Lightweight User Equipment-Side Detection of False Base Station Attacks Using a First-Order Markov Chain

Area of Science:

• Cybersecurity
• Mobile Network Security
• Wireless Communication

Background:

• False Base Station (FBS) attacks exploit vulnerabilities during the network authentication phase.
• Existing User Equipment (UE)-side detectors often require scarce labeled attack data or are too resource-intensive for mobile devices.
• The need for efficient, lightweight, and data-scarce detection methods for FBS attacks is critical.

Purpose of the Study:

• To develop a lightweight User Equipment (UE)-side detector for False Base Station (FBS) attacks.
• To create a detector that does not rely on labeled attack data and is suitable for resource-constrained devices.
• To analyze the performance and efficiency of the proposed detection method against existing baselines.

Main Methods:

• A first-order Markov chain model is employed, utilizing a four-tuple state of packet type, direction, message identifier, and access-network type.
• Thresholds are derived from normal traffic patterns, eliminating the need for labeled attack data.
• The detector operates with a single counting pass, fitting within a 119 KB memory footprint.

Main Results:

• The detector achieved an F1 score of 88.70% in leave-one-session-out evaluation and 96.23% with calibration across 192 LTE and 5G captures.
• It successfully flagged 51 out of 53 attacks, demonstrating high detection accuracy.
• The detector exhibited the lowest latency (0.46 ms) and smallest working set (8.8 MB) among eleven benchmarked detectors.

Conclusions:

• The proposed lightweight Markov chain-based detector is effective for identifying False Base Station (FBS) attacks on User Equipment (UE).
• Its low resource requirements and independence from labeled attack data make it suitable for smartphones and embedded systems.
• The detector offers a promising solution for enhancing mobile network security against sophisticated signaling attacks.