Method for rapidly detecting and positioning illegal base station intrusion

Abstract

The invention provides a method for rapidly detecting and positioning illegal base station intrusion. According to the method, basic network parameters such as LAC, CI and field intensity, acquired by a common user handset and user business behaviors are utilized to determine whether parameter change and the business behaviors are in accordance with various pre-set early warning characteristic conditions, summation of weights in accordance with the characteristic conditions is carried out, whether the present situation belongs to early warning of illegal base station intrusion is determined according to the total weight; when existence of the early warning is determined, a GPS switch of a user is in an open state, present GPS latitude and longitude information of a position of the user is recorded, first-level early warning information is transmitted to a remote central processing unit; report information of multiple terminals are classified by the central processing unit according to LAC codes before attack, secondary integrated alarm analysis on one type of early warning information is carried out to determine whether pre-set alarm characteristic conditions are satisfied, summation of weights in accordance with the alarm characteristic conditions is carried out, whether the present situation belongs to illegal base station intrusion alarm is determined according to the total weight, after existence of the alarm is determined, an illegal base station position during the present illegal base station intrusion is calculated, and real-time alarm is carried out.

Description

technical field [0001] The invention belongs to the field of wireless networks, in particular to a fast detection and positioning method for illegal base station intrusion. Background technique [0002] The current GSM mobile communication system adopts a one-way authentication system, that is, only the network authenticates the terminal, and does not require the terminal to authenticate the network. "Illegal base station" (also known as "pseudo base station" or "simulation base station") equipment utilizes this loophole in the GSM system protocol. Its basic working principle is that by simulating the mobile communication wireless base station system and the background analysis system, using the mobile network system network number (MNC), frequency resources, etc., to pretend to be the adjacent area of ​​the legal base station, the illegal base station system first detects the carrier in the current target area. Frequency information, and then continuously transmit pseudo-p...

AI Technical Summary

Problems solved by technology

[0009] (2) It can be distinguished by some parameters, such as T3212, RXLEVACCESS_MIN, LAC, CI (cell identity) and other parameters are quite different from those set on the network; although the BCCH of the fake cell is the same as that of the legal cell, but the LAC and CI are quite different

[0014] Disadvantages of Method 1 (drive test): 1) The cost of drive test is high and the manpower is limited, so it is difficult to realize the whole network, all-day, real-time test, and it can only be carried out in key areas or after suspected phenomena such as user complaints; 2 ) is more effective for fixedly deployed illegal base stations, but it cannot track illegal base stations in a moving state. When it is known that user complaints or indicators are abnormal, the illegal base station has left the area, and it is even impossible to confirm whether there is an illegal base station attack. Unable to locate illegal base station location

[0015] Defects of method 2 (A port signaling monitoring): 1) Not all location updates from LAC=65534 to legal cells are initiated after the pseudo cell is disconnected from the network; 2) It is necessary to detect illegal base stations through A port signaling monitoring Only the continuous trend of the surrounding cells can be used to locate and judge, which has a lot to do with the flow of people around the pseudo-cell; 3) Port A lacks the exact location of the attacked mobile phone (only the actual LAC area where the terminal is located can be judged, the range is too large ), it is difficult to achieve precise positioning

Images