## 4 Proposed Antenna Beam Model for RBS
### Deploy RBS to the Motorway (Attack Scenario)  
The outline of a suggested potential RBS attack scenario is proposed here. An intruder establishes an RBS in close proximity to the road segment, indicated by the red shape in Figure 5. A rogue agent attempts to entice the UE to attach to it by spoofing the TAC and CID of a legitimate BS that is slightly further away [37]. Figure 5 shows an RBS with two beams. Usually, a single beam would suffice, but in a \"real\" scenario only one of the red beams would be present depending on the direction in which the antenna is pointed. Nevertheless, Figure 6a clearly shows that both RBS beams are actually generated. It is unlikely that attackers would implement an RBS with high transmission power because of the high cost and physical size of the required infrastructure. For this reason, the simulated RBS has been specified with a lower transmit power than the legitimate BS units in the area and uses a narrow beam directional antenna that covers part of the motorway with higher gain to deceive the UE. The antenna gain is also inversely proportional to the beamwidth of the antenna as shown in Equation (5) [38]:  
\[G(\mathrm{dB})=10\log_{10}\left(\frac{APC}{BW_{\theta}BW_{\phi}}\right) \tag{5}\]  
The antenna pattern was assumed as a rectangular area in the proposed model, and the APC (Antenna Pattern Constant) takes a fixed value of 41,253 if the beamwidth dimensions are in degrees [15]. The horizontal and vertical beamwidths are considered to be approximately equal in the simulation, therefore an antenna beamwidth is estimated based on the given gain by (5). The position of the RBS is being used to determine when the UE falls  
Figure 4: Radiation patterns of a real antenna and the simplified model used in the simulator. below the RBS coverage. This is also used to measure the timespan during which the UE is covered by the narrow beams of the RBS identified as \(T_{A}\) and \(T_{B}\) as shown in Figure 5.  
The RBS generates a higher RSS that can defraud the mobile UE, as shown in Figure 5(a). As expected, there are two areas in which the RBS power is higher when two beams are used. The first beam is pointed down to the road at 30 degrees; thus, we can see a higher received signal, but for a shorter time than the second beam which is positioned on the road at 60 degrees. Typically, the 5G standard does not allow a legitimate BS to handover a UE to an RBS that is unknown to the 5 GCore (5 GC). The 5 GC Access and Mobility Management Function (AMF) would normally maintain a list of legitimate BS-IDs in the respective tracking area. This should prevent the RBS from stealing the UE communication link at the user plane level. Thus, at first glance, injecting malicious information into a platoon leader may not be possible. However, in the technical specification of enhanced 5G security against RBS, the 3 GPP identifies that the handover decision making in 5G systems is centred on the information included in the UE MR. The UE evaluates the RSS of nearby BS units on the basis of the syncing signal that transports the synchronisation and information block without additional security [43]. Consequently, as shown in Figure 5(b), the RBS attempts to forge  
Figure 5: RBS attack scenario, \(BW_{\theta}\): beamwidth angles; (\(X_{BS}\), \(Y_{BS}\)): location of the base station; TAC: Tracking Area Code; CID: Cell Identifier; V2V: Vehicle-to-Vehicle communications; and, \(T_{A}\), \(T_{B}\): edges of narrow beams. Figure 6: The received signal strength of a mobile UE in the attack model. the identification parameters of the second BS such as its Mobile Country Code (MCC) and Mobile Network Code ( MNC). It then masquerades as the second legitimate BS with a higher RSS and declares itself to be available for connection. To design an RBS detection mechanism, designers need data that are equivalent to that contained in the MR from a UE. As a first step, a simulation tool was constructed to generate MR data based on the simulation of received signal values from multiple base stations.