Applying Machine Learning on RSRP-based Features for False Base Station Detection

TL;DR

This paper explores machine learning techniques to detect false base stations in LTE networks using RSRP-based features, effectively reducing false negatives even when attackers use legitimate PCIs, demonstrated through simulation experiments.

Contribution

It introduces three novel ML features based on RSRP and cell locations, and evaluates multiple models to improve false base station detection accuracy.

Findings

High detection precision (75-95%) for false base stations.

Low false positive rate (0.5%) in detection.

ML models outperform traditional detection rules.

Abstract

False base stations -- IMSI catchers, Stingrays -- are devices that impersonate legitimate base stations, as a part of malicious activities like unauthorized surveillance or communication sabotage. Detecting them on the network side using 3GPP standardized measurement reports is a promising technique. While applying predetermined detection rules works well when an attacker operates a false base station with an illegitimate Physical Cell Identifiers (PCI), the detection will produce false negatives when a more resourceful attacker operates the false base station with one of the legitimate PCIs obtained by scanning the neighborhood first. In this paper, we show how Machine Learning (ML) can be applied to alleviate such false negatives. We demonstrate our approach by conducting experiments in a simulation setup using the ns-3 LTE module. We propose three robust ML features (COL, DIST, XY) based on Reference Signal Received Power (RSRP) contained in measurement reports and cell locations. We evaluate four ML models (Regression Clustering, Anomaly Detection Forest, Autoencoder, and RCGAN) and show that several of them have a high precision in detection even when the false base station is using a legitimate PCI. In our experiments with a layout of 12 cells, where one cell acts as a moving false cell, between 75-95\% of the false positions are detected by the best model at a cost of 0.5\% false positives.