Utafiti huu unapendekeza kundi la ndege zisizo na rubani lililo na vihisi vya masafa ya redio kwa ajili ya kugundua kwa njia passiv na kubaini mahali zilipo fake base stations au IMSI catchers zinazolenga kuelekeza simu za mkononi kujiunganisha nazo katika maeneo mapana. Kila UAV inapendekezwa kubeba software-defined radio, wideband antenna, edge-computing unit inayotegemea NVIDIA Jetson Orin na secure mesh-network communication.

Mfumo uliopendekezwa wa detection hautegemei kiashiria kimoja cha signal. Utambulisho wa base station na frequency allocation, transmit power na signal quality, cellular protocol settings, pamoja na movement na broadcast behavior ya station kwa muda vinatathminiwa kwa pamoja. Taarifa hizi hubadilishwa kuwa 18-dimensional feature vector; rule-based suspicion score inaunganishwa na probability output ya Random Forest classifier ili station iainishwe kuwa legitimate, needing monitoring, suspicious au confirmed threat.

UAV moja inapopata suspicious signal, huomba independent verification kutoka kwa swarm members wengine. Angalau receivers mbili zikithibitisha station hiyo hiyo, swarm huchagua TDoA au AoA localization kulingana na signal continuity, time synchronization, receiver geometry na signal-to-noise ratio. TDoA hutumia tofauti za muda wa signal kufika kwa receivers tofauti, huku AoA ikitumia direction of arrival ya signal.

Controlled laboratory experiments zilifanywa kwa kutumia USRP B210 na mfumo wa srsRAN unaoemulate 4G LTE transmissions. Watafiti waliripoti overall detection rate ya %96,5, false positive rate ya %0,6, swarm verification time ya takriban sekunde 2, end-to-end mission latency ya chini ya sekunde 5 na average TDoA localization error ya mita 0,424 kwa receiver spacing ya mita nne. Hata hivyo, kuna arithmetic na reporting inconsistencies ndani ya utafiti kwa values hizi.

Hakuna operational field test iliyofanywa kwa swarm ya UAV inayoruka kweli. Swarm verification iliigwa kwa receivers tatu za maabara zilizowekwa kwenye known positions. Kulingana na scaling table ya watafiti, consumer-grade GPS na software synchronization zikitumiwa, localization error inaweza kuongezeka hadi takriban mita 10,6 katika real formation ya mita 100 na mita 21,2 katika mita 200.

Kwa mtazamo wa Uturuki: Mbinu hii inaweza kubadilishwa kwa utafiti wa passive RF monitoring unaohusiana na ukaguzi wa miundombinu ya mawasiliano ya simu na mamlaka zilizoidhinishwa nchini Uturuki, perimeter security ya critical facilities, matukio yenye watu wengi na maeneo yenye suspicion ya temporary rogue transmitter. Kwa matumizi, legitimate base-station database maalumu kwa operators na frequency bands za Uturuki inapaswa kuundwa; real flight tests zifanywe katika miji, terrain na building-density tofauti; na BTK authorizations, civil aviation rules, personal-data protection na confidentiality of communications vitathminiwe kwa pamoja. Kutokana na utafiti huu haiwezi kuhitimishwa moja kwa moja kwamba Uturuki itapata %96,5 detection success, field localization ya chini ya nusu mita au direct operational usability.

Fake base station ni nini?

Fake base station ni radio system inayotangaza kama legitimate mobile-operator cell kwa lengo la kuathiri connection behavior ya simu zilizo karibu. Baadhi ya mifumo, inayojulikana pia kama IMSI catchers, inaweza kutumia sifa za cellular protocols kupata permanent au temporary device identifiers, kufuatilia locations, kuelekeza connection kwenye technology yenye security dhaifu zaidi au kuvuruga communication service.

Utafiti unasisitiza hasa ugumu wa kutambua portable rogue stations. Vifaa hivi vinaweza kufanya kazi kwa muda mfupi, kubadilisha mahali kwa gari au mtu, kuiga legitimate cell identities na kubadilisha transmit power ili kukwepa fixed ground sensors. Ground teams zinapolazimika kuscan eneo kubwa, changamoto za coverage, response time na physical access hutokea.

Uchunguzi wa kifaa halisi umeakisiwaje katika utafiti?

Watafiti wanaeleza kwamba threat model ilitokana na technical examination ya IMSI catcher halisi iliyogunduliwa na law enforcement mwanzoni mwa 2025. Kielelezo 1 kwenye ukurasa wa 4 wa utafiti kinaonyesha kwa nambari software-defined radios nyingi, RF splitters, power amplifiers, filters, network switch na power components zilizowekwa ndani ya metal enclosure.

Imeelezwa kwamba kifaa kilichochunguzwa kilikuwa na software-defined radios tisa na kwamba mfumo uliweza kutumia frequencies tofauti wakati mmoja kwa scanning, transmission au monitoring. Uchambuzi huu ndio msingi wa mtazamo wa watafiti kwamba rogue stations hazipaswi kuigwa tu kama simple single-transmitter laboratory devices.

Hata hivyo, experimental evaluation haikufanywa kwa kuendesha moja kwa moja kifaa hiki kilichokamatwa. Attack behaviors ziliundwa katika separate safe laboratory emulation inayotegemea USRP B210 na srsRAN. Real-device analysis ilitoa threat model, huku performance tests zikifanywa kwa synthetic na controlled transmissions.

Kwa nini UAV swarm inatumika?

UAV nyingi huangalia radio source hiyo hiyo kutoka positions tofauti na kutoa faida tatu. Kwanza, maeneo makubwa yanaweza kuscanwa kwa haraka zaidi kuliko sensor moja iliyowekwa. Pili, alarm kutoka receiver moja inaweza kuthibitishwa na UAV nyingine na hivyo kupunguza false-alarm risk. Tatu, receivers kuwa katika positions tofauti huruhusu geometric localization ya signal source.

Mtandao unaoundwa kati ya UAV unaitwa Flying Ad Hoc Network au FANET. Muundo huu unalenga kuruhusu UAV kuwasiliana kupitia separate mesh network wakati cellular communication infrastructure si ya kuaminika au yenyewe ndiyo target inayochunguzwa.

Tabaka tano za UAV platform

Kielelezo 2 kwenye ukurasa wa 5 wa utafiti kinaonyesha physical UAV prototype inayobeba NVIDIA Jetson Orin processing unit na RF hardware. Hata hivyo, katika localization experiment UAV tatu za kimwili hazikurushwa kwa wakati mmoja; receivers tatu zilitumiwa kwenye fixed laboratory coordinates.

Ground Control Station inafanya nini?

Web-based Ground Control Station huonyesha UAV positions, flight paths, battery status, communication links na RF analyses kwenye screen moja. Telemetry, SDR output na camera feed hupokelewa kutoka separate UDP endpoints; SSH connection kwa Jetson computer hutolewa kwa maintenance na management.

Kielelezo 3 kwenye ukurasa wa 7 wa utafiti kinaonyesha control panel ambako connection settings zinafanywa. Kielelezo 4 kinaonyesha messaging kati ya Ground Control Station na UAV tatu kama sequence diagram.

Swarm mission yenye hatua tano

1. Distributed patrol: Kila UAV huscan spectrum katika region iliyopewa na kutafuta anomaly kwa local machine-learning model.
2. Independent verification: Alarm ya kwanza hutumwa kwa UAV nyingine. Angalau UAV mbili lazima zithibitishe kwamba station hiyo hiyo ni suspicious.
3. Leader selection na formation: UAV iliyotoa alarm ya kwanza huwa leader; nyingine huteuliwa kuwa followers na suitable triangular geometry huhesabiwa.
4. Localization: Leader huchagua TDoA au AoA kulingana na signal na formation conditions na kutuma new positions kwa followers.
5. Mission completion: Final location estimate hutumwa kwa Ground Control Station; UAV husynchronize logs na kurudi patrol.

Detection system yenye tabaka nne

A. Identity na frequency verification

Tabaka la kwanza linalinganisha PLMN, MCC, MNC, TAC, cell identity na EARFCN zinazotangazwa na station na trusted operator records. Invalid au geographically inconsistent tracking-area code, unusual cell-identity partitioning au frequency ambayo haijapangiwa operator huunda anomaly flag.

B. RF power na quality analysis

Received reference-signal power husanifishwa kulingana na mean na standard deviation ya legitimate cells katika frequency band hiyo hiyo:

\[ Z_i= \frac{RSRP_i-\mu_{\mathrm{band}}} {\sigma_{\mathrm{band}}} \]

Values zenye \(|Z_i|>2\) huchukuliwa kuwa unusual power indicator. Strong RSRP kuonekana pamoja na low RSRQ au SINR hutathminiwa kama ishara ya transmitter inayotumia high gain lakini isiyo na carrier-class calibration.

Carrier frequency offset huhesabiwa kwa namna hii:

\[ CFO_i=f_{\mathrm{ölçülen}}-f_{\mathrm{beklenen}} \]

Katika utafiti, offsets za zaidi ya 100 Hz zilitumiwa kama anomaly threshold zinazohusishwa na low-cost SDR oscillators.

C. Cellular protocol analysis

SIB1 na SIB2 messages hufumbuliwa na encryption options, cell-access settings, random-access configuration na broadcast timing huchunguzwa. Kutangaza EEA0 zero-encryption option pekee kumechukuliwa katika utafiti kuwa strongest single rogue-station indicator.

Cell kuonyeshwa kuwa access barred, reselection behavior kuzuiwa, PRACH parameters zisizolingana na operator structure au unusual connection latencies pia huongezwa kwenye protocol score.

D. Time na location context

Apparent movement speed ya base station kati ya observations zinazofuatana huhesabiwa kama:

\[ v_i= \frac{d(G_{t+1},G_t)} {t_{t+1}-t_t} \]

Hapa \(d\) ni Haversine distance kati ya geographical positions mbili. Short-lived transmission, kuonekana tena katika locations tofauti na rapid changes za broadcast parameters hutathminiwa kama portable-station behavior.

Kipimo kilichotolewa kwa broadcast stability ni:

\[ S_{\mathrm{kararlılık}} = 1- \frac{\operatorname{Var}(P_t)} {\mu(P_t)} \]

Value hii huhesabiwa tu ikiwa kuna angalau observations tatu zinazofuatana.

Machine learning na decision fusion

Feature vector ya dimensions 18 huundwa kwa kuchukua identity features tatu, RF features tano, protocol features tano na contextual features tano kutoka tabaka nne. Binary indicators huwa 0 au 1, na continuous variables huletwa kwenye range ya 0–1 kwa min–max values zilizohesabiwa kutoka training partition.

Weighted sum ya layer scores huhesabiwa kama:

\[ S_{\mathrm{toplam}} = w_A\widehat{S}_{\mathrm{kimlik}} + w_B\widehat{S}_{\mathrm{RF}} + w_C\widehat{S}_{\mathrm{protokol}} + w_D\widehat{S}_{\mathrm{bağlam}} \]

Final score huunganishwa na probability ya rogue station kutoka Random Forest model kwa namna hii:

\[ S_{\mathrm{nihai}} = \lambda S_{\mathrm{toplam}} + (1-\lambda)\,100\,P(\mathrm{sahte}\mid x_i) \]

TDoA localization

Mbinu ya TDoA hutumia tofauti za muda wa signal hiyo hiyo kufika kwa UAV tofauti:

\[ \Delta t_{ij} = \frac{ \lVert p_T-p_i\rVert- \lVert p_T-p_j\rVert }{c} \]

\(p_T\) ni unknown transmitter position, \(p_i\) na \(p_j\) ni UAV positions, na \(c\) ni speed of light. Receivers tatu hutoa independent time differences mbili na transmitter position huhesabiwa kutoka intersection ya hyperbolic surfaces.

Kuongeza carrier phase difference kunalenga kuboresha coarse location iliyotokana na time difference kwa resolution ndogo kuliko wavelength. Hata hivyo, mbinu hii inahitaji high time synchronization na suitable receiver geometry.

AoA localization

AoA hupima angle ambayo signal inafika kwa kila receiver:

\[ \theta_i= \arctan \left( \frac{y_T-y_i} {x_T-x_i} \right) \]

Intersection ya direction lines zilizopimwa kutoka angalau positions mbili tofauti hutoa transmitter position. Kwa sababu AoA haihitaji nanosecond-level time matching kati ya receivers, inapendelewa katika short na intermittent transmissions. Kwa upande mwingine, errors katika antenna orientation na UAV heading angle zinaweza kuathiri localization result moja kwa moja.

RSSI backup kwa UAV moja

Ikiwa UAV moja tu ndiyo inafanya kazi, coarse RSSI gradient method inayosogea kuelekea direction ambako signal strength inaongezeka inapendekezwa. Watafiti wanaeleza kwamba mbinu hii haifai katika laboratory experiment ya mita 4 na inahitaji initial distance ya angalau mita 20–50 katika open field.

RSSI method iliondolewa kwenye localization results. Hata hivyo, katika first hybrid fusion attempt, kuingiza invalid RSSI estimates kwenye final result kulisababisha average error kubwa ya mita 22,52. Watafiti wanapendekeza kwamba katika siku zijazo unreliable methods ziondolewe kabisa badala ya kubaki na low weight.

Matokeo yanayoungwa mkono na utafiti

• Kutumia identity, RF, protocol na temporal context kwa pamoja kunaweza kuchunguza rogue-station behaviors tofauti ndani ya framework moja.
• Protocol scenario iliyotangaza zero-encryption option pekee iligunduliwa katika samples zote kwenye controlled experiment.
• RF frequency na power instability ziliweza kutoa detection indicator hata wakati identity information ilibaki legitimate.
• Verification kutoka receivers nyingi hutoa second security gate baada ya alarm ya sensor moja.
• TDoA ilitoa localization error ndogo kuliko AoA kwa stationary na continuously transmitting laboratory transmitters.
• AoA ilitoa error ndogo kuliko TDoA katika portable, short-lived transmitter scenario.

Mambo ambayo utafiti haujathibitisha

• Hauthibitishi kwamba UAV tatu zinazorusha kweli zitatoa performance hiyo hiyo.
• Haionyeshi kwamba IMSI catcher halisi iliyokamatwa iligunduliwa experimentally na mfumo uliopendekezwa.
• Hautoi experimental validation kwenye 5G standalone networks.
• Haionyeshi generalizability katika mobile operators tofauti, cities, rural areas au dense built environments.
• Hauthibitishi localization error ya chini ya nusu mita katika real field environment.
• Values za 100 na 200 meter UAV formations si measurements, bali scaling estimates kutoka laboratory result.
• Haipimi real effects za wind, vibration, orientation change na formation distortion kwenye AoA na TDoA.
• Hairuhusu detection rate ya %96,5 kuhesabiwa upya kwa consistency na numerical explanations zote ndani ya utafiti.

Nguvu za utafiti

Nguvu kuu ya utafiti ni kutoa multi-layer defense approach isiyotegemea tu high signal strength au single cell-identity error. Hata attacker akiiga identity fields fulani kwa usahihi, frequency instability, protocol behavior au movement over time inaweza kuacha dalili katika tabaka nyingine.

Threat model kutengenezwa kutokana na uchunguzi wa real multi-SDR device kunatoa starting point halisi zaidi kuliko tafiti zinazodhani simple laboratory transmitters pekee. Kufanya experiments katika safe, low-power controlled environment pia kunazuia kuathiri real mobile subscribers.

Watafiti kuripoti wazi failed hybrid localization fusion na kueleza sababu ya error ya mita 22,52 ni mojawapo ya nguvu za utafiti. Matokeo haya yanaonyesha kwamba kuunganisha methods zote bila masharti hakutoi improvement kila wakati.

Mapungufu makuu na inconsistencies

• Utafiti ni preprint ambayo haijapitia peer review.
• UAV swarm haikuigwa ikiwa inaruka, bali kwa receivers tatu stationary.
• Umbali kati ya laboratory receivers ni mita 4 tu.
• Operational 100–200 meter results si experimental measurements, bali linear scaling estimates.
• Legitimate data inategemea cell ya operator mmoja tu katika eneo la Athens.
• Supervised dataset ina 200 legitimate na 200 rogue samples tu.
• Ingawa five-fold cross-validation imetajwa, imeandikwa kwamba katika kila fold %70 training na %30 test zilitumiwa; maelezo haya hayaendani na classic five-fold split.
• Katika R1, ingawa inasemekana samples mbili zilizobaki pia zilipatikana kwa RF layer, overall success imetolewa kama %98.
• Katika R3, ingawa inasemekana samples sita zilizobaki zilipatikana kwa power instability, overall success imetolewa kama %92.
• Katika R4, kukosa sample moja kati ya 15 kunalingana na success ya %93,3, lakini %96 imeripotiwa.
• Kwa R4, main data description inataja 50 rogue samples, lakini scenario section inataja 15 active samples.
• Physical consistency threshold imetolewa kama mita 300 katika general table na mita 50 katika R1 experiment description.
• Average ya TDoA katika four equal-sized localization scenarios hailingani arithmetically na mita 0,424 iliyo kwenye graph.
• Kwa R2, proposed method ni “hybrid” lakini actual best method ni TDoA, huku consistency column ikiwekwa correct.
• Hakuna open-access link iliyotolewa kwa raw dataset na implementation code.
• Hakuna standard deviation au confidence interval iliyotolewa kwa different model runs.

Ni validation gani zinahitajika baadaye?

Kwanza, field experiment inapaswa kufanywa kwa angalau UAV tatu zinazorusha kweli, katika formations za mita 100–200 na wind conditions tofauti. Athari ya UAV vibration kwenye antenna phase, compass error kwenye AoA na formation drift kwenye GDOP inapaswa kupimwa kando.

Model inapaswa kufanyiwa external validation kwa mobile operators tofauti, frequency bands, urban structures na rural areas. Kwa kila mazingira mapya, inapaswa kuripotiwa ni data kiasi gani kinahitajika kuunda legitimate RSRP na CFO baseline kwa reliability.

Kwa 5G, identity fields kama GUTI, SUCI na SUPI, beamforming behavior na 5G-specific SIB messages vinapaswa kuongezwa kwenye mfumo. Hata hivyo, haipaswi kudhaniwa kwamba 4G results zinageneralize moja kwa moja kwa 5G kwa sababu tu ya architectural similarity.

Hatimaye, data split, sample counts, confusion matrix na scenario successes vinapaswa kuchapishwa wazi; code, configuration na anonymized RF features zishirikishwe ili independent research teams ziweze kuhesabu tena results.

Mbinu na Matokeo ya Utafiti

Experimental setup

Controlled rogue-station scenarios nne

Detection results zilizoripotiwa

Scenario suspicion scores

Swarm verification results

Scenario R3 ilitoa slowest verification kwa sababu confidence scores katika secondary receivers ziliathiriwa na RF fluctuations. Katika R1, strong na stable signal ilionekana haraka kwa receivers zote.

Swarm verification kwa signal strength

Kielelezo 15 kinaonyesha kwamba signal inapodhoofika, verification rate hupungua na latency huongezeka. Ingawa inabaki ndani ya time limit ya sekunde tano, karibu robo ya signals zilizo chini ya −80 dBm hazikupata sufficient swarm verification.

Localization results

Kulingana na maelezo kwamba samples 25 zilitumiwa katika kila scenario, simple average ya TDoA values nne ni takriban mita 0,503 na average ya AoA values ni takriban mita 0,785. Haijaelezwa jinsi overall averages za mita 0,424 na 0,811 katika Kielelezo 16 zilivyohesabiwa.

Validation ya adaptive method selection

Matokeo ya R3 yanaonyesha kwamba moderate frequency instability haifanyi TDoA kuwa unusable lazima wakati synchronized receivers tatu zipo. Watafiti wanapendekeza kusasisha selection strategy na kuipa TDoA priority ikiwa kuna synchronized receivers tatu au zaidi.

Scaling kutoka laboratory hadi real formation

Jedwali hili halionyeshi measured field results, bali estimates zilizotengenezwa na watafiti kwa linear-error scaling assumption. Hasa, expected error katika real formation kwa consumer hardware ni kubwa zaidi kwa kiasi kikubwa kuliko mita 0,424 ya laboratory.

Kikomo cha mbinu kwa privacy na sheria

Mfumo uliopendekezwa unalenga kufuatilia tu downlink broadcast parameters na physical RF characteristics za base stations kwa njia passiv. Haulazimishi simu kujiunganisha nao, haudecode subscriber traffic na haulengi kukusanya IMSI.

Hata hivyo, airborne monitoring ya cellular spectrum, high-resolution localization na UAV operations ziko chini ya regulations rasmi kuhusu confidentiality of communications, personal-data protection, civil aviation na authority limits. Kuwa passive kitaalamu hakumaanishi mfumo unaweza kutumiwa bila ruhusa.

Dokezo la Chanzo na Mbinu

Utafiti huu ni preprint ambayo haijapitia peer review. DOI inatambulisha SSRN study record na haionyeshi acceptance ya peer-reviewed journal article. Kauli “submitted to Ad Hoc Networks” haimaanishi acceptance au publication na journal.

Scientific content ya makala hii ya Verianla imeandaliwa kwa msingi wa maandishi, equations, tables, graphs na visuals za utafiti uliopakiwa pekee. External sources zilitumiwa tu kwa bibliographic verification ya title, author order, institutional affiliation, DOI, SSRN upload date na official publication status.

Ushahidi mkuu wa experimental katika utafiti ni low-power na safe 4G LTE laboratory emulation. Real-device examination ilichangia threat model; lakini performance experiments hazikufanywa kwa real seized device.

Matokeo ya “UAV swarm” hayakutokana na UAV tatu katika real-time flight, bali receivers tatu zilizowekwa stationary katika laboratory. Tofauti hii ni muhimu hasa kwa athari za vibration, orientation, wind, GPS error na variable formation geometry kwenye localization.

Detection rate ya %96,5, false positive rate ya %0,6 na localization error ya mita 0,424 zilizoripotiwa katika utafiti haziendani kikamilifu na sample counts na baadhi ya intermediate results katika scenario descriptions. Ili matokeo yaweze kuthibitishwa independently, sample-level predictions, data split lists, confusion matrices na computation code zinapaswa kuchapishwa.

Mfumo unapaswa kutathminiwa tu ndani ya authorized na lawful passive infrastructure monitoring. Model output pekee si legal proof kwamba transmitter ni illegal; lazima ithibitishwe kwa operator records, spectrum measurements, authorized technical examination na evidence integrity.