysis of one or more cellular activity records descriptive of connectivity of the plurality of mobile cellular devices to the cellular network, their location and a timing.

In an optional implementation form of the first, and/or second aspects, one or more machine learning models are applied to analyze one or more cellular activity records to identify at least some of the plurality of cellular events.

In an optional implementation form of the first, and/or second aspects, one or more machine learning models are applied to estimate the location of one or more potential entrances to one or more underground infrastructures and/or at least part of the path of one or more underground infrastructures according to the distribution of the locations of the at least some mobile cellular devices.

In a further implementation form of the first, and/or second aspects, the location of at each of the plurality of mobile cellular devices is identified based positioning information received from the respective mobile cellular device, and/or triangulation using position data received from a plurality of cellular base stations in relation to the respective mobile cellular device.

Other systems, methods, features, and advantages of the present disclosure will be or become apparent to one with skill in the art upon examination of the following drawings and detailed description. It is intended that all such additional systems, methods, features, and advantages be included within this description, be within the scope of the present disclosure, and be protected by the accompanying claims.

Unless otherwise defined, all technical and/or scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the invention pertains. Although methods and materials similar or equivalent to those described herein can be used in the practice or testing of embodiments of the invention, exemplary methods and/or materials are described below. In case of conflict, the patent specification, including definitions, will control. In addition, the materials, methods, and examples are illustrative only and are not intended to be necessarily limiting.

Implementation of the method and/or system of embodiments of the invention can involve performing or completing selected tasks automatically. Moreover, according to actual instrumentation and equipment of embodiments of the method and/or system of the invention, several selected tasks could be implemented by hardware, by software or by firmware or by a combination thereof using an operating system. ר For example, hardware for performing selected tasks according to embodiments of the invention could be implemented as a chip or a circuit. As software, selected tasks according to embodiments of the invention could be implemented as a plurality of software instructions being executed by a computer using any suitable operating system. In an exemplary embodiment of the invention, one or more tasks according to exemplary embodiments of methods and/or systems as described herein are performed by a data processor, such as a computing platform for executing a plurality of instructions. Optionally, the data processor includes a volatile memory for storing instructions and/or data and/or a non-volatile storage, for example, a magnetic hard-disk and/or removable media, for storing instructions and/or data. Optionally, a network connection is provided as well. A display and/or a user input device such as a keyboard or mouse are optionally provided as well.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS Some embodiments of the invention are herein described, by way of example only, with reference to the accompanying drawings. With specific reference now to the drawings in detail, it is stressed that the particulars are shown by way of example and for purposes of illustrative discussion of embodiments of the invention. In this regard, the description taken with the drawings makes apparent to those skilled in the art how embodiments of the invention may be practiced.

In the drawings: FIG. I is a flowchart of an exemplary process of mapping underground infrastructures based on cellular network connectivity, according to some embodiments of the present invention; FIG. 2 is a schematic illustration of an exemplary system for mapping underground infrastructures based on cellular network connectivity, according to some embodiments of the present invention; and FIG. 3 is a schematic illustration of an exemplary underground tunnel system; FIG. 4 is a schematic illustration of a distribution of cellular connection events mapped to locate potential entrances to an exemplary underground tunnel system, according to some embodiments of the present invention; FIG. 5 is a schematic illustration of a distribution of cellular connection events mapped to locate a perimeter of potential entrances to an exemplary underground tunnel system, according to some embodiments of the present invention; FIG. 6 is a schematic illustration of a distribution of cellular static location events mapped to locate potential entrances to an exemplary underground tunnel system, according to some embodiments of the present invention; FIG. 7 is a flowchart of an exemplary process of mapping a path of an exemplary underground tunnel system based on distribution of cellular dynamic location events, according to some embodiments of the present invention; FIG. 8 is a schematic illustration of a distribution of cellular dynamic location events mapped to estimate a path of an exemplary underground tunnel system, according to some embodiments of the present invention; and FIG. 9 is a flowchart of an exemplary process of mapping one or more entrances to an exemplary underground tunnel system and a path of the underground tunnel system based on distribution of cellular events, according to some embodiments of the present invention.

DETAILED DESCRIPTION The present invention, in some embodiments thereof, relates to mapping an underground infrastructure, and, more specifically, but not exclusively, to mapping an underground infrastructure including tunnels used for terror activities based on cellular network connectivity.

Underground infrastructures, for example, tunnels, shafts, underground halls, underground structures, borrows, excavations, caves, and/or the like may be typically artificial structures constructed and used for one or more uses, objectives, goals, and/or applications.

For example, one or more terrorist groups, such as, for example, Hamas, Hezbollah, Isis, Al-Qaeda, and/or the like may construct and use underground infrastructures for their terror activities since they may be highly difficult to locate, access, and/or destroy. Vietcong during the Vietnam war also used underground tunnels as defensive and offensive means against the US army. Such underground infrastructures may be typically constructed in areas controlled by terror organizations and/or areas bordering with sovereign state targeted by the terrorist groups. Such areas may include urban areas such as, for example, the Gaza strip, as well as country and/or rural areas such as, for example, south Lebanon.

In the Gaza strip for example, the Hamas built a massive underground system with estimated 500 kilometers of underground tunnels including logistic tunnels for moving troops, storing weapons and explosives, hosting command centers, dwelling and rest areas, hideouts, and/or the like. The complex underground system also includes attack tunnels and shafts from which terrorists may emerge to launch attacks on the approaching IDF. The Hamas also built penetrating attack tunnels which went under the Israeli border in attempt to launch fatal attacks on Israeli forces and civilians. However, in recent years Israel built a structural underground barrier against such penetrating tunnels and this capability of the Hamas is thought to be eliminated.

The Hamas built this massive underground system under significant urban and country areas of the Gaza strip and Gaza city for its malicious activities in order to prevent detection by surveillance and/or detection means (e.g., drones, cameras, satellite, etc.), espionage (spies, informants, etc.), and/or the like. These malicious activities may include, for example, stealth travelling in a certain area without being detected, attack tunnels for penetrating undetected under border lines and/or behind enemy lines which may be typically guarded by above-ground protection and/or detection means, for secret command posts, gathering, and/or hiding, for storage of means such as, weapons, explosives, food, water, fuel, and/or the like. In another example, hostages and/or kidnapped people may be hidden in the underground infrastructure.

Obviously detecting and mapping the layout of such secretive underground infrastructures, for example, entrances, path, halls, and/or the like may be a major challenge since they may be located in hostile areas which are not easily accessible and may be typically protected by armed terrorists, protection and/or surveillance measures and even laid with booby-traps, explosives, and/or the like.

According to some embodiments of the present invention, there are provided methods, systems, devices and computer program products for estimating the layout of underground infrastructures based on analysis of cellular activity of mobile cellular devices potentially used, carried, held, worn, and/or otherwise associated with people, for example, potential terrorists who go in and out and/or through the underground infrastructures.

One or more cellular activity records storing, logging, and/or documenting cellular activity of mobile cellular devices, for example, acellular phone, a smart watch, a wearable Internet of Things (I0T) device, and/or the like in an area suspected to host an underground infrastructure may be analyzed to identify a plurality of cellular events involving communication and/or dis-communication of the mobile cellular devices with one or more cellular networks.

Each such cellular event may associate a respective mobile cellular device with one or more connectivity attributes (e.g., connected or not, in communication or not, cellular protocol, etc.), a location of the mobile cellular device and a timing (e.g., timestamp).

The location of the mobile cellular devices during these cellular events may be analyzed to identify distribution of the cellular events, specifically to identify one or more distribution patterns which may be indicative of locations of potential entrances to the underground infrastructure, a path of the suspected underground infrastructure and/or part thereof, and/or the like.

For example, the cellular events may include connection events in which one of the mobile cellular devices connects to the cellular network or disconnects from it.

Based on analysis of the distribution of the locations of a plurality of connecting and/or disconnecting mobile cellular devices, one or more regions and/01 locations characterized by significant density of connection events may be identified. It may be estimated that potential entrances to the underground infrastructure may be found at, and/or adjacent to the dense distribution location since the connection events may be indicative of the mobile cellular devices going underground and/or emerging from underground where cellular connective is degraded and possible lost.

The cellular events may be further analyzed to identify one or more patterns reflecting possible field security warfare doctrines employed by the terrorists to prevent detection of the underground infrastructure, its layout and/or entrances. Such warfare doctrines may dictate, for example, active disconnection of the mobile cellular devices (e.g., turn OFF, shut down cellular link, etc.) at a certain distance prior to entering the underground infrastructure. In another example, the warfare doctrines may prevent taking the mobile cellular devices into the underground infrastructure.

Such warfare doctrines may yield distributions of cellular events that may be identified and used to estimate the location of one or more entrances to the underground infrastructure.

The cellular events may be also analyzed to identify dynamic location distribution patterns of a plurality of mobile cellular devices which do not match above- ground locomotion paths and may be therefore indicative of the path of one or more sections and/or segments of the underground infrastructure, in particular such sections which are relatively shallow and may not prevent cellular connectivity of underground mobile cellular devices to the cellular network. Such dynamic location distribution patterns may be identified based on analysis of dynamic location events of the dynamically moving mobile cellular devices.

Obviously, one or more of the above distribution analyses and estimations may be combined together, for example, identifying adjacent and/or close proximity locations of high density connection events and active connection events may be indicative of the location of one or more potential entrances where some of the users may actively disconnect or reconnect their mobile cellular devices before going or after emerging from the underground infrastructure. In another example, the path of one or more segments of the underground infrastructure may be estimated based on dynamic location events originating from and/or leading to a location of one or more potential entrances estimated based on connection events.

Optionally, machine learning may be applied to analyze the cellular activity data to identify at least some of the plurality of cellular events, specifically cellular events estimated to be valuable and contribute to detecting and/or estimating the location of one or more of the entrances to the underground infrastructure 202 and/or for estimating at least part of the path of the underground infrastructure 202. In another example, machine learning may be applied to identify one or more distribution patterns of the cellular events and estimate accordingly the location of one or more of the entrances to the underground infrastructure and/or at least part of the path of the u ndergro u nd i nfrastruc t u re.

Estimating and mapping layout of underground infrastructures based on cellular connectivity events of users going in, travelling through, and/or emerging from the underground infrastructures may present significant advantages and benefits compared to existing methods for mapping underground infrastructures.

First, estimating and mapping underground infrastructures based on analysis of cellular events identified for a plurality of mobile cellular devices associated with users who are going in and/or out of the underground infrastructures may significantly increase performance, for example, accuracy, reliability, and/or robustness of detection of underground infrastructures’ infrastructure layout and entrances since the analysis may encompass big data analysis comprising a large number of mobile cellular devices monitored and tracked over significant time periods.

Moreover, mapping the underground infrastructure and its entrances based on cellular activity eliminates the need to physically approach, access, and/or go down the underground infrastructure as may be done by the existing methods. This may significantly reduce resources, complexity, and/or costs entailed by such physical, in addition to eliminating the risk of such personnel and/or reconnaissance gear typically used to map such underground infrastructure which may be guarded and/or booby- trapped.

Furthermore, using machine learning trained to identify distribution patterns of the cellular events may further increase performance of detection and estimation of the location of entrances to the underground infrastructure and/or its layout and path.

In addition, the cellular connectivity data may be available in abundance either from providers of the cellular network service and/or from cellular communication in:erception and monitoring systems used by military forces in conflict zones where underground infrastructures may exists for electronic warfare as part of their combat against terrorist organizations. As such, there may be no need to develop, and/or deploy specific equipment for intercepting the cellular activity which may significantly reduce development, deployment, and/or maintenance costs, effort, and/or time.

Before explaining at least one embodiment of the invention in detail, it is to be understood that the invention is not necessarily limited in its application to the details of construction and the arrangement of the components and/or methods set forth in the following description and/or illustrated in the drawings and/or the Examples. The invention is capable of other embodiments or of being practiced or carried out in various ways.

As will be appreciated by one skilled in the art, aspects of the present invention may be embodied as a system, method or computer program product.

Accordingly, aspects of the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.) or an embodiment combining software and hardware aspects that may all generally be referred to herein as a "circuit," "module" or "system." Furthermore, aspects of the present invention may take the form of a computer program product embodied in one or more computer readable medium(s) having computer readable program code embodied thereon.

Any combination of one or more computer readable medium(s) may be utilized. The computer readable storage medium can be a tangible device that can retain and store instructions for use by an instruction execution device. The computer readable storage medium may be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non- exhaustive list of more specific examples of the computer readable storage medium includes the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as punch-cards or raised structures in a groove having instructions recorded thereon, and any suitable combination of the foregoing. A computer readable storage medium, as used herein, is not to be construed as being transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission media (e.g., light pulses passing through a fiber-optic cable), or electrical signals transmitted through a wire.

Computer program code comprising computer readable program instructions embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wire line, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

The computer readable program instructions described herein can be downloaded to respective computing/processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and/or a wireless network. The network may comprise copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and/or edge servers. A network adapter card or network interface in each computing/processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the respective computing/processing device.

The computer readable program instructions for carrying out operations of the present invention may be written in any combination of one or more programming languages, such as, for example, assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language such as Smalltalk. C++ or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages.

The computer readable program instructions may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGA), or programmable logic arrays (PLA) may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the present invention.

Aspects of the present invention are described herein with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer readable program instructions.

The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention.

In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of instructions, which comprises one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts or carry out combinations of special purpose hardware and computer instructions.

Referring now to the drawings, FIG. 1 is a flowchart of an exemplary process of mapping underground infrastructures based on cellular network connectivity, according to some embodiments of the present invention.

An exemplary process 100 may be executed to estimate locations of potential entrances and/or exits, collectively designated entrances herein, to underground infrastructures. The process 100 may be also executed to estimate and/or identify a path of one or more underground infrastructures and/or part thereof.

In particular, the entrances’ locating and/or the path of the underground infrastructure may be estimated based on distribution of a plurality of cellular events involving cellular mobile devices used by users entering, exiting, and/or moving through the underground infrastructure.

Reference is also made to FIG. 2, which is a schematic illustration of an exemplary system for mapping underground infrastructures based on cellular network connectivity, according to some embodiments of the present invention.

An exemplary underground infrastructure (UG-INF) detection system 2 may be adapt execute a process such as the process 100 for estimating location of potential entrances to one or more underground infrastructures 202 and/or at least part of a path of one or more of the underground infrastructures 202.

The underground infrastructures 202, for example, an underground tunnel, a shaft, an underground hall, an underground structure, a borrow, an excavation, a cave, and/or the like may be typically an artificial structure constructed for one or more uses, goals, and/or applications.

The UG-INF detection system 200 may estimate the location of the entrances to the underground infrastructures 202 and/or their path by analyzing a plurality of cellular events involving communication and/or dis-communication of a plurality of mobile cellular devices 204 with one or more cellular networks.

Reference is now made to FIG. 3, which is a schematic illustration of an exemplary underground tunnel system. An exemplary underground tunnel system 202A such as the underground infrastructure 202, for example, a terror related underground tunnel system constructed in an urban area and/or an open area for terrorist activities, may comprise a plurality of entrances (entrances/exists) 302, a plurality of tunnel segments 304 and one or more underground halls 306 used for gathering, storage, dwelling, lodging, and/or the like. The entrances 302 which may comprise stairways and/or laddered shafts may be typically located out of plain site, for example, in structures, in buildings, connected to underground cellars, under bush or vegetation, and/or the like.

The mobile cellular devices 204, for example, a cellular phone, a cellular tablet, a cellular wearable and/or carry-able device (e.g., smart watch, goggles, loT device, etc.) and/or the like may be carried, and/or worn by the users 206, and/or otherwise attached to the users 206.

One or more of the cellular networks may be served via one or more cellular base stations (also known as cells, cell towers, etc.) which are deployed to provide cellular network connectivity and services to mobile cellular devices 204 located within their cellular coverage area. Optionally, one or more of the cellular networks may be served via one or more satellite systems comprising satellites orbiting and/or stationary in space around earth.

The UG-INF detection system 200, for example, a server, a computing node, a cluster of computing nodes and/or the like may include an Input/Output interface 210, a processor(s) 212, and a storage 214 for storing data and/or code (program store).

The I/O interface 210 may comprise, for example, one or more wired and/or wireless interfaces, ports, and/or links, implemented in hardware, software, and/or PATENT OFFTCFb K A 1. L ? ד ד ~ combination thereof, for connecting to one or more wired and/or wireless networks, for example, a Local Area Network (LAN), a Wireless LAN (WLAN, e.g., Wi-Fi), a Wide Area Network (WAN), a Municipal Area Network (MAN), a cellular network, the internet, and/or the like. In another example, the I/O interface 210 may further include one or more wired and/or wireless I/O interfaces, ports and/or interconnections, for example, a Universal Serial Bus (USB) port, a serial port, a Bluetooth (BT) interface, a Radio Frequency (RF) interface, Wireless Local Area Network (WLAN), and/or the like.

Via the I/O interface 210, the UG-INF detection system 200 may communicate with one or more remote network resources, for example, a remote server, a storage server, a cloud service, and/or the like. Via the I/O interface 210, the UG-INF detection system 200 may connect to one or more external and/or attachable devices, for example, an attachable storage media (e.g., memory stick, etc.), a nearby device (e.g., mobile device, etc.), and/or the like.

For example, via the I/O interface 210, the UG-INF detection system 200 may access one or more cellular activity records 230 descriptive of connectivity of the plurality of mobile cellular devices 204 to one or more cellular networks. For example, the UG-INF detection system 200 may communicate, via one or more networks, with one or more remote network resources to receive one or more cellular activity records 230. In another example, the UG-INF detection system 200 may access, via one or more networks, one or more remote network resources, for example, a database, and/or the like storing one or more cellular activity records 230. In another example, the UG-INF detection system 200 may fetch one or more cellular activity records 230 from one or more external and/or attachable devices.

The cellular activity records 230 descriptive of connectivity of the plurality of mobile cellular devices 204 to one or more cellular networks may describe one or more connectivity attributes relating to connection of each mobile cellular device 2 to the cellular network(s). The connectivity attributes relating to each mobile cellular device 204 may identify the respective mobile cellular device 204 by its unique identifier (ID), for example, a phone number, a Mobile Subscriber Integrated Services Digital Network Number (MSISDN), and/or the like.

The connectivity attributes may include, for example, connection or disconnection state, communication or dis-communication state, connection quality, connection protocol (e.g., 3G, 4G, 5G, etc.), a connection stability (e.g., signal strength, etc.). and/or the like. The connectivity attributes logged in the cellular activity record(s) 230 may further include a location and a timing of each of the mobile cellular devices 204, i.e., the location of each mobile cellular device 204 at a given time. As such, the location of each mobile cellular device 204, for example, a position, an elevation, a depth, and/or the like may be associated with a respective timestamp expressed in absolute timing (e.g., time of day, date, etc.), and/or relative timing (e.g., timer, counter, etc.) with respect to some known reference base time.

The location of each of the plurality of mobile cellular devices 204 may be identified using one or more methods, techniques, and/or algorithms. For example, the location of one or more of the mobile cellular devices 204 may be identified and/or defined based on positioning information received from the respective mobile cellular device 204. The position data may be received and/or derived from one or more positioning sensors, devices, and/or applications of the respective mobile cellular device 204, for example, a Global Positioning System (GPS) sensor, a mobile navigation app, and/or the like. In another example, the location of one or more of the mobile cellular devices 204 may be identified and/or defined based on triangulation using position data received from a plurality of cellular base stations of the cellular network in relation to the respective mobile cellular device 204. Triangulation methods and algorithms for computing the location of mobile cellular device 204 is well known in the art and is beyond the scope of this disclosure.

The cellular activity data logged in the cellular activity record(s) 230 may be collected from one or more providers, operators and/or deployer of the cellular network(s) which may monitor the cellular activity of the mobile cellular device 2 with their cellular base stations. However, one or more cellular activity record(s) 2 may log cellular activity of the mobile cellular device 204 captured by one or more cellular communication interception systems, for example, a cellular signals interception system adapted to intercept, monitor, and/or track cellular connections to extract at least some of the connectivity relating to at least some of the connections of the mobile cellular device 204 with the cellular network(s). For clarity and brevity, such cellular communication interception systems, which may be military systems, are considered equivalent to cellular base stations and may yield similar cellular activity data and connectivity attributes.

The processor(s) 212, homogenous or heterogeneous, may include one or more processing nodes arranged for parallel processing, as clusters and/or as one or more multi core processor(s).

The storage 214 may include one or more non-transitory memory devices, for example, persistent devices such as, for example, a ROM. a Flash array, a hard drive, an SSD, a magnetic disk and/or the like, and/or volatile devices such as, for example, a RAM device, a cache memory and/or the like. The storage 214 may further comprise one or more local and/or remote network storage resources, for example, a storage server, a Network Attached Storage (NAS), a network drive, a cloud storage service and/or the like accessible via the I/O interface 210.

The processor(s) 212 may execute one or more software modules, for example, a process, a script, an application, an agent, a utility, a tool, an Operating System (OS), a service, a plug-in. an add-on. and/or the like each comprising a plurality of program instructions stored in a non-transitory medium (program store) such as the storage 214 and executed by one or more processors such as the processor(s) 212.

Optionally, the processor(s) 212 further include, utilize and/or apply one or more hardware elements available to the UG-INF detection system 200, for example, a circuit, a component, an Integrated Circuit (IC), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA), a Digital Signals Processor (DSP), a Graphic Processing Unit iGPU), an Artificial Intelligence (AI) accelerator, and/or the like.

The processor(s) 212 may therefore execute one or more functional modules utilized by one or more software modules, one or more of the hardware modules and/or a combination thereof. For example, the processor(s) 212 may execute a UG-INF detection engine 220 adapted for executing the process 100.

Via the I/O interface 210, the UG-INF detection system 200, specifically the UG-INF detection engine 220 may output one or more map records 232, for example, a map, a topographic map, a terrain map, an urban area layout drawing, a photograph, a ground level photograph, an aerial photograph, a satellite photograph, an orthophoto, a three dimensional (3D) image and/or model, and/or the like updated to map one or more potential entrances estimated by the UG-INF detection engine 220 to lead to the underground infrastructure 202 and/or a path of the underground infrastructure 2 and/or part thereof estimated by the UG-INF detection engine 220.

Optionally, the UG-INF detection system 200, specifically, the UG-INF detection engine 220 may be utilized by one or more cloud computing services, platforms and/or infrastructures such as, for example, Infrastructure as a Service (laaS), Platform as a Service (PaaS), Software as a Service (SaaS) and/or the like provided by one or more vendors, for example, Google Cloud Platform (GCP), Microsoft Azure, Amazon Web Service (AWS) and Elastic Compute Cloud (EC2), IBM Cloud, and/or the like. These cloud computing services may be adapted to receive one or more of the cellular activity record(s) 230, and output one or more updated map records updated to map the potential entrances to the underground infrastructure 202 and/or an estimated path of the underground infrastructure 202 and/or part thereof.

For brevity, the process 100 and the system 200 are described with respect to a single underground infrastructure system 202. This, however, should not be construed as limiting since the process 100 may be repeated, duplicated, and/or scaled for estimating location of potential entrances to a plurality of underground infrastructure systems such as the underground infrastructure system 202 and/or for estimating their path based on distribution of locations of a plurality of mobile cellular devices 2 during a plurality of cellular events.

Also for brevity, the process 100 is described with respect to a single cellular network. This should not be construed as limiting, since the process 100 may be scaled for identifying a plurality of cellular events involving communication and/or dis- communication of the mobile cellular devices 204 with a plurality of cellular networks.

As shown at 102, the process 100 starts with the UG-INF detection engine 220 analyzing one or more cellular activity records 230 logging cellular activity of a plurality of mobile cellular devices 204, in particular, mobile cellular devices 2 located in an area, zone, and/or site in which there are suspected to an underground infrastructure 202.

As shown at 104, based on the analysis of the cellular activity record(s) 230, the UG-INF detection engine 220 may identify a plurality of cellular events.

Each of the plurality of cellular events involves communication and/or dis- communication of one of the plurality of mobile cellular devices 204 with a cellular network. Each cellular event may relate to one of the plurality of mobile cellular devices 204, i.e., each cellular event may describe communication of one of the mobile cellular devices 204 with the cellular network.

Each cellular event relating to a respective mobile cellular device 204 may be defined by a respective unique combination of connectivity attributes of the respective mobile cellular device 204. First, each of cellular event may include an ID associating the respective cellular event with the respective mobile cellular device 204. Moreover, each of the cellular events may be associated with a different timing attribute, i.e., a unique timestamp. In addition, while each of the cellular events relating to each mobile cellular device 204 may have a different timestamp, one or more of the other connectivity attributes of the cellular events relating to one or more of the mobile cellular devices 204 may change, for example, a connectivity state, a communication state, a location, and/or the like.

As shown at 106, the UG-INF detection engine 220 may determine, compute, and/or otherwise identify a plurality of locations of at least some of the plurality of mobile cellular devices 204 during at least some of their related cellular events.

As described herein before, the location of one or more of the mobile cellular devices 204 may be determined based on positioning information received from the respective mobile cellular device 204, and/or based on triangulation of the respective mobile cellular device 204 using multiple cellular base stations in communication with the respective mobile cellular device 204. The location of the mobile cellular devices 204 during each cellular event associated with a respective timestamp may be directly extracted from the cellular activity record(s) 230, and/or identified using one or more of the cellular communication interception systems.

As shown at 108, the UG-INF detection engine 220 may compute a distribution of the plurality of locations of at least some of the mobile cellular devices 204 during at least some of their related cellular events.

While the distribution relates to the locations of mobile cellular devices 2 during cellular events, for brevity the distribution is interchangeably described to relate to the cellular events themselves.

As shown at 110, based on analysis of the distribution, the UG-INF detection engine 220 may identify one or more distribution patterns and estimate accordingly the location of one or more potential entrances to the underground infrastructure 202 and/or estimate a path of the underground infrastructure 202 and/or part thereof.

In particular, the UG-INF detection engine 220 may track the distribution of the cellular events over time, for example, days, weeks, months, and/or the like to identify one or more distribution patterns and estimate the entrances' location and/or the path of the underground infrastructure 202 and/or part thereof.

For example, the plurality of cellular events may comprise a plurality of connection events. During each of the connection events one of the plurality of mobile cellular devices 204 disconnects from the cellular network or connects to the cellular network.

Since cellular network connectivity may significantly degrade and typically lost underground, disconnecting mobile cellular devices 204 which disconnect from the cellular network may be indicative that their associated users 206 are going underground, i.e., into the underground infrastructure 202. Complementary, reconnecting mobile cellular devices 204 which connect to the cellular network may be indicative that their associated users 206 are emerging from underground to the surface, i.e., coming out of the underground infrastructure 202.

Therefore, based on distribution of the locations of a plurality of network disconnecting mobile cellular devices 204 and/or network connecting (reconnecting) mobile cellular devices 204. the UG-INF detection engine 220 may estimate the location of one or more potential entrances to the underground infrastructure 202.

Reference is now made to FIG. 4, which is a schematic illustration of a distribution of cellular connection events mapped to locate potential entrances to an exemplary underground tunnel system, according to some embodiments of the present invention.

A UG-INF detection engine such as the UG-INF detection engine 220 may map the distribution of a plurality of connection events involving communication and/or dis-communication of a plurality of mobile cellular devices such as the mobile cellular devices 204 with a cellular network in a certain area in which an underground infrastructure such as the underground infrastructure 202, for example, an underground tunnel system such as the underground tunnel system 202A is suspected to exist.

As seen, based on analysis of the distribution of the locations of network disconnecting and/or network connecting (reconnecting) mobile cellular devices 204, the UG-INF detection engine 220 may identify one or more locations 402 where the distribution of connection events is significantly dense meaning that many mobile cellular devices 204 connected and/or disconnected to/from the cellular network at the locations 402.

While highly common when going into or emerging from underground infrastructures, connection events, in particular, connection events which are not actively conducted by users such as the users 206 to connect or disconnect their mobile cellular devices 204 to/from the cellular network are typically rare and may be randomly distributed. Such sporadic connection events may be seen at several locations throughout the certain area.

Therefore, based on the distribution, the UG-INF detection engine 220 may estimate that one or more of the densely distributed locations 402 is not random and may be thus highly indicative of a location of one or more potential entrances 302 to the underground tunnel system 202A.

However, in order to safeguard the locations of the entrances 302 to the underground tunnel system 202A and prevent their detection based on cellular connectivity of their mobile cellular devices 204, the users 306, specifically the terrorists may employ one or more field security warfare doctrines with respect to their mobile cellular devices 204.

A first exemplary warfare doctrine may dictate that at least some of the terrorists 306 must actively disconnect their mobile cellular devices 204 from the cellular network, for example, turn the mobile cellular devices 204 OFF, at a certain distance from an entrance 302 before entering it, for example. 30 meters, 50 meters, 100 meters, and/or the like. Complementary, this first warfare doctrine may dictate that after emerging from the underground tunnel system 202A via an entrance 302, these terrorists 306 may actively reconnect their mobile cellular devices 204 to the cellular network only after distancing a certain distance from the entrance 302 through which they emerged.

The UG-INF detection engine 220 may be therefore adapted to analyze the distribution of connection events to identify one or more perimeter distributions in which a plurality of connection events are distributed at a certain distance from an estimated location of one or more entrances 302 to the underground tunnel system 202A.

Reference is now made to FIG. 5, which is a schematic illustration of a distribution of cellular connection events mapped to locate a perimeter of potential entrances to an exemplary underground tunnel system, according to some embodiments of the present invention.

As seen, the UG-INF detection engine 220 may map the distribution of a plurality of connection events involving communication and/or dis-communication of at least some of the mobile cellular devices 204 with a cellular network in the certain area. Based on the distribution, the UG-INF detection engine 220 identify one or more distribution patterns, for example, perimeter distributions 502 where one or more regions of densely distributed connection events are located at a certain distances from a point which the UG-INF detection engine 220 may estimate to be the location of one or more potential entrance 302.

Moreover, the UG-INF detection engine 220 may derive one or more directives and/or characteristics of the distant active disconnect/connect warfare doctrine which are apparent at one or more perimeter distributions 502 and project and/or apply these directives on one or more other perimeter distributions 502 to estimate the location of the entrance 302 based on the other perimeter distributions 502.

For example, as seen, the pattern of perimeter distributions 502( 1) and 502(2) includes multiple regions of densely distributed connection events, specifically four.

As seen, these regions are located at significantly similar distances (radius) from an imaginary center point. The UG-INF detection engine 220 may therefore estimate that the center point is a location of a potential entrance 302.

However, the UG-INF detection engine 220 may further determine the distance (radius) from the center point estimated as the location of potential entrances 302, for example, 30 meters, 50 meters, etc. The UG-INF detection engine 220 may determine the distance from the densely distributed regions of the perimeter distributions 502( I) and 502(2) to their respective center points, for example, 50 meters.

The UG-INF detection engine 220 may therefore assume that the distant active disconnect/connect warfare doctrine dictates that at least some of the terrorists 206 actively disconnect their mobile cellular devices 204 50 meters away from the entrance 302 before entering the underground infrastructure 202A and/or actively reconnect their mobile cellular devices 204 30 meters only after moving 50 meters away from the entrance 302 after emerging from the underground infrastructure 202A.

The UG-INF detection engine 220 may then project this directive to one or more other perimeter distributions 502, for example, perimeter distributions 502(3) where only a single region of densely distributed connection events is identified and a respective center point is therefore impossible to identify thus making it highly difficult to estimate the location of a respective potential entrance 302.

However, since the UG-INF detection engine 220 determined that the location of a potential entrance 302 may be located 50 meters from the single region of densely distributed connection events of the distribution 502(3). The UG-INF detection engine 220 may then apply one or more methods to estimate a location which is meters away from the single region of densely distributed connection of distribution 502(3).

For example, the UG-INF detection engine 220 may analyze the layout of above-ground structures, infrastructure, and/or landscape to identify one or more features that may indicate, suggest, and/or hint where the location of the potential entrance 302 may be, for example, locomotion paths, access ways and/or the like. For example, assuming the area around the distribution 502(3) is an urban area where there is only a single access way to move from the single region of densely distributed connection events, the UG-INF detection engine 220 may estimate that a potential entrance 302 may be located 50 meters away from the single dense distribution region in the direction of the single access way.

In another example, since the mobile cellular devices 204 of one or more of the terrorists 206 may be tracked prior to their active disconnection, i.e., before the terrorist 206 ar/ive at the single dense distribution region of the distribution 502(3), the UG-INF detection engine 220 may estimate the direction from where the terrorist 2 arrived. The UG-INF detection engine 220 may therefore draw an imaginary substantially straight line continuing the arrival direction of the terrorists 206 and estimate a potential entrance 302 may be located 50 meters away from the single dense distribution region along the imaginary line.

A second exemplary warfare doctrine may dictate that at least some of the terrorists 306 are prohibited from bringing their mobile cellular devices 204 into the underground tunnel system 202A and must leave them outside. As such, when arriving at the location of an entrance 302, these terrorists 306 may store their mobile cellular devices 204 in a storage place outside the entrance 302 (e.g., cabinet, etc.), leave them to charge, and/or the like. This means that these mobile cellular devices 204 may be static for significant period of times while turned ON and connected to the cellular network.

The UG-INF detection engine 220 may be therefore adapted to analyze the cellular event to identify distribution static location events of the cellular events which map static locations over time of one or more of the plurality of mobile cellular devices 204. Based on analysis of the distribution of static location events, the UG-INF detection engine 220 may identify one or more distribution patterns relating to static location events, for example, one or more regions in which there are a plurality of static location events of multiple mobile cellular devices 204. The UG-INF detection engine 220 may further estimate that one or more of these dense distribution regions may be indicative of a storage place of terrorists 306 employing the second warfare doctrine and may estimate that one or more potential entrances 302 may be located adjacent and/or in close proximity to the detected dense distribution regions.

Reference is now made to FIG. 6, which is a schematic illustration of a distribution of cellular static location events mapped to locate potential entrances to an exemplary underground tunnel system, according to some embodiments of the present invention.

As seen, the UG-INF detection engine 220 may identify a plurality of static location events out of the plurality of cellular events. The static location events relate to at least some of the mobile cellular devices 204 which are connected to the cellular network and located at one or more static locations for certain periods of time.

Based on distribution of the locations of the static location events, specifically • distribution over time, the UG-INF detection engine 220 may identify one or more static location time series of static location events. Each static location time series may map a static location over time of one of the plurality of mobile cellular devices 204 while connected to the cellular network.

Based on a static location distribution of locations of one or more mobile cellular devices 204 during respective static location time series, the UG-INF detection engine 220 may identify one or more distribution patterns, for example, static location distributions 602 comprising regions of densely distributed static location events. The UG-INF detection engine 220, aware of the second warfare doctrine, may therefore estimate that the static location distributions 602 may be indicative of an adjacent and/or close-by potential entrance 302.

Moreover, the UG-INF detection engine 220 may determine that the static location distributions 602 may be indicative of potential entrance(s) 302 when the static location events of the each static location time series extend over a time period exceeding a certain threshold, for example, three hours, six hours, eight hours, and/or the like.

Optionally, the UG-INF detection engine 220 may adjust the static locations distribution to discard one or more static location time series, and/or one of more of the mobile cellular devices 204 which are estimated not to be associated with users 2 going in and out of the underground tunnel system 202A. For example, based on the distribution of cellular events, for example, static location events, the UG-INF detection engine 220 may identify one or more mobile cellular devices 204 which may be associated with one or more facilities, for example, a residential home, an office, a commercial facility (e.g., store, etc.), a factory and/or the like which is located at the location mapped by one or more of the static location distributions 602.

For example, assuming a certain mobile cellular device 204 is associated with static location distribution 602 where a carpenter shop is located. Further assuming the UG-INF detection engine 220 identifies, based on additional cellular events involving the certain mobile cellular device 204, that a user 206 associated with the certain mobile cellular device 204 typically arrives at the location of the static location distribution 602 at 9:00 in the morning and leaves at 17:00 in the evening. In such case, the UG- INF detection engine 220 may estimate that the user 206 associated with the certain mobile cellular device 204 is not related to the underground tunnel system 202A and may discard the certain mobile cellular device 204, its static location events and it static location time series.

According to some embodiments of the present invention, the UG-INF detection engine 220 may estimate and map the path of the underground infrastructure 202, for example, the underground tunnel system 202A and/or part thereof by tracking dynamic locations of a plurality of mobile cellular devices 204. This may be feasible and highly valuable for underground infrastructures 202 which are relatively shallow and do not prevent cellular connectivity at least in part of their segments, and/or sections.

Reference is now made to FIG. 7, which is a flowchart of an exemplary process of mapping a path of an exemplary underground tunnel system based on distribution of cellular dynamic location events, according to some embodiments of the present invention.

Reference is also made to FIG. 8. which is a schematic illustration of a distribution of cellular dynamic location events mapped to estimate a path of an exemplary underground tunnel system, according to some embodiments of the present invention.

A UG-INF detection engine such as the UG-INF detection engine 220 may execute an exemplary process 700 to estimate the path of at least part of an exemplary underground infrastructure such as the underground infrastructure 202, for example, the underground tunnel system 202A.

As shown at 702, a UG-INF detection engine such as the UG-INF detection engine 220 may analyze one or more cellular activity records such as the cellular activity record 230 to identify a plurality of cellular events involving communication and/or dis-communication between a plurality of mobile cellular devices such as the mobile cellular devices 204 and the cellular network(s).

As shown at 704, the UG-INF detection engine 220 may identify a plurality of dynamic location events of the plurality of cellular events relating to at least some of the plurality of the mobile cellular devices 204. The plurality of dynamic location events may be arranged in a plurality of dynamic location time series each mapping the dynamic location, i.e., movement, of one of the plurality of mobile cellular devices 2 over time. In other words, each dynamic location time series may describe a movement pattern, route, and/or the like of a mobile cellular device 204 dynamically moving and changing location over time.

The locations of the mobile cellular devices 204 may be identified as described herein before in step 106 of the process 100.

As shown at 706, based on analysis of at least some of the plurality of dynamic location time series, the UG-INF detection engine 220 may track the dynamic location of the respective mobile cellular devices 204 associated with the analyzed dynamic location time series and identify movement patterns, i.e., routes, of these mobile cellular devices 204.

As shown at 708, the UG-INF detection engine 220 may compare between the movement patterns and/or routes of these dynamic mobile cellular devices 204 to identify one or more common routes travelled by at least some of the plurality of dynamic mobile cellular devices 204.

For example, as seen in FIG. 8, based on analysis of the plurality of dynamic location time series identified for at least plurality of dynamic mobile cellular devices 204, the UG-INF detection engine 220 may identify one or more common routes 8 travelled by these dynamic mobile cellular devices 204, for example, common routes 802(1), 802(2). 802(3), 802(4), and 802(5).

As shown at 710, the UG-INF detection engine 220 may compare between each of the one or more common routes to respective one or more above-ground locomotion paths identified in the area, zone, and/or site of the respective common route, for example, a street, a road, a trail, a pathway, and/or the like. Such locomotion paths are designated 804 in FIG. 8.

The UG-INF detection engine 220 may identify and/or locate the above- ground locomotion paths based on analysis of map data comprising one or more map items, for example, a map, a topographic map, a ground level photograph, an aerial photograph, a satellite image, an orthophoto, and/or the like descriptive of above- ground infrastructure and/or structure at the zone where the dynamic locations of the mobile cellular devices 204 are detected during the corresponding dynamic location time series.

As shown at 712, which is a decision step, responsive to identifying that there is no above-ground locomotion paths which match the respective common route, the UG-INF detection engine 220 branch to 71 4. Otherwise, in case there are one or more above-ground locomotion paths which substantially match the respective common route, the UG-INF detection engine 220 may branch to 716.

For example, the UG-INF detection engine may determine that common routes 802(3), 802(4), and/or 802(5) do not match any above-ground locomotion paths 804 and may branch to 714. In another example, the UG-INF detection engine may determine that common routes 802(1), and/or 802(2) may substantially match above- ground locomotion paths 804 and may branch to 716.

As shown at 714, since a respective common route, for example, common routes 802(3), 802(4), and/or 802(5) do not match any above-ground locomotion path 804, the UG-INF detection engine 220 may estimate that the dynamic mobile cellular devices 204 sharing the respective common route are not travelling above ground but may be rather moving in the underground infrastructure 202 and/or part thereof, and the respective common route is therefore indicative of at least part of the path of the underground infrastructure 202.

A shown at 716, since the respective common route, for example, common routes 802( 1), and/or 802(2) substantially match one or more above-ground locomotion paths 804, the UG-INF detection engine 220 may be unable to determine and/or estimate whether the dynamic mobile cellular devices 204 sharing the respective common route are travelling through the above-ground locomotion path(s) or in an underground path which is substantially overlapping the above-ground locomotion paths 804. A such, the respective common route is not necessarily indicative of a path of the underground infrastructure 202 and/or part thereof and the UG-INF detection engine 220 is therefore unable to estimate with whether the respective common route follows the path of the underground infrastructure 202 or not.

Reference is made once again to FIG. 1.

As shown at 112, the UG-INF detection engine 220 may update one or more map records such as the map record 232 to map the estimated location of the one or more potential entrance(s) and/or the path of the underground infrastructure 202 and/or part thereof.

For example, the UG-INF detection engine 220 may mark the estimated location of one or more potential entrances on one or more of the map record(s) 232. In another example, UG-INF detection engine 220 may outline the estimated path of one or more segments of the underground infrastructure 202 on one or more of the map record(s) 232.

As shown at 114, the UG-INF detection engine 220 may output the updated map record(s) 232 which may be used by one or more systems, devices, platforms, and/or applications for one or more uses, applications, and/or objectives.

For example, the updated map record(s) 232 may be used to initiate one or more actions, operations, and/or activities relating to one or more of the potential entrances and/or to the underground infrastructure 202. Such actions, operations, and/or activities may include, for example, striking the potential entrances and/or the underground infrastructure 202, through an air strike, a ground strike, a naval strike and/or a combination thereof according to the updated map record(s) 232. In another example, the underground infrastructure 202 may be infiltrated for one or more objectives, for example, a reconnaissance mission, a search and destroy mission, and/or the like.

For example, the UG-INF detection engine 220 may transmit the updated map record(s) 232 over the network, via the I/O interface, to one or more remote systems, devices, and/or applications adapted to visualize, for example, display and/or render the updated map record(s) 232 including the estimated location of the location of the one or more potential entrance(s) and/or the path of the underground infrastructure 202. In another example, the UG-INF detection engine 220 may output the updated map record(s) 232 via the I/O interface for use by one or more navigation system of one or more combat vehicles, and/or weapon, for example, a missile, a rocket, an aircraft, and/or the like adapted to home on one or more potential entrance(s) and/or one or more segments of the underground infrastructure 202 according to the updated map record(s) 232.

Optionally, the UG-INF detection engine 220 may apply one or more Machine Learning (ML) models, for example, a neural network, a deep learning neural network (DNN), a classifier, a statistical classifier, a Support Vector Machine (SVM), and/or the like to analyze the cellular activity record(s) 230 to identify at least some of the plurality of cellular events. In particular, the ML models may be applied to identify cellular events which are estimated to be valuable and of significant contribution to detecting and/or estimating the location of one or more of the entrances to the underground infrastructure 202 and/or for estimating at least part of the path of the underground infrastructure 202.

Moreover, the UG-INF detection engine 220 may apply one or more ML models, for example, a neural network, a DNN, a classifier, a statistical classifier, an SVM, and/or the like to estimate the location of one or more of the entrances to the underground infrastructure 202 and/or to estimate at least part of the path of the underground infrastructure 202 according to the distribution of the locations of the at least some mobile cellular devices 204 during at least some of the cellular events.

In particular, the ML models may be trained to learn distribution patterns such as, for example, the distribution patterns 402, 502, 602, 802 and/or the like which may be indicative of entrances to the underground infrastructure 202 and/or of paths of segments of the underground infrastructure 202. The ML models may be further trained to estimate entrances’ location and/or the path of the underground infrastructure 202 according to the learned distribution patterns identified in cellular connectivity data, in particular based on big data analysis of large volumes of cellular activity data captured over time in one or more areas suspected to accommodate underground infrastructures According to some embodiments of the present invention, one or more of the embodiments described herein before may be combined to identify entrances to the underground infrastructure and/or the path of the underground infrastructure and/or part thereof.

For example, assuming a certain field security warfare doctrine dictates that some users 206, for example, low level terrorists must actively disconnect their mobile cellular devices 204 at a certain distance before arriving at an entrance to the underground infrastructure 202 while high ranking terrorist leaders may not be forced to do so and may go underground with their mobile cellular devices 204 turned ON and potentially connected to the cellular network. In such case, based on distribution of connection events relating to mobile cellular devices 204 associated with both low- level terrorists 206 and high ranking terrorists 306, the UG-INF detection engine 2 may identify one or more distribution patterns such as 402 traced to connection events of the high ranking terrorists’ 306 mobile cellular devices 204 as well as one or more distribution patterns such as 502 traced to connection events of the low level terrorists’ 306 mobile cellular devices 204. Based on the combination of these distribution patterns the UG-INF detection engine 220 may estimate the location of a potential entrance 302 with significantly improved performance, for example, accuracy, reliability, and/or the like.

In another example, assuming another field security warfare doctrine dictates that a first group of terrorists 206 must leave their mobile cellular devices 204 out of the underground infrastructure 202 while a second group of terrorists 206 may take their mobile cellular devices 204 underground with them. In such case, based on distribution of static location events relating to mobile cellular devices 204 associated with the first group of terrorists 206 and connection events relating to mobile cellular devices 204 associated with the second group of terrorists 206, the UG-INF detection engine 220 may identify one or more distribution patterns such as 602 traced to the static location events and one or more distribution patterns such as 402 traced to connection events of the connection events. Based on the combination of these distribution patterns the UG-INF detection engine 220 may estimate the location of a potential entrance 302 with significantly improved performance, for example, accuracy, reliability, and/or the like.

In another example, the UG-INF detection engine 220 may combine some of the embodiments to identify entrances such as the entrances 302 to an underground infrastructure 202 and at least part of a path of the underground infrastructure 202.

Reference is now made to FIG. 9, which is a flowchart of an exemplary process of mapping one or more entrances to an exemplary underground tunnel system and a path of the underground tunnel system based on distribution of cellular events, according to some embodiments of the present invention.

A UG-INF detection engine such as the UG-INF detection engine 220 may combine process 100 and/or part thereof with the process 700 to identify one or more potential entrances such as the entrances 302 to an underground infrastructure such as the underground infrastructure 202 and a path of the underground infrastructure 2 and/or part thereof, specifically a path leading to/from the estimated entrance(s) 302.

For brevity, the process 900 is described with respect to a single underground infrastructure system 202. This, however, should not be construed as limiting since the process 900 may be repeated, duplicated, and/or scaled for estimating location of potential entrances to a plurality of underground infrastructures such as the underground infrastructure system 202 and estimating their path.

As shown at 902, the UG-INF detection engine 220 may analyze one or more cellular activity 1 ecords such as the cellular activity record 230 to identify a plurality of cellular events involving communication and/or dis-communication between a plurality of mobile cellular devices such as the mobile cellular devices 204 in an area where an underground infrastructure 202 is suspected to exist.

As shown al 904, the UG-INF detection engine 220 may identify a plurality of cellular events of relating to at least some of the plurality of the mobile cellular devices 204.

As shown at 906, the UG-INF detection engine 220 may identify the locations of the at least some of the mobile cellular devices 204 during at least some of the mobile cellular devices 204 during at least some of the cellular events, for example, connection events, static location events, and/or dynamic location events.

The locations of the mobile cellular devices 204 may be identified as described herein before in step 106 of the process 100.

As shown at 908. the UG-INF detection engine 220 may estimate the location of one or more potential entrances such as the entrances 302 to the underground infrastructure 202, for example, the underground tunnel system 202A according to the distribution of the locations of at least some of the mobile cellular devices 304 during a plurality of cellular events.

In particular, the UG-INF detection engine 220 may estimate the location of the potential entrance(s) 302 based on one or more distribution patterns indicative of the location of the potential entrance(s) 302. These distribution patterns may include, for example, one or more distributions such as the distribution 402 of the locations of mobile cellular devices 204 during a plurality of connection events. In another example, the distribution patterns may one or more distributions such as the distribution 502 of the locations of mobile cellular devices 204 during a plurality of active connection events. In another example, the distribution patterns may one or more distributions such as the distribution 602 of the locations of mobile cellular devices 204 during a plurality of static location events.

As shown at 910, the UG-INF detection engine 220 may track dynamic locations of at least some of the plurality of mobile cellular devices 204 going from/to the estimated location of one or more of the potential entrance(s) 302.

In particular, the UG-INF detection engine 220 may track the dynamic locations of these mobile cellular devices 204 based on a plurality of dynamic location time series mapping the dynamic location of the mobile cellular devices 204 over time as described in step 706 of the process 700.

The UG-INF detection engine 220 may further compare between dynamic location time series relating to a plurality of mobile cellular devices 204 to identify one or more common routes travelled by at least some of the users 206 associated with these mobile cellular devices 204, as described in step 708 of the process 700, in particular common routes leading from and/or to the estimated location of one or more of the potential entrance(s) 302.

The UG-INF detection engine 220 may compare between each of the one or more common routes and above-ground locomotion paths identified in the zone of the respective common route as described in step 710 of the process 700. The UG-INF detection engine 220 may determine whether each identified common route is indicative of at least part of the path of the underground infrastructure 202, for example, the underground tunnel system 202A responsive to identifying there are no above- ground locomotion routes matching the respective common route as described in steps 112 and 714 of the process 700.

Based on one or more of the common routes of mobile cellular devices 2 estimated to be travelled underground, the UG-INF detection engine 220 may estimate and/or determine a path of the underground infrastructure 202 and/or pail thereof, specifically segments and/or sections of the underground infrastructure 202 leading to and/or from the estimated location of the potential entrance(s).

As shown at 912, the UG-INF detection engine 220 may update one or more map records such as the map record 232, as described in step 112 of the process 100.

As shown at 914, the UG-INF detection engine 220 may output the updated map record(s) 232, as described in step 114 of the process 100.

Optionally, the UG-INF detection engine 220 may update the map record(s) 232 to map an estimated path of at least part of the underground infrastructure 202 by associating between a first potential entrance to the underground infrastructure 202 and one or more second potential entrances to the underground infrastructure 202.

In particular, the UG-INF detection engine 220 may estimate the at least part of the underground infrastructure 202 by according to the estimated location of the first potential entrance and the estimated location of one or more of the second potential entrances. This estima ion is based on the fact that the underground infrastructure 2 connects between the first potential entrance and the second potential entrance(s) and its layout may be deduced and/or estimated based on the path between the locations of these entrances.

The UG-INF detection engine 220 may apply one or more methods, techniques, and/or algorithms for associating between the first potential entrance and the one or more second potential entrances to the underground infrastructure 202. For example, the UG-INF detection engine 220 may identify a plurality of disconnection events of the plurality of connection events at the estimated location of the first potential entrance in which one or more of the plurality of mobile cellular devices 204 disconnect from the cellular network. The UG-INF detection engine 220 may further identify a plurality of corresponding succeeding reconnection events of the same mobile cellular devices 204 at the location of one or more of the second potential entrances in which these mobile cellular devices 204 reconnect to the cellular network.

A disconnection event of a certain mobile cellular device 204 at one place, namely the location of the first potential entrance, followed by a succeeding reconnection event of the same mobile cellular device 204 at another location, namely the location of the second entrance, may be highly indicative that a user 206 associated with the certain mobile cellular device 204 has gone underground through the first potential entrance and emerged from the underground infrastructure 202 through the second potential entrance.

Based on such disconnection and succeeding reconnection event of a plurality of mobile cellular devices 204, the UG-INF detection engine 220 may therefore associated and/or correlate between one or more potential entrances to the underground infrastructure 202 and may optionally estimate a path of the underground infrastructure 202 and/or part thereof accordingly.

Optionally, the UG-INF detection engine 220 may associate between a first potential entrance and one or more second potential entrances subject to a time limit applied on the time that passes between the disconnection event and a corresponding succeeding reconnection event. This means, that the UG-INF detection engine 220 may associate the first potential entrance with a second potential entrance based on the time interval between each of the plurality of disconnection events and its respective corresponding succeeding reconnection event. For example, in case the time interval does not exceed a certain threshold, for example, 3 hours, 5 hours, etc., the UG-INF detection engine 220 may associate between the first potential entrance and the second potential entrance. However, in case the time interval exceeds the certain threshold, the UG-INF detection engine 220 may not associate between the first potential entrance and the second potential entrance.

Optionally, the UG-INF detection engine 220 may adjust the path of the underground infrastructure 202 according to intermittent connection of one or more mobile cellular devices 204 between a detected disconnection event and a corresponding succeeding reconnection event of the same mobile cellular device 204.

Since, based on the disconnection event and a corresponding succeeding reconnection event, the respective mobile cellular device 204 is estimated to move underground in the underground infrastructure 202, the intermittent connection of the respective mobile cellular device 204 between these two events may be further indicative that the respective mobile cellular device 204 is potentially moving in the underground infrastructure 202 where connectivity to the cellular network is degraded and potentially lost.

As such, the location of one or more intermittent connection events may be therefore mapped to be underground locations in the underground infrastructure 202, and the UG-INF detection engine 220 may therefore adjust accordingly the path of the underground infrastructure 202 according to locations of the intermittent connection events.

Optionally, the UG-INF detection engine 220 may adjust the path of the underground infrastructure 202 according to a layout of one or more above-ground landmarks, infrastructures, and/or structures. For example, assuming an estimated path of the underground infrastructure 202 goes through an area where there is a landmark barrier, for example, a well, a creek, a valley, a terrain drop, and/or the like, the UG- INF detection engine 220 may adjust the path of the underground infrastructure 202 to go around the blocking landmark. In another example, assuming an estimated path of the underground infrastructure 202 goes under a high rising building typically having a supporting structure buried deep in the ground, the UG-INF detection engine 220 may adjust the path of the underground infrastructure 202 to go around the estimated buried supporting structure.

The descriptions of the various embodiments of the present invention have been presented for purposes of illustration, but are not intended to be exhaustive or limited to the embodiments disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terminology used herein was chosen to best explain the principles of the embodiments, the practical application or technical improvement over technologies found in the marketplace, or to enable others of ordinary skill in the art to understand the embodiments disclosed herein.

It is expected that during the life of a patent maturing from this application many relevant systems, methods and computer programs will be developed and the scope of the terms cellular mobile devices and ML models are intended to include all such new technologies a priori.

As used herein the term "about" refers to ± 10 %.

The terms "comprises", "comprising", "includes", "including", "having" and their conjugates mean "including but not limited to". This term encompasses the terms "consisting of and "consisting essentially of.

The phrase "consisting essentially of means that the composition or method may include additional ingredients and/or steps, but only if the additional ingredients and/or steps do not materially alter the basic and novel characteristics of the claimed composition or method.

As used herein, the singular form "a", "an" and "the" include plural references unless the context clearly dictates otherwise. For example, the term "a compound" or "at least one compound" may include a plurality of compounds, including mixtures thereof.

The word "exemplary" is used herein to mean "serving as an example, an instance or an illustration". Any embodiment described as "exemplary" is not necessarily to be construed as preferred or advantageous over other embodiments and/or to exclude the incorporation of features from other embodiments.

The word "optionally" is used herein to mean "is provided in some embodiments and not provided in other embodiments". Any particular embodiment of the invention may include a plurality of "optional" features unless such features conflict.

Throughout this application, various embodiments of this invention may be presented in a range format. It should be understood that the description in range format is merely for convenience and brevity and should not be construed as an inflexible limitation on the scope of the invention. Accordingly, the description of a range should be considered to have specifically disclosed all the possible subranges as well as individual numerical values within that range. For example, description of a range such as from 1 to 6 should be considered to have specifically disclosed subranges such as from I to 3, from 1 to 4, from I to 5, from 2 to 4, from 2 to 6, from 3 to 6 etc., as well as individual numbers within that range, for example, 1, 2, 3, 4, 5, and 6. This applies regardless of the breadth of the range.

Whenever a numerical range is indicated herein, it is meant to include any cited numeral (fractional or integral) within the indicated range. The phrases "ranging/ranges between" a first indicate number and a second indicate number and "ranging/ranges from" a first indicate number "to" a second indicate number are used herein interchangeably and are meant to include the first and second indicated numbers and all the fractional and integral numerals there between.

It is appreciated that certain features of the invention, which are, for clarity, described in the context of separate embodiments, may also be provided in combination in a single embodiment. Conversely, various features of the invention, which are, for brevity, described in the context of a single embodiment, may also be provided separately or in any suitable sub-combination or as suitable in any other described embodiment of the invention. Certain features described in the context of various embodiments are not to be considered essential features of those embodiments, unless the embodiment is inoperative without those elements.

Although the invention has been described in conjunction with specific embodiments thereof, it is evident that many alternatives, modifications and variations will be apparent to those skilled in the art. Accordingly, it is intended to embrace all such alternatives, modifications and variations that fall within the spirit and broad scope of the appended claims.

It is the intent of the applicant(s) that all publications, patents and patent applications referred to in this specification are to be incorporated in their entirety by reference into the specification, as if each individual publication, patent or patent application was specifically and individually noted when referenced that it is to be incorporated herein by reference. In addition, citation or identification of any reference in this application shall not be construed as an admission that such reference is available as prior art to the present invention. To the extent that section headings are used, they should not be construed as necessarily limiting. In addition, any priority document(s) of this application is/are hereby incorporated herein by reference in its/their entirety.

Claims (20)

WHAT IS CLAIMED IS:

1. A method of mapping underground infrastructure based on cellular network connectivity, the method comprising: using at least one processor for: identifying a plurality of cellular events, each of the plurality of cellular events involves communication and/or dis-communication of one of a plurality of mobile cellular devices with a cellular network; identifying a plurality of locations of at least some of the plurality of mobile cellular devices during at least some of their related cellular events; estimating a location of at least one potential entrance to at least one underground infrastructure and/or a path of at least one underground infrastructure according to a distribution of the plurality of locations; and outputting at least one map record updated to map the location of the at least one potential entrance and/or the path of the at least one underground infrastructure.

2. The method of claim 1, wherein the plurality of cellular events comprise a plurality of connection events, during each of the plurality of connection events one of the plurality of mobile cellular devices disconnects from or connects to the cellular network, the location of the at least one potential entrance is estimated based on the distribution of a plurality of locations of network disconnecting or network connecting mobile cellular devices of the plurality of mobile cellular devices during at least some of the plurality of connection events.

3. The method of claim 2, further comprising estimating the location of the of at least one potential entrance based on at least one perimeter distribution of a plurality of locations of at least one of the plurality of mobile cellular devices which actively connects to or disconnects from the cellular network.

4. The method of claim 1, wherein the plurality of cellular events comprise a plurality of static location events, the plurality of static location events comprise at least one static location time series of static location events mapping a static location over time of at least one of the plurality of mobile cellular devices which is connected to the cellular network, the location of the at least one potential entrance is estimated based on a static location distribution of locations of the at least one mobile cellular device during the at least one static location time series.

5. The method of claim 4, further comprising estimating the location of the of at least one potential entrance based on the static locations distribution when the static location events of the at least one static location time series extend over a time period exceeding a certain threshold.

6. The method of claim 4, further comprising adjusting the static locations distribution to discard at least one of the plurality of mobile cellular devices associated with at least one facility located at the location mapped by the static locations distribution.

7. The method of any one of claims 1, 2 and/or 4, further comprising updating the at least one map record to map the path of the at least one underground infrastructure by: identifying a plurality of dynamic location events of the plurality of cellular events, the plurality of dynamic location events are arranged in a plurality of dynamic location time series each mapping a dynamic location of one of the plurality of mobile cellular devices over time, tracking the dynamic location of the plurality of mobile cellular devices based on analysis of the plurality of dynamic location time series, identifying at least one common route travelled by at least some of the plurality of mobile cellular devices, comparing between the at least one common route and above-ground locomotion paths identified in a zone of the at least one common route, and estimating the at least one common route is indicative of at least part of the path of the at least one underground infrastructure responsive to identifying there is no above-ground locomotion path matching the at least one common route.

8. The method of claim 7, wherein the above-ground locomotion paths are identified based on analysis of map data descriptive of above-ground infrastructure and/or structure at the zone of the locations of the at least some mobile cellular devices during the corresponding dynamic location time series.

9. The method of any one of claims 1,2 and/or 4, further comprising updating the at least one map record to map an estimated path of at least one underground infrastructure by associating between a first potential entrance to the at least one underground infrastructure and at least one second potential entrance to the at least one underground infrastructure and estimating the path according to the estimated location of the first entrance and the estimated location of the at least one second entrance.

10. The method of claim 9, wherein the first potential entrance is associated with the at least one second potential entrance based on a plurality of disconnection events of the plurality of connection events identified at the first potential entrance in which at least one of the plurality of mobile cellular devices disconnects from the cellular network and corresponding succeeding reconnection events of the plurality of connection events identified at the at least one second potential entrance in which the same at least one mobile cellular device reconnects to the cellular network.

11. The method of claim 10, further comprising associating the first potential entrance with the at least one second potential entrance based on a time interval between each of the plurality of disconnection events and its respective corresponding succeeding reconnection event.

12. The method of any of claims 1, 2, 5, further comprising adjusting the path of at least one underground infrastructure according to intermittent connection of the at least one mobile cellular device between a detected disconnection event and a corresponding reconnection event of the at least one mobile cellular device, the intermittent connection is indicative of the at least one mobile cellular device potentially moving in the at least one underground infrastructure where connectivity to the cellular network is degraded.

13. The method of any of claims 1, 2, 5, further comprising adjusting the path of at least one underground infrastructure according to a layout of at least one above- ground landmark, infrastructure and/or structure.

14. The method of claim 1, wherein the at least one updated map record is used to initiate at least one action relating to the at least one potential entrance and/or to the at least one underground infrastructure.

15. The method of claim 1, wherein the at least one underground infrastructure is a member of a group consisting of: an underground tunnel, a shaft, an underground hall, an underground structure, a borrow, an excavation, and a cave.

16. The method of claim I, wherein the plurality of cellular events are identified based on analysis of at least one cellular activity record descriptive of connectivity of the plurality of mobile cellular devices to the cellular network, their location and a timing.

17. The method of claim 16. further comprising applying at least one machine learning model to analyze at least one cellular activity record to identify at least some of the plurality of cellular events.

18. The method of claim 16, further comprising applying at least one machine learning model to estimate the location of at least one potential entrance to at least one underground infrastructure and/or a path of at least one underground infrastructure according to the distribution of the locations of the at least some mobile cellular devices.

19. The method of claim 1, wherein the location of at each of the plurality of mobile cellular devices is identified based on at least one of: positioning information received from the respective mobile cellular device, and triangulation using position data received from a plurality of cellular base stations in relation to the respective mobile cellular device.

20. A method of mapping underground infrastructure based on mobile cellular devices tracking, the method comprising: using at least one processor for: estimating a location of at least one potential entrance to at least one underground infrastructure according to a distribution of a plurality of locations of a plurality of mobile cellular devices during a plurality of connection events of a plurality of cellular events, during each of the plurality of connection events one of the plurality of mobile cellular devices disconnects from or connects to a cellular network; tracking a dynamic location of at least some of the plurality of mobile cellular devices from the estimated location of the at least one potential entrance based on a plurality of dynamic location events of the plurality of cellular events, the plurality of dynamic location events are arranged in a plurality of dynamic location time series each mapping a dynamic location of a respective one of the plurality of mobile cellular devices over time; identifying at least one common route travelled by at least some of the plurality of mobile cellular devices; comparing between the at least one common route and above-ground locomotion paths identified in a zone of the at least one common route; determining the at least one common route is indicative of at least part of a path of at least one underground infrastructure responsive to identifying there is no above-ground locomotion route matching the at least one common route; and outputting at least one map record updated to map the at least part of the path of the at least one underground infrastructure. Roy S. Melzer, Adv. Patent Attorney G.E. Ehrlich (1995) Ltd. 35 HaMasger Street Sky Tower, 13th Floor Tel Aviv 6721407