Scalable and Robust Mobile Activity Fingerprinting via Over-the-Air Control Channel in 5G Networks

TL;DR

This paper presents a scalable, deep learning-based method for mobile activity fingerprinting over 5G control channels, demonstrating privacy vulnerabilities even with limited data and highlighting new attack possibilities.

Contribution

It introduces the first method for over-the-air mobile activity tracking using PDCCH messages and develops a deep learning approach that is scalable and effective despite data loss.

Findings

Less than 10% of PDCCH messages can be decoded

Mobile activity tracking is feasible with limited control channel data

Deep learning enables scalable traffic classification

Abstract

5G has undergone significant changes in its over-the-air control channel architecture compared to legacy networks, aimed at enhancing performance. These changes have unintentionally strengthened the security of control channels, reducing vulnerabilities in radio channels for attackers. However, based on our experimental results, less than 10% of Physical Downlink Control Channel (PDCCH) messages could be decoded using sniffers. We demonstrate that even with this limited data, cell scanning and targeted user mobile activity tracking are feasible. This privacy attack exposes the number of active communication channels and reveals the mobile applications and their usage time. We propose an efficient deep learning-based mobile traffic classification method that eliminates the need for manual feature extraction, enabling scalability across various applications while maintaining high performance even in scenarios with data loss. We evaluated the effectiveness of our approach using both an open-source testbed and a commercial 5G testbed, demonstrating the feasibility of mobile activity fingerprinting and targeted attacks. To the best of our knowledge, this is the first study to track mobile activity over-the-air using PDCCH messages.