A Fast Detection and Location Method of Illegal Base Station Intrusion

Abstract

The invention proposes a fast detection and location method for illegal base station intrusion. This method uses the basic network parameters (LAC, CI, field strength, etc.) collected on ordinary users' mobile phones and user business behaviors to judge whether the parameter changes and business behaviors meet the preset warning characteristic conditions, and sum up the weights that meet the characteristic conditions. According to the total weight, it is judged whether it is an early warning of illegal base station intrusion; after the early warning is judged, when the user's GPS switch is turned on, the GPS latitude and longitude information of the current user's location is recorded, and the first-level early warning information is transmitted to the remote central processing unit; the central processing unit classifies the reported information of multiple terminals according to the LAC code before the attack, conducts a second comprehensive alarm analysis on the early warning information belonging to one category, and determines whether the preset alarm feature conditions are met, and will meet the alarm feature conditions. The weights are summed up to determine whether the current illegal base station intrusion alarm is based on the total weight. After the alarm is judged to be established, the illegal base station position at the time of the illegal base station intrusion is calculated and a real-time alarm is issued.

Description

technical field [0001] The invention belongs to the field of wireless networks, in particular to a fast detection and positioning method for illegal base station intrusion. Background technique [0002] The current GSM mobile communication system adopts a one-way authentication system, that is, only the network authenticates the terminal, and does not require the terminal to authenticate the network. "Illegal base station" (also known as "pseudo base station" or "simulation base station") equipment utilizes this loophole in the GSM system protocol. Its basic working principle is that by simulating the mobile communication wireless base station system and the background analysis system, using the mobile network system network number (MNC), frequency resources, etc., to pretend to be the adjacent area of ​​the legal base station, the illegal base station system first detects the carrier in the current target area. Frequency information, and then continuously transmit pseudo-p...

AI Technical Summary

Problems solved by technology

[0009] (2) It can be distinguished by some parameters, such as T3212, RXLEVACCESS_MIN, LAC, CI (cell identity) and other parameters are quite different from those set on the network; although the BCCH of the fake cell is the same as that of the legal cell, but the LAC and CI are quite different

[0014] Disadvantages of Method 1 (drive test): 1) The cost of drive test is high and the manpower is limited, so it is difficult to realize the whole network, all-day, real-time test, and it can only be carried out in key areas or after suspected phenomena such as user complaints; 2 ) is more effective for fixedly deployed illegal base stations, but it cannot track illegal base stations in a moving state. When it is known that user complaints or indicators are abnormal, the illegal base station has left the area, and it is even impossible to confirm whether there is an illegal base station attack. Unable to locate illegal base station location

[0015] Defects of method 2 (A port signaling monitoring): 1) Not all location updates from LAC=65534 to legal cells are initiated after the pseudo cell is disconnected from the network; 2) It is necessary to detect illegal base stations through A port signaling monitoring Only the continuous trend of the surrounding cells can be used to locate and judge, which has a lot to do with the flow of people around the pseudo-cell; 3) Port A lacks the exact location of the attacked mobile phone (only the actual LAC area where the terminal is located can be judged, the range is too large ), it is difficult to achieve precise positioning

Images