# Fake Base Station Detection and Link Routing Defense +
## 9 Conclusions  
We designed and built a fake base station detection, blacklisting, and link routing scheme against fake base stations for user equipment. We implemented and validated different base station scenarios (legitimate, fake, and faulty) using software-defined radios and the open-source software srsRAN. We empirically implemented the faulty base station scenario and measured the time duration for the RRC and NAS to evaluate the performance of our scheme. We analyzed the performance of our scheme by varying the threshold valuesto obtain the optimal thresholds so that our scheme detects and blacklists only fake base stations instead of unintentionally faulty base stations, i.e., zero false positives. To achieve zero false positives, we found that using both NAS-layer connection time and the number of registration requests as thresholds rather than using either one of them alone provides better performance in terms of faster and more accurate detection of fake base stations. We also implemented and validated link routing to show that the user equipment can evade a fake base station attack after detection. In the implementation, we showed that our scheme reduces the fake base station availability threat impact from an infinite time duration (without our scheme defense) to only 2.93 s (with our scheme defense).  
Conceptualization, S.P. and S.-Y.C.; Methodology, S.P. and S.-Y.C.; Software, S.P.; Validation, S.P. and S.-Y.C.; Investigation, S.P. and S.-Y.C.; Resources, J.K. ([PERSON]), J.K. ([PERSON]) and S.-Y.C.; Data curation, S.P.; Writing--original draft, S.P. and S.-Y.C.; Writing--review & editing, S.P., J.K. ([PERSON]), J.K. ([PERSON]) and S.-Y.C.; Visualization, S.P.; Supervision, J.K. ([PERSON]) and S.-Y.C.; Project administration, J.K. ([PERSON]), J.K. ([PERSON]) and S.-Y.C.; Funding acquisition, J.K. ([PERSON]), J.K. ([PERSON]) and S.-Y.C. All authors have read and agreed to the published version of the manuscript.  
This research was funded by the Institute of Information & communications Technology Planning & Evaluation (IITP) grant funded by the Korea government (MSIT) (No. 2021-0-00796, Research on Foundational Technologies for 6G Autonomous Security-by-Design to Guarantee Constant Quality of Security).  
The raw data supporting the conclusions of this article will be made available by the authors on request.  
This work extends our previous conference paper [40] and a poster paper [41]. In addition to the overall presentation and writing-based improvements, we extend our conference paper by incorporating more sophisticated threats and designing an active measurement against the threats. More specifically, we include the Sybil threat, where a fake base station can change its identity before relaunching the attack after being blacklisted by the user equipment. To defend against such an attack we introduce link routing as an active defense mechanism that redirects the user equipment from the fake base station to a legitimate base station. In our scheme implementation, we use the reputation vector that contains the base stations that served the user equipment in the past while redirecting the connection to the legitimate base station. We updated the design for the active and passive defense, implemented the design, and analyzed the performance of the scheme in this journal manuscript. We thank the anonymous reviewers for their valuable feedback to improve this work. We also thank Korea government (MSIT) for supporting this work.  
The authors declare no conflicts of interest. The funders had no role in the design of the study; in the collection, analyses, or interpretation of data; in the writing of the manuscript; or in the decision to publish the results.