# Fake Base Station Detection and Link Routing Defense +
###### Abstract
For example, there are open-source tools and tutorials for setting up fake base stations, e.g., Refs. [1; 2]. The fake base station exploits the radio signal-based base station selection process and the vulnerability in the broadcasting SIB and RRC messages. Previous research launched a fake base station to manipulate the RRC and SIB communications to downgrade security protection, misdirect the user equipment connection, and transmit fake public warning system messages, among others, as described in Section 2. In contrast to the previous research, we focus on the fake base station's threat to user equipment availability. The fake base station prevents user equipment from connecting to a legitimate base station and therefore deprives it of its connectivity availability. We first investigate fake base stations and discover that a base station that times the disconnection start among the steps in the connectivity setup process can cause much more availability damage; more specifically, the fake base station will complete the RRC setup but stop after receiving the first digital communication meant for the backend core network to continue to keep the user equipment engaged and to waste its connection time and effort. To defend against fake base stations, we designed and built a scheme with a passive and an active defense that requires the implementation or changes only at the user equipment level, i.e., does not require any protocol-level changes or changes in any other entities beyond the base station. Our scheme detects and blacklists a fake base station as a passive defense; then, it redirects connectivity to a legitimate base station as an active defense. In passive defense, we specifically design our scheme so that the detection and blacklisting minimize the false positives to avoid blacklisting a legitimate base station that is faulty or has a temporary connection issue. Our scheme and its detection threshold control thus depend on the base station-user equipment channel condition and the fake base station's transmission power. Our scheme also makes use of real-time observations directly related to the availability impact on the user equipment. Because the fake base station aims to keep the user equipment connected and engaged to itself as long as possible, we use the time duration of the connectivity setup as well as the number of repeated request transmissions to inform and drive our scheme. Once a fake base station is detected and blacklisted, in active defense, the user equipment has to redirect its connection to a legitimate base station. The detection and blacklisting may not be sufficient to ensure restoring connectivity. A Sybil-capable fake base station can take a new identity to escape the blacklisting and make the user equipment reconnect to it. To address this problem, we introduce a redirection mechanism called _link routing_, where the user equipment can restore its connectivity to a base station from a list of known base stations stored within the user equipment. After the detection of the fake base station, link routing ensures user equipment availability to establish a control connection with the legitimate network. We implemented our scheme using software-defined radios and open-source 5G srsRAN software to validate our design. We implemented and simulated the user equipment (implementing the defense) and the base stations, including legitimate and working well vs. faulty and temporarily unable to connect vs. fake and malicious base stations. Because of the lasting impacts of blacklisting, we simulated and analyzed a faulty but legitimate base station, which temporarily cannot provide connectivity; our scheme does not blacklist such a base station. We validated our design by analyzing the performance of the implemented scheme in detecting a fake base station with zero false positives, which is important because we blacklist the subject base station and avoid using it in the future.