Fake base station detection using temporal graph analysis and anomaly detection
Network computing equipment may receive one or more radio parameter measurement reports generated by one or more user equipment. A report may comprise radio parameter values measured by user equipment corresponding to signals transmitted by a radio access network node and time information corresponding to the report. The computing equipment may perform temporal analysis based on time information corresponding to one or more reports and may generate a temporal graph based on the time information. Edges of the temporal graph may correspond to connection activity of user equipment that generated the reports with respect to one or more radio access network nodes. The edges may be ranked using a graph-based model and optimally combined with anomaly scores, determined based on the measured radio parameter values, into combined anomaly scores that may be compared to a criterion to determine that a radio access network node is a fake base station.
1 . A method, comprising:
receiving, by network computing equipment comprising at least one processor, at least one user equipment radio parameter measurement report, generated by at least one user equipment, comprising at least one report value;
analyzing, by the network computing equipment, the at least one report value to result in at least one analyzed report value;
based on the at least one analyzed report value, determining, by the network computing equipment, at least one connection transition value with respect to at least one radio access network node,
wherein the at least one connection transition value is a first connection transition value corresponding to a time associated with the at least one user equipment radio parameter measurement report, wherein the at least one user equipment radio parameter measurement report further comprises at least one radio performance measurement value, and wherein the method further comprises:
analyzing, by the network computing equipment, the at least one radio performance measurement value to result in a second connection transition value associated with the at least one radio access network node; and
based on the first connection transition value and the second connection transition value, determining, by the network computing equipment, a fake base station score indicative of a probability that the at least one radio access network node is a fake base station.
2 . The method of claim 1 , wherein the at least one analyzed report value corresponds to at least one interval associated with the at least one user equipment radio parameter measurement report.
3 . The method of claim 1 , wherein the at least one analyzed report value is at least one time-based value.
4 . The method of claim 1 , wherein the at least one radio access network node is a first radio access network node, wherein the at least one connection transition value is a first connection transition value that corresponds to the at least one user equipment transitioning from having a connection status with the first radio access network node to having the connection status with a second radio access network node, wherein the at least one user equipment radio parameter measurement report is a first user equipment radio parameter measurement report, wherein the at least one report value is a first time corresponding to the at least one user equipment radio parameter measurement report, and wherein the first connection transition value is determined based on at least the first time and a second time corresponding to a second user equipment radio parameter measurement report.
5 . The method of claim 4 , further comprising:
determining, by the network computing equipment, a second connection transition value based on at least the first connection transition value and a third time corresponding to a third user equipment radio parameter measurement report.
6 . The method of claim 1 , wherein the at least one radio access network node is a first radio access network node, and wherein the at least one connection transition value corresponds to the at least one user equipment being idle and transitioning from selection of camping on the first radio access network node to selection of camping on a second radio access network node.
7 . The method of claim 1 , wherein the at least one radio access network node is a first radio access network node, and wherein the at least one connection transition value corresponds to the at least one user equipment transitioning from being connected to the first radio access network node to being connected to a second radio access network node.
8 . The method of claim 1 , further comprising:
analyzing, by the network computing equipment, the fake base station score with respect to a fake base station score criterion to result in an analyzed fake base station score;
based on the analyzed fake base station score being determined to satisfy the fake base station score criterion, determining, by the network computing equipment, that the at least one radio access network node is at least one fake base station; and
performing, by the network computing equipment, a connection establishment action.
9 . The method of claim 8 , wherein the connection establishment action comprises adding at least one identifier corresponding to the at least one fake base station to a base station barring list.
10 . The method of claim 1 wherein the analyzing of the at least one radio performance measurement value comprises analyzing the at least one radio performance measurement value according to at least one of: an isolation forest machine learning model or a local outlier feature machine learning model.
11 . The method of claim 1 , wherein the at least one radio performance measurement value is at least one of: a received signal strength value or a received signal signal-to-interference-plus-noise ratio value.
12 . The method of claim 1 , wherein the at least one connection transition value corresponds to a temporal graph edge.
13 . The method of claim 1 , further comprising:
adding at least one identifier corresponding to the at least one radio access network node to at least one base station barring list.
14 . Network computing equipment, comprising:
at least one processor configured to process executable instructions that, when executed by the at least one processor, facilitate performance of operations, comprising:
receiving at least one user equipment radio parameter measurement report, corresponding to at least one radio access network node and generated by at least one user equipment, the at least one user equipment radio parameter measurement report comprising at least one time value and at least one radio performance measurement value;
analyzing the at least one time value to result in at least one first anomaly value corresponding to the at least one radio access network node;
analyzing the at least one radio performance measurement value to result in at least one second anomaly value corresponding to the at least one radio access network node;
based on the at least one first anomaly value and the at least one second anomaly value, determining at least one combined anomaly score;
analyzing the at least one combined anomaly score with respect to an anomaly score criterion to result in an analyzed anomaly score; and
based on satisfaction of the anomaly score criterion, performing a connection establishment action,
wherein the analyzed anomaly score is indicative of a probability that the at least one radio access network node is a fake base station and wherein the performing the connection establishment action comprises, wherein the analyzing of the at least one time value comprises applying a temporal graph model to the at least one time value, wherein the at least one first anomaly value corresponds to at least one edge of a temporal graph generated by the applying of the temporal graph model to the at least one time value, wherein the at least one radio access network node is a first radio access network node, and wherein the at least one edge corresponds to connection transition activity with respect to the first radio access network node and at least a second radio access network node.
15 . The network computing equipment of claim 14 , wherein the determining of the at least one combined anomaly score comprises applying an ensemble learning model to the at least one first anomaly value and the at least one second anomaly value.
16 . The network computing equipment of claim 14 , wherein the analyzing of the at least one radio performance measurement value comprises applying, to the at least one radio performance measurement value, at least one of: an isolation forest learning model or a local outlier factor learning model.
17 . The network computing equipment of claim 14 , wherein the network computing equipment is part of a wireless communication network core network.
18 . The network computing equipment of claim 14 , wherein the connection establishment action comprises adding at least one identifier corresponding to the at least one radio access network node to at least one base station barring list.
19 . A non-transitory machine-readable medium, comprising executable instructions that, when executed by at least one processor of network computing equipment, facilitate performance of operations, comprising:
receiving at least one user equipment radio parameter measurement report, corresponding to at least one radio access network node and generated by at least one user equipment, the at least one user equipment radio parameter measurement report comprising at least one time value and at least one radio performance measurement value;
analyzing the at least one time value to result in at least one first anomaly value corresponding to the at least one radio access network node;
analyzing the at least one radio performance measurement value to result in at least one second anomaly value corresponding to the at least one radio access network node; and
based on the at least one first anomaly value and the at least one second anomaly value, determining at least one combined anomaly score indicative of a probability that the at least one radio access network node is a fake base station,
wherein the analyzing of the at least one time value comprises applying a temporal graph model to the at least one time value, wherein the at least one first anomaly value corresponds to at least one edge of a temporal graph generated by the applying of the temporal graph model to the at least one time value, wherein the at least one radio access network node is a first radio access network node, and wherein the at least one edge corresponds to connection transition activity with respect to the first radio access network node and at least a second radio access network node.
20 . The non-transitory machine-readable medium of claim 19 , wherein the operations further comprise:
adding at least one identifier corresponding to the at least one radio access network node to at least one base station barring list.