RF fingerprinting of base stations for network operator identification

Rogue or false base stations (FBSs) in cellular networks are a threat to users' privacy and security and operator's network integrity. FBS detection methods is an active research area, with passive, active and network-based approaches, varying by the degree of interaction required with the network and the amount of information necessary from the network. Radio frequency fingerprinting (RFF) methods have been applied to identify unique radio emitters but have not studied the identification of similarity or common characteristics of emitters. In this work, we aim to identify network operators through radio frequency fingerprinting (RFF) of base stations (BSs). We propose to do so based on the classification of synchronization signals, using a complex-valued convolutional neural network (CNN) architecture. Our results indicate that LTE operators can be identified from raw in-phase and quadrature (I/Q) samples collected over a live network with an accuracy of more than 97%.