# Fake Base Station Detection and Link Routing Defense +
## 7 Implementation and Experimental Results
### Detection Accuracy Performance against Fake Base Station  
We test our scheme against a legitimate base station, a faulty (but legitimate) base station, and a fake base station while varying \(\tau_{T}\) (\(494\,\mathrm{ms}<\tau_{T}<1893\,\mathrm{ms}\)) while varying \(\tau_{N}\) (\(36<\tau_{N}<138\)). Our scheme correctly decides the legitimate base station and the fake base station with 100% accuracy, i.e., our scheme yields 0 (no fake base station) for all of the legitimate base station experiments, and it yields 1 (yes base station) for all of the fake base stations. Against a legitimate base station, our scheme correctly does not detect and blacklist the base station. Against a fake base station persistently withholding the connection, our scheme correctly decides that it is a fake base station, and the false-negative rate is zero. In the faulty (but legitimate) base station experiments, i.e., when testing our scheme against a faulty base station, we observe errors when varying \(\tau_{T}\) and \(\tau_{N}\). Because the faulty base station is still legitimate, it is incorrect to detect, classify, and blacklist it as a fake base station. Varying \(\tau\) can yield false positives, where a faulty base station's connectivity setup (RRC/NAS) is detected and blacklisted as a fake base station. We analyze such errors because we want to reduce and avoid blacklisting a faulty but legitimate base station. We vary the \(\tau\) thresholds (\(\tau_{T}\) and \(\tau_{N}\)) and compare our scheme using both \(T\) and \(N\) observations vs. our scheme variant using only \(T\) vs. our scheme variant using only \(N\). We first jointly vary \(\tau_{T}\) and \(\tau_{N}\) and show our results. To jointly vary the \(\tau_{N}\), we introduce the \(\tau\)_ratio,_ which is the ratio between the \(\tau\) value and some reference value \(\tau_{0}\). The \(\tau_{T}\) ratio is equal to \(\frac{\tau_{T}}{\tau_{T,0}}\) where \(\tau_{T,0}=823\) ms; the \(\tau_{N}\) ratio is equal to \(\frac{\tau_{N}}{\tau_{N,0}}\) where \(\tau_{N,0}=60\) requests. For example, if the \(\tau_{N}\) ratio is equal to two, \(\tau_{T}=1646\) ms, which is doubled from \(\tau_{T,0}=823\) ms. While the reference values (the denominators of the \(\tau\) ratio) can be chosen differently, we choose \(\tau_{T,0}=823\) ms and \(\tau_{N,0}=60\) requests, as these are the average values (rounded) of the faulty base station experiments when the base station's transmission power is the lowest and thus the values are the highest, which is describe in Section 7.3. In Section 7.3, we observe that the 95% confidence interval is small, so we expect \(\tau_{T}=\tau_{T,0}=823\) ms and \(\tau_{N}=\tau_{N,0}=60\) to have a relatively small number of false-positive errors. Figure 7a shows the results of the joint varying of \(\tau_{T}\) and \(\tau_{N}\) while fixing the \(\tau_{T}\) ratio and \(\tau_{N}\) ratio to be equal, i.e., \(\tau_{T}\) ratio = \(\tau_{N}\) ratio. The false positive rate/probability decreases as we increase \(\tau\) for both \(T\) and \(N\), because increasing \(\tau\) reduces the detection sensitivity and the occurrences of detecting 1 (deciding that it is a fake base station). We also see that our scheme using both \(T\) and \(N\) observed information outperforms our scheme variants using either. For example, when the \(\tau_{T}\) ratio and \(\tau_{N}\) ratio are both equal to one (i.e., \(\tau_{T}\) = 823 ms and \(\tau_{N}\) = 60), our scheme's false-positive rate is 0.0053, while using \(T\) only has a false-positive rate of 0.1467 and using \(N\) only has a false-positive rate of 0.0213. Using both pieces of information provides better/lower error rates; while our scheme using both \(T\) and \(N\) provides a very small false-positive rate of 0.0053, it still provides errors and blacklists the faulty but legitimate base station with a probability of 0.0053. Our threshold selection is based on the optimality definition in Section 7.1, e.g., to minimize the error performance.