Abstract:Fake base stations (FBSes) pose a significant security threat by impersonating legitimate base stations. Though efforts have been made to defeat this threat, up to this day, the presence of FBSes and the multi-step attacks (MSAs) stemming from them can lead to unauthorized surveillance, interception of sensitive information, and disruption of network services for legitimate users. Therefore, detecting these malicious entities is crucial to ensure the security and reliability of cellular networks. Traditional detection methods often rely on additional hardware, predefined rules, signal scanning, changing protocol specifications, or cryptographic mechanisms that have limitations and incur huge infrastructure costs in accurately identifying FBSes. In this paper, we develop FBSDetector-an effective and efficient detection solution that can reliably detect FBSes and MSAs from layer-3 network traces using machine learning (ML) at the user equipment (UE) side. To develop FBSDetector, we created FBSAD and MSAD, the first-ever high-quality and large-scale datasets for training machine learning models capable of detecting FBSes and MSAs. These datasets capture the network traces in different real-world cellular network scenarios (including mobility and different attacker capabilities) incorporating legitimate base stations and FBSes. The combined network trace has a volume of 6.6 GB containing 751963 packets. Our novel ML models, specially designed to detect FBSes and MSAs, can effectively detect FBSes with an accuracy of 92% and a false positive rate of 5.96% and recognize MSAs with an accuracy of 86% and a false positive rate of 7.82%. We deploy FBSDetector as a real-world solution to protect end-users through an Android app and validate in a controlled lab environment. Compared to the existing solutions that fail to detect FBSes, FBSDetector can detect FBSes in the wild in real time.

What problem does this paper attempt to address?

### What problems does this paper attempt to solve? This paper aims to solve **the detection problems of fake base stations (FBSes) and multi - step attacks (MSAs) in cellular networks**. Specifically: 1. **The threat of fake base stations**: - By disguising as legitimate base stations, fake base stations can lure devices to connect and carry out complex multi - step attacks, resulting in unauthorized surveillance, interception of sensitive information and interruption of network services for legitimate users. - Although many efforts have been made to deal with this threat, the existing methods rely on additional hardware, predefined rules, signal scanning, protocol specification changes or encryption mechanisms, and these methods have limitations and are costly. 2. **The deficiencies of existing detection methods**: - Existing detection methods usually rely on heuristic rules or signature matching and cannot adapt to evolving attack patterns. - Some solutions rely on crowdsourced data and are difficult to scale to systems protecting billions of devices. - Some detection schemes require the installation of expensive proprietary hardware. For example, CellDAM needs to place an auxiliary node near the user device to capture signaling messages, which is impractical in practical applications. - Solutions based on low - level protocols cannot effectively detect complex fake base stations and cannot identify multi - step attacks. 3. **Billions of unprotected devices**: - Currently, billions of devices worldwide are vulnerable to fake - base - station - based attacks, and future protocol defense mechanisms will take several years to be deployed. Therefore, these devices need to be secured through built - in solutions because replacing the devices is neither realistic nor too costly. 4. **Designing an efficient and low - cost solution**: - The paper proposes a machine - learning - based framework FBSDetector, which uses layer - 3 network traces on the user - device side to reliably detect fake base stations and multi - step attacks. - This framework does not require additional hardware or protocol modification and can run on devices to detect attacks in real - time. ### Main contributions: - **Creation of a high - quality large - scale dataset**: Developed FBSAD and MSAD, which are the first high - quality, large - scale datasets containing traces of fake base stations and multi - step attacks. - **Innovative machine - learning models**: Designed a Sequential - LSTM model for fake base - station detection, which significantly improves the detection accuracy and reduces the false - positive rate; at the same time, proposed a graph - learning - based method to detect multi - step attacks, which can identify complex and evolving attack patterns. - **Practical deployment and verification**: Deployed FBSDetector as an Android application and verified it in a laboratory environment, demonstrating its performance, memory and power consumption in real - world scenarios. In short, this paper is committed to developing an efficient, low - cost solution without additional hardware to deal with the threats of fake base stations and multi - step attacks to cellular network security.

FBSDetector: Fake Base Station and Multi Step Attack Detection in Cellular Networks using Machine Learning

FBS-Radar: Uncovering Fake Base Stations at Scale in the Wild

Fake Base Station Detection and Link Routing Defense

Seeing is Believing: A Federated Learning Based Prototype to Detect Wireless Injection Attacks

Murat: Multi-RAT False Base Station Detector

Lies in the Air: Characterizing Fake-base-station Spam Ecosystem in China

Lightweight Detection of On-Body Sensor Impersonator in Body Area Networks.

ADSBAN: Anomaly detection system for body area networks utilizing IoT and machine learning

FBSleuth

DT-DDNN: A Physical Layer Security Attack Detector in 5G RF Domain for CAVs

An Effective Intrusion Detection in Mobile Ad-hoc Network Using Deep Belief Networks and Long Short-Term Memory

Research on a New Proposed Fake Base Station Restraining Scheme based on Pseudo Signal

Machine-Learning-Enabled Intrusion Detection System for Cellular Connected UAV Networks

False Data Injection Attack Detection in Edge-based Smart Metering Networks with Federated Learning

Deep Learning-Based Approach for User Activity Detection with Grant-Free Random Access in Cell-Free Massive MIMO

Adaptive activation Functions with Deep Kronecker Neural Network optimized with Bear Smell Search Algorithm for preventing MANET Cyber security attacks

Precheck Sequence Based False Base Station Detection During Handover: A Physical Layer Security Scheme

Multi-stage Jamming Attacks Detection using Deep Learning Combined with Kernelized Support Vector Machine in 5G Cloud Radio Access Networks

GNSS Spoofing Detection and Mitigation With a Single 5G Base Station Aiding

Federated Learning for Zero-Day Attack Detection in 5G and Beyond V2X Networks

usfAD Based Effective Unknown Attack Detection Focused IDS Framework