# Fake Base Station Detection and Link Routing Defense +
###### Abstract  
Fake base stations comprise a critical security issue in mobile networking. A fake base station exploits vulnerabilities in the broadcast message announcing a base station's presence, which is called SIB1 in 4G LTE and 5G NR, to get user equipment to connect to the fake base station. Once connected, the fake base station can deprive the user of connectivity and access to the Internet/cloud. We discovered that a fake base station can disable the victim user equipment's connectivity for an indefinite period of time, which we validated using our threat prototype against current 4G/5G practices. We designed and built a defense scheme which detects and blacklists a fake base station and then, informed by the detection, avoids it through link routing for connectivity availability. For detection and blacklisting, our scheme uses the real-time information of both the time duration and the number of request transmissions, the features of which are directly impacted by the fake base station's threat and which have not been studied in previous research. Upon detection, our scheme takes an active measure called link routing, which is a novel concept in mobile/4G/5G networking, where the user equipment routes the connectivity request to another base station. To defend against a Sybil-capable fake base station, we use a history-reputation-based link routing scheme for routing and base station selection. We implemented both the base station and the user on software-defined radios using open-source 5G software (srsRAN v23.10 and Open5 GS v2.6.6) for validation. We varied the base station implementation to simulate legitimate vs. faulty but legitimate vs. fake and malicious base stations, where a faulty base station notifies the user of the connectivity disruption and releases the session, while a fake base station continues to hold the session. We empirically analyzed the detection and identification thresholds, which vary with the fake base station's power and the channel condition. By strategically selecting the threshold parameters, our scheme provides zero errors, including zero false positives, to avoid blacklisting a temporarily faulty base station that cannot provide connectivity at the time. Furthermore, our link routing scheme enables the base station to switch in order to restore the connectivity availability and limit the threat impact. We also discuss future directions to facilitate and encourage R&D in securing telecommunications and base station security. elecommications networking; 5G; 6G; fake base station; detection; blacklisting; security; availability; link routing +
Footnote †: This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license ([[https://creativecommons.org/licenses/by/4.0/](https://creativecommons.org/licenses/by/4.0/)]([https://creativecommons.org/licenses/by/4.0/](https://creativecommons.org/licenses/by/4.0/))). Footnote †: This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license ([[https://creativecommons.org/licenses/by/4.0/0/](https://creativecommons.org/licenses/by/4.0/0/)]([https://creativecommons.org/licenses/by/4.0/0/](https://creativecommons.org/licenses/by/4.0/0/))). Footnote †: This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https://creativecommons. equipment thus requires a base station as the first hop (i.e., last-mile hop) in its communication path to the remote server and Internet. In telecommunications networking protocol, e.g., 4G and 5G, the base station sets up a wireless communication channel via radio resource control (RRC), which includes a system information block (SIB) broadcasting communication to announce the base station's presence and deliver the communication-channel control information. A malicious or fake base station is a well-known security issue in mobile networking.