A network-based positioning method to locate false base stations

In recent years False Base Stations (FBSs) have received increased attention. A False Base Station can perform active or passive attacks against mobile devices or user equipment (UE) to steal private information, such as International Mobile Subscriber Identifier (IMSI), to trace users locations, or to prevent users from getting service from operators. Most of the existing solutions related to FBS have focused on the detection aspects of the false station rather than locating its position. However, once an FBS is detected in a network, discovering its exact location precisely and remotely becomes highly crucial to initiate preventive actions. In this work, we propose a network-based localization method for estimating the exact geographical position of an FBS whose existence is already detected in a cellular network. Our method relies on a comparative pairwise analysis of the Reference Signals Received Power (RSRP) values reported as a standard procedure by the UEs in the vicinity of FBS through their measurement reports. Specifically, for each pair of related measurement reports, we identify a half-plane indicating the probable location of the FBS and then predict the exact location based on the intersection of all obtained half-planes. We have implemented and experimentally evaluated our proposed method in the Network Simulator 3 (ns-3) and showed that it accurately estimates FBS location with meter-level precision under different scenarios in a cellular network.