# Fake Base Station Detection and Link Routing Defense +
## 2 Related Work
### Defense against Fake Base Station  
While the previous research largely focused on the offensive side of fake base stations, more limited research detected and identified fake base stations using RF fingerprinting in wireless signal processing [15], packet tracing with machine learning [16], and the use of digital spam messages transmitted by the fake base station [10; 17]. These previous research studies are highly relevant to our work because they have the same goal of detecting and identifying fake base stations. However, our work uses the user equipment's behavior caused by connecting to the fake base station for detection and identification and focuses on the RRC control communication to set up the connectivity. Our work focuses on the RRC control communication standardized by 3 GPP [18], because the control communication is unique to the cellular base station. Our work is orthogonal to these previous detection/identification works and can be used in conjunction with them to provide a richer detection/identification protocol; we focus on our novel contributions and the detection features of time and number of registration request packets in the RRC in this paper.  
Other research works [19; 20; 21; 22] proposed the digital-signature-based authentication of system information messages by legitimate base stations to prevent the user equipment from connecting to a fake base station. Our defense work is distinguishable from these previous research works in the following ways. First, these previous works offer preventive measures to disable the user equipment from connecting to a fake base station; in contrast, our work detects and identifies the threat after it occurs. Second, these previous works involve greater systematic changes involving protocol and algorithmic changes in the user equipment, base station, and backend core network; for example, 3 GPP is in the initial stages of conceptualizing and identifying the requirements of establishing a public key for base stations to enable such a cryptographic approach [23]. In contrast, our work only requires implementation on the user equipment, which is also the beneficiary of the scheme, and thus requires substantially fewer changes in the system implementation and standardization, facilitating practicality and deployability. Our work is therefore orthogonal to these previous works and can be used in conjunction with the previous cryptographic approaches.  
In cellular 4G/5G protocol, a limited number of research studies implemented security on cellular base stations against potentially malicious user equipment, e.g., for authentication [24; 25]. While the backend core network has traditionally authenticated the user equipment and established security, e.g., 5G authentication and key management (AKA), such an approach of implementing security on the base station on the network edge can enable quicker mitigation and reduce threat impacts. Our work, however, considers malicious base stations (i.e., the threat actor is the base station) in contrast to these previous research studies that defend against malicious user equipment.