## 1 Introduction
Rogue Base Station (RBS) attacks and International Mobile Subscriber Identity (IMSI) catchers are the most frequently published attacks on the RAN layer. In these attacks, the IMSIs of User Equipment (UE) are targeted during the initial network registration process and paging attacks. However, it is expected that the 5G standards and services will address known attacks for all access types in this layer. An unencrypted IMSI, for example, could not be transferred in 5G. A further move toward countering the RBS is undertaken by the 3 rd Generation Partnership Project (3 GPP). The security group in 3 GPP (called SA3) has outlined that radio information received by UEs may include traces of RBS \"fingerprints\" [14]. Based on this information and analyses of Measurement Report (MR), SA3 suggests recognising a framework that enables cellular networks to reliably identify such RBS threats. The framework complements other technology implemented in 5G, as described above, to protect the UEs from RBS attacks [15]. This study focuses on the generation of realistic MR data. In D2D and V2X communication, there might be rogue gNodeB units alongside legitimate gNodeB units. The use case includes several vehicle platooning scenarios in which an RBS is positioned along the road and attempts to entice the platoon leader's UE to handover to the RBS. Many scenarios have included several RBS attacks in vehicular platooning to influence the platoon and cause large traffic collisions with a significant threat to life. This could be performed as an MitM attack, where the RBS imitates a legitimate BS and transmits information between the other legitimate BS and the leader of the platoon. Eventually, the platoon leader can then be ordered to take a manoeuvre that results in a fatal accident by changing the contents of the control messages. The generation of large datasets for training and testing was a priority. One could use UE measured data gathered from a vehicle driving through a 5G coverage area, but it would be difficult to determine whether these datasets were normal or anomalous. To preclude the generation of anomalous data or data that are only relevant to the specific route that was taken, a novel method of simulation has been developed, capable of generating large datasets for a wide range of scenarios in a fraction of the time needed to obtain UE data from a \"drive test\". Our method runs on a standard PC and quickly generates realistic MR data reflecting a user-defined topology of legitimate BS and RBS, BS/RBS transmission strength, speed and direction of platoon leader, and physical position of the road surface with respect to the BS/RBS location. In summary, our work provides the following contributions:  
* Simulation of 5G tracking areas where platooning vehicles travel and connect to the BS situated in each tracking area. * Building a novel flexible data generator of 5G MRs that can generate realistic streams of radio data. * A Handover protocol is implemented and a model for RBS antenna beams is introduced to present several normal and attack scenarios. * Developing a software platform to mimic the signals from legitimate BSs and RBSs at variable locations and proposing several attack scenarios to enable 5G RBS investigations. The remainder of this paper is organised as follows. In Section 2, a short summary of studies related to RBS detection techniques is presented to establish the role of the MR and the type of data that it contains. Section 3 describes the proposed architecture and simple handover protocol. Section 4 describes the antenna beam model for the RBS and the attack model. Section 5 presents the experimental results by illustrating the legitimate and attack scenarios in detail. Finally, in Section 6, we conclude the paper by summarising the main achievements and considering some directions for future work.