# 5G-Based Smart Healthcare and Mobile Network Security: Combating Fake Base Stations
## 4 Combating Fake Base Stations
### Fake Base Station Detection  
Detecting suspicious base stations and potential threats is vital for early identification and proactive action. Take the case in Taiwan; public awareness of the threat of fake base station attacks is still relatively low, and its research and investigation only just started recently because of the recent incident. A big telecom company just released an app with a 2G fake base station detection feature recently. The company is working with government agencies to develop this feature in response to the criminal case mentioned in [3]. Though their detection method is undisclosed, this is still an important step forward against the  
Figure 2: Security threat of base station.  
fake base station threats in Taiwan [17]. But this kind of traditional detection method requires the installation of special apps on the UE and root privileges to access the modem driver, which are also limited by different hardware constraints and software compatibility issues. UE also comes in various types of devices other than phones, like smart gadgets or health equipment that are difficult to install and maintain apps on individually.  
The research community is actively exploring other methods for detecting fake base stations. Network-based, signal-based, and location-based detection schemes have gained considerable attention, offering viable means to counteract fake base station attacks [18,19]. Some of these detection methods can be adapted and applied to the context of 5G and smart healthcare networks.  
One of them is the \"Crocodile Hunter\" project developed by the Electronic Frontier Foundation (EFF) [20]; it is based on open-sourced projects and low-cost hardware, and it aids in detecting fake base stations. We think this is a promising concept for providing detection and protection for 5G-based smart healthcare and mobile networks.  
Based on this concept, we designed a detection scheme that resides at the side of the network manager and has the capability to update legitimate cell information from the core network as shown in Figure 3. Our proposed scheme monitors nearby signals, listens to messages broadcasted by base stations in proximity, and detects any suspicious base stations or potentially malicious fake base stations. The detector stores this record in a database to be analyzed by the operators and tracks activities. The detection algorithm continues to monitor the cells and compares them to a whitelist of authentic cell information. The whitelist can be periodically updated to reflect the current configuration of the network and to ensure better security. The detection mechanism is illustrated below as shown in Figure 4.  
First, the detector, which is a radio frontend or a device with UE functionalities, performs a cell search and decodes information blocks. Different cell signatures are gathered, including several parameters that fake base station attackers would use, mainly MCC, MNC, PCI, and EARFCN, and the timestamp of when the cells are spotted is also recorded.  
After the records are gathered, the detection algorithm examines these cells, and we analyzed the data collected in the database. The system flow of the detection mechanism is shown below. The detection algorithm compares the cell identity with the whitelist and security criteria. The basic criteria were designed based on a whitelist of permitted base stations in the network. The detector sees whether a cell is (a) a real cell that matches the whitelist and belongs to our network, (b) not authorized but belongs to other legitimate operators with legal MCC-MNC, or (c) does not belong to the above criteria and is suspicious.  
This proposed detection scheme can serve as a starting point for people who want to build a fake base station detection system without the need to install apps on individual devices.  
Figure 3: Proposed detection scheme.