# 5G-Based Smart Healthcare and Mobile Network Security: Combating Fake Base Stations
## 5 Results and Discussion  
### Detector Deployment  
All our experiments were run in our lab at the university. We set up the experiment to gather nearby cell signals to test our concept.  
In the first phase, the detector basically did what attackers do during the probing and information-gathering phase, but instead of using this information to perform attacks, we stored this information to analyze the different cell identities for further use. The detector scanned through the bands of a band list that contained all the bands that needed to be scanned. A simple loop script could be used to repeatedly run the _cell_search_ and _cell_measurement_ program, iterating through each band EARFCN number as the parameters. We gathered the different configurations and parameters of the fake base stations and real  
Figure 4: Flowcharts of the proposed detection scheme: (**a**) Phase 1—scanning flow chart. (**b**) Phase 2—evaluate cell record.  
base stations from the previous attack phase. The public network data are real signals broadcasted by MNOs that were received in our lab using _Crocodilehunter_. We edited the config.ini to reflect the network of Taiwan, setting the expected MCC to 01 and 466. Table 1 shows some of the entries of the records. An MCC (mobile country code) is a three-digit numeric code that is allocated by the ITU and uniquely identifies a specific country. An MNC (mobile network code) is used to identify a specific mobile network operator within the country. A TAC (tracking area code) enables finer-grained tracking and management within a network's coverage areas. These codes work together to ensure efficient and accurate mobile network operations and subscriber management.  
In the second phase, the cell record went through an analysis process to be examined. We constructed a whitelist of \"real cells\" as a reference, that is, using the appropriate MCC-MNC. We analyzed the records gathered in the previous steps. During a period of 7 days, we discovered that the scanner scanned 33,579 times and picked up a total of 145 distinct cell entries. Most of them were public network cells starting with MCC 466 as shown in Table 2. However, we discovered multiple cells--121, to be exact--that did not belong to MCC 466 or 01 as shown in Table 3. But they were indeed present; we tried to look up those unknown MCCs, but there are no corresponding country code-network code combinations in Taiwan as far as we know.  
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**eNB ID** & **PCI** & **MCC** & **MNC** & **EARFCN** & **TAC** & **Last Seen** \\ \hline
701115 & 460 & 466 & 97 & 275 & 44280 & 17 January 2023 15:45 \\ \hline
176827 & 151 & 466 & 97 & 3050 & 60664 & 11 January 2023 11:08 \\ \hline
186013 & 157 & 466 & 01 & 50 & 3408 & 16 January 2023 02:47 \\ \hline
579485 & 157 & 466 & 03 & 50 & 23888 & 9 January 2023 18:07 \\ \hline \hline \end{tabular}
\end{table}
Table 1: Detector cell records.  
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**MCC** & **MNC** & **TAC** & **PhyID** & **EARFCN** & **Time Stamp** & **Frequency** & **eNodeB\_ID** \\ \hline
466 & 97 & 44280 & 151 & 275 & 17 January 2023 15:35 & 2137.5 & 701115 \\ \hline
466 & 1 & 19792 & 292 & 3250 & 17 January 2023 15:35 & 2670 & 710023 \\ \hline
466 & 1 & 19792 & 292 & 3250 & 17 January 2023 15:34 & 2670 & 710023 \\ \hline