* The displacement mode of fraudulent SIMs is automated through SIM to module allocation and short base station movements. However, though costly, fraudsters might manually transport gateways by car or motorcycle, equipped with the necessary tools and internet connection, to achieve a more realistic trajectory.

* Lastly, fraudsters strive to ensure the "mobility uniqueness" of their fraudulent users' trajectories. They aim to reproduce the realistic pattern of predominantly individual movements instead of grouped ones, which are the default scenario with a SIMBox (being a box of SIMs). They achieve this by adjusting the number of SIM cards assigned to each SIMBox gateway; the higher the number, the more the SIMBox generates group mobility.

**(3) Social behavior.** Calls and text events are direct indicators of inter-user interactions and social dynamics. In particular, a user's contacts ($con_p$), the importance, and the direction (in/out) of his interactions with these contacts provide insights into his social behavior. These interactions, commonly represented as mobile call graphs in the literature [36], often encapsulate significant relationships, such as familial ties or connections within a friend group. In the context of SIMBox fraudulent SIMs, which frequently re-originate multiple calls with a diverse set of contacts, there is a notable absence of these meaningful relationships. Fraudsters employ a two-pronged approach to counteract this inherent pattern [14]:

* First, by handling incoming traffic routing, specific SIMBox users can be prioritized for terminating calls from international users based on the corresponding contact. This strategic control serves to limit fraudulent users' number of contacts.

* Fraudulent users leverage network activity generation functionalities, enabling them to exchange calls and text amongst themselves. This tactic simulates the appearance of close-knit groups, effectively mimicking genuine user relationships.

**(4) Device property.** The device property relates to the number of SIM cards a user's device operates with, typically limited to one or two for legitimate users. However, in the case of a SIMBox, designed to handle multiple SIM cards per GSM module, a single fraudulent device identifier ($dev_p$, i.e., IMEI code) may be associated with several SIM cards. Additionally, a SIM card connecting to multiple GSM modules accumulates multiple recorded device identifiers (IMEIs). To obfuscate this noticeable behavior, fraudsters have devised methods to simulate a distinct mobile device identifier for each fraudulent SIM card [15]. They achieve this by employing IMEI modification or spoofing that links the IMEI code to the SIM card rather than the GSM module. Therefore, fraudsters can automatically alter the IMEI code by specifying an IMEI generation rule and the corresponding new IMEI value(s).

# B FRAUDZEN DESCRIPTION

## B.1 The SimulationManager

Being event-driven, it chronologically executes timestamped events issued by simulation objects throughout the simulation time. An event execution runs a function into the related simulation object, which can schedule new events.

## B.2 The NetworkManager

This module is responsible for creating the cellular network infrastructure, the user devices, and the fraud architecture (cf. Fig. 2), all described in the following.

**Network infrastructure.** The mobile cellular network, as designed in FraudZen, is multi-operator. Each operator provides its subscribers with communication services through voice, text messages, and mobile data to or from external networks (i.e., local or international operators). Each operator's network architecture is based on the standards, comprising a Radio Access Network (RAN) and a core network. Each RAN's base station transmits service initiation requests to the core network and performs paging. The core network provides, in addition to network communication services, control operations, namely authentication and mobility management. It also continually records in a file timestamped network service usage events constituting each operator's CDRs.

**Network devices.** A network device is formed by adding a SIM to a cell phone. Such a partition between SIMs and user appliances allows for distinguishing legitimate devices from fraudulent ones, created in the SIMBox. Each legitimate device has a mobility component and a traffic component. The mobility component keeps up-to-date devices' connected base station by scheduling handovers, i.e., movements between the network cells, according to the chosen mobility model. Similarly, the traffic manager schedules each device's traffic generation according to the defined traffic model.

**SIMBox architecture.** From inputs such as the number of SIMBank, gateways, and SIM/GSM configuration groups, FraudZen builds a SIMBox architecture and related configuration units. The SIMBox operates with SIM cards provided by the simulation operators, from which it forms SIMBox SIM cards (i.e., SimbSIMCard). Each SimbSIMCard has a state (e.g., Free/Blocked) and a set of parameters related to its traffic (e.g., call count, total call duration), allowing the control of its activity. Each SIM and GSM group works according to a set of functionality configurations given by the SIMBox fraud model. Once, the SIMBox architecture is formed and configured, it continually receives, with a fixed frequency, international traffic to be routed as local calls to legitimate users.

## B.3 The TrafficManager

This module handles traffic generation for legitimate and fraudulent devices. For legitimate devices, traffic events are repeatedly generated according to the input traffic model. Each traffic event has the attributes: timestamp, event type (call, international call, text, or data), metric (i.e., call duration or data size), and contact in case of a call or text. FraudZen currently includes a trace-based traffic model, reading next events from an input file. Based on the returned event type, legitimate devices transmit a call/text/data service request to their connected base station. Fraudulent devices make use of these same requests to generate traffic; however, this is coordinated by SIMBox architecture's network activity generation and incoming traffic routing algorithms.

## B.4 The MobilityManager

It handles legitimate and fraudulent users cell-granularity displacements during the simulation. Legitimate users have a mobility attribute implementing the input specified mobility model. FraudZen
* The displacement mode of fraudulent SIMs is automated through SIM to module allocation and short base station movements. However, though costly, fraudsters might manually transport gateways by car or motorcycle, equipped with the necessary tools and internet connection, to achieve a more realistic trajectory.

* Lastly, fraudsters strive to ensure the "mobility uniqueness" of their fraudulent users' trajectories. They aim to reproduce the realistic pattern of predominantly individual movements instead of grouped ones, which are the default scenario with a SIMBox (being a box of SIMs). They achieve this by adjusting the number of SIM cards assigned to each SIMBox gateway; the higher the number, the more the SIMBox generates group mobility.

**(3) Social behavior.** Calls and text events are direct indicators of inter-user interactions and social dynamics. In particular, a user's contacts ($con_p$), the importance, and the direction (in/out) of his interactions with these contacts provide insights into his social behavior. These interactions, commonly represented as mobile call graphs in the literature [36], often encapsulate significant relationships, such as familial ties or connections within a friend group. In the context of SIMBox fraudulent SIMs, which frequently re-originate multiple calls with a diverse set of contacts, there is a notable absence of these meaningful relationships. Fraudsters employ a two-pronged approach to counteract this inherent pattern [14]:

* First, by handling incoming traffic routing, specific SIMBox users can be prioritized for terminating calls from international users based on the corresponding contact. This strategic control serves to limit fraudulent users' number of contacts.

* Fraudulent users leverage network activity generation functionalities, enabling them to exchange calls and text amongst themselves. This tactic simulates the appearance of close-knit groups, effectively mimicking genuine user relationships.

**(4) Device property.** The device property relates to the number of SIM cards a user's device operates with, typically limited to one or two for legitimate users. However, in the case of a SIMBox, designed to handle multiple SIM cards per GSM module, a single fraudulent device identifier ($dev_p$, i.e., IMEI code) may be associated with several SIM cards. Additionally, a SIM card connecting to multiple GSM modules accumulates multiple recorded device identifiers (IMEIs). To obfuscate this noticeable behavior, fraudsters have devised methods to simulate a distinct mobile device identifier for each fraudulent SIM card [15]. They achieve this by employing IMEI modification or spoofing that links the IMEI code to the SIM card rather than the GSM module. Therefore, fraudsters can automatically alter the IMEI code by specifying an IMEI generation rule and the corresponding new IMEI value(s).

# B FRAUDZEN DESCRIPTION

## B.1 The SimulationManager

Being event-driven, it chronologically executes timestamped events issued by simulation objects throughout the simulation time. An event execution runs a function into the related simulation object, which can schedule new events.

## B.2 The NetworkManager

This module is responsible for creating the cellular network infrastructure, the user devices, and the fraud architecture (cf. Fig. 2), all described in the following.

**Network infrastructure.** The mobile cellular network, as designed in FraudZen, is multi-operator. Each operator provides its subscribers with communication services through voice, text messages, and mobile data to or from external networks (i.e., local or international operators). Each operator's network architecture is based on the standards, comprising a Radio Access Network (RAN) and a core network. Each RAN's base station transmits service initiation requests to the core network and performs paging. The core network provides, in addition to network communication services, control operations, namely authentication and mobility management. It also continually records in a file timestamped network service usage events constituting each operator's CDRs.

**Network devices.** A network device is formed by adding a SIM to a cell phone. Such a partition between SIMs and user appliances allows for distinguishing legitimate devices from fraudulent ones, created in the SIMBox. Each legitimate device has a mobility component and a traffic component. The mobility component keeps up-to-date devices' connected base station by scheduling handovers, i.e., movements between the network cells, according to the chosen mobility model. Similarly, the traffic manager schedules each device's traffic generation according to the defined traffic model.

**SIMBox architecture.** From inputs such as the number of SIMBank, gateways, and SIM/GSM configuration groups, FraudZen builds a SIMBox architecture and related configuration units. The SIMBox operates with SIM cards provided by the simulation operators, from which it forms SIMBox SIM cards (i.e., SimbSIMCard). Each SimbSIMCard has a state (e.g., Free/Blocked) and a set of parameters related to its traffic (e.g., call count, total call duration), allowing the control of its activity. Each SIM and GSM group works according to a set of functionality configurations given by the SIMBox fraud model. Once, the SIMBox architecture is formed and configured, it continually receives, with a fixed frequency, international traffic to be routed as local calls to legitimate users.

## B.3 The TrafficManager

This module handles traffic generation for legitimate and fraudulent devices. For legitimate devices, traffic events are repeatedly generated according to the input traffic model. Each traffic event has the attributes: timestamp, event type (call, international call, text, or data), metric (i.e., call duration or data size), and contact in case of a call or text. FraudZen currently includes a trace-based traffic model, reading next events from an input file. Based on the returned event type, legitimate devices transmit a call/text/data service request to their connected base station. Fraudulent devices make use of these same requests to generate traffic; however, this is coordinated by SIMBox architecture's network activity generation and incoming traffic routing algorithms.

## B.4 The MobilityManager

It handles legitimate and fraudulent users cell-granularity displacements during the simulation. Legitimate users have a mobility attribute implementing the input specified mobility model. FraudZen
currently includes mobility models based on existing mobility traces, which can be easily extended. On the other hand, the mobility of a fraudulent device matches the movements of its belonging gateway.

Such movements are governed by a strategy defined at the level of the whole SIMBox architecture and given by the input SIMBox fraud model.
currently includes mobility models based on existing mobility traces, which can be easily extended. On the other hand, the mobility of a fraudulent device matches the movements of its belonging gateway.

Such movements are governed by a strategy defined at the level of the whole SIMBox architecture and given by the input SIMBox fraud model.