FBSleuth

Zhuang, Zhou; Ji, Xiaoyu; Zhang, Taimin; Zhang, Juchuan; Xu, Wenyuan; Li, Zhenhua

doi:10.1145/3196494.3196521

Cited by 48 publications

(7 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…CELLDAM provides a root-less defense by using a companion data-plane signal analyzer [54]. On the other hand, such monitors can also be deployed at the networks (RAN), such as heuristics-based fake base station detectors [24], [55], [56], [25], [26], [57], [58], and anomalous traffic classifiers [59], [60], [61]. While our system can be viewed as a run-time monitor, it is distinguished from the above works for being the first defense at the 5G O-RAN control plane that offers programmability and extensibility.…”

Section: Related Workmentioning

confidence: 99%

“…After luring nearby victim UE to connect, the FBS then transmits malicious messages to perform DoS or privacy leakage attacks, which are also known as IMSI catchers in legacy 2G and 3G networks [42], [23]. We consider these attacks can be detected by using existing FBS detection (or IMSI catcher detection) techniques [42], [23], [24], [57], [26]. Such techniques, which rely on signal strengths, measurement reports, and other heuristics, can also be deployed at the O-RAN control plane.…”

Section: Other Cellular L3 Attacksmentioning

confidence: 99%

See 1 more Smart Citation

5G-Spector: An O-RAN Compliant Layer-3 Cellular Attack Detection Service

Wen,

Porras,

Yegneswaran

et al. 2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Over the past several years, the mobile security community has discovered a wide variety of exploits against link and session-establishment protocols. These exploits can be implemented on software-defined radios (SDRs) that disrupt, spoof, or flood layer-3 (L3) messages to compromise security and privacy, which still apply to the latest 5G mobile network standard. Interestingly, unlike the prior generations of closed (proprietary) mobile network infrastructures, 5G networks are migrating toward a more intelligent and open-standards-based fully interoperable mobile architecture, called Open RAN or O-RAN. The implications of transitioning mobile infrastructures to a software-defined architectural abstraction are quite significant to the INFOSEC community, as it allows us to extend the mobile data plane and control plane with security-focused protocol auditing services and exploit detection. Based on this design, we present 5G-SPECTOR, the first comprehensive framework for detecting the wide spectrum of L3 protocol exploits on O-RAN. It features a novel security audit stream called MOBIFLOW that transfers fine-grained cellular network telemetry, and a programmable control-plane xApp called MOBIEXPERT. We present an extensible prototype of 5G-SPECTOR which can detect 7 types of cellular attacks in real-time. We also demonstrate its scalability to 11 unknown attacks as well as 31 real-world cellular traces, with effective performance (high accuracy, no false alarms) and low (<2% CPU, <100 MB memory) overhead.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Other Cellular L3 Attacksmentioning

confidence: 99%

5G-Spector: An O-RAN Compliant Layer-3 Cellular Attack Detection Service

Wen,

Porras,

Yegneswaran

et al. 2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

show abstract

“…Finally, FBSleuth [34] is a recently designed BS-based tool that can identify RBS devices based on minor differences in the emitted signals caused by hardware imperfections. This defence software lacks monitoring of the platooning data traffic traversing between multiple BS in a 5G network that is the domain of our work.…”

Section: Background and Related Workmentioning

confidence: 99%

Synthetic Generation of Realistic Signal Strength Data to Enable 5G Rogue Base Station Investigation in Vehicular Platooning

2022

View full text Add to dashboard Cite

Rogue Base Stations (RBS), also known as 5G Subscription Concealed Identifier (SUCI) catchers, were initially developed to maliciously intercept subscribers’ identities. Since then, further advances have been made, not only in RBSs, but also in communication network security. The identification and prevention of RBSs in Fifth Generation (5G) networks are among the main security challenges for users and network infrastructure. The security architecture group in 3GPP clarified that the radio configuration information received from user equipment could contain fingerprints of the RBS. This information is periodically included in the measurement report generated by the user equipment to report location information and Received Signal Strength (RSS) measurements for the strongest base stations. The motivation in this work, then is to generate 5G measurement reports to provide a large and realistic dataset of radio information and RSS measurements for an autonomous vehicle driving along various sections of a road. These simulated measurement reports can then be used to develop and test new methods for identifying an RBS and taking mitigating actions. The proposed approach can generate 20 min of synthetic drive test data in 15 s, which is 80 times faster than real time.

show abstract

“…They work by comparing the received packet with an ideal simulated packet. They have been used with a variety of protocol, such as Wi-Fi [1] or GSM [17]. They simplify the collection of relevant features with smaller dimensionalities, which is known to be more resistant to noise than waveform based approaches.…”

Section: Wireless Devices Fingerprintingmentioning

confidence: 99%

Bluetooth devices fingerprinting using low cost SDR

Helluy-Lafont

Boé

Grimaud

et al. 2020

2020 Fifth International Conference on Fog and Mobile Edge Computing (FMEC)

View full text Add to dashboard Cite

Physical fingerprinting is a trending domain in wireless security. Those methods aim at identifying transmitters based on the subtle variations existing in their handling of a communication protocol. They can provide an additional authentication layer, hard to emulate, to improve the security of systems. Software Defined Radios (SDR) are a tool of choice for the fingerprinting, as they virtually enable the analysis of any wireless communication scheme. However, they require expensive computations, and are still complex to handle by newcomers. In this paper, we use low cost SDR to propose a physical-layer fingerprinting approach, that allows recognition of the model of a device performing a Bluetooth scan, with more than 99.8% accuracy in a set of ten devices.

show abstract

FBSleuth

Cited by 48 publications

References 21 publications

5G-Spector: An O-RAN Compliant Layer-3 Cellular Attack Detection Service

5G-Spector: An O-RAN Compliant Layer-3 Cellular Attack Detection Service

Synthetic Generation of Realistic Signal Strength Data to Enable 5G Rogue Base Station Investigation in Vehicular Platooning

Bluetooth devices fingerprinting using low cost SDR

Contact Info

Product

Resources

About