The advancement of cellular communication technology has profoundly transformed human life. People can now watch high-definition videos anytime, anywhere, and aim for the implementation of advanced autonomous driving capabilities. However, the sustainability of such an environment is threatened by false base stations. False base stations execute attacks in the Radio Access Network (RAN) of cellular systems, adversely affecting the network or its users. To address this challenge, we propose a behavior rule specification-based false base station detection system, SMDFbs. We derive behavior rules from the normal operations of base stations and convert these rules into a state machine. Based on this state machine, we detect network anomalies and mitigate threats. We conducted experiments detecting false base stations in a 5G RAN simulator, comparing our system with seven machine learning-based detection techniques. The experimental results showed that our proposed system achieved a detection accuracy of 98% and demonstrated lower overhead compared to other algorithms.

Electric vehicle (EV) chargers are often deployed in public spaces, making them easily accessible targets for cyber attackers. Moreover, EV chargers are components of EV charging infrastructure in which IT and OT domains coexist; thus, if they are compromised and used as intrusion points, they may affect the entire EV charging infrastructure. To address this issue, this paper proposes SMDEVC, which applies a specification-based intrusion detection paradigm to electric vehicle supply equipment (EVSE) by combining behavior-rule specification with UPPAAL verification. The proposed system specifies the normal behavior rules of EV chargers and classifies behaviors that deviate from these rules as abnormal. In addition, the proposed system reduces false positives through compliance-degree feedback. Using the CICEVSE2024 dataset, we conducted experiments to compare the detection performance and resource efficiency of the proposed system with those of machine learning, deep learning, and hybrid models. The experimental results show that the proposed SMDEVC achieved an accuracy of 96.0% and an F1-score of 97.9% on the CICEVSE2024 network dataset. In addition, the proposed system reduced peak memory usage by up to 99.6% compared with the other methods.

False base station (FBS) attacks exploit the attach window before the network authenticates to the device. Existing User Equipment (UE)-side detectors typically need either labeled attack data, which is scarce and does not generalize to unseen attacks, or models too heavy for the resource budget of a smartphone or embedded endpoint. This study presents a lightweight UE-side detector built on a first-order Markov chain over a four-tuple state of packet type, direction, message identifier, and access-network type. A single counting pass fits the 119 KB chain, and thresholds are derived from normal traffic, so no attack labels are consulted. The capture path requires root and Qualcomm modem diagnostic access. Attacks surface as low-probability transitions, rare field values, and anomalous pacing, fused into a per session verdict with per-message attribution. On 192 commercial, testbed, and public LTE and 5G captures, the detector flags 51 of 53 attacks at an F1 of 88.70% in leakage-free leave-one-session-out evaluation and 96.23% once calibration covers the scored sessions. In five-fold cross-validation its F1 of 86.21% trails the strongest supervised baselines by margins that are not statistically significant, and it records the lowest latency (0.46 ms) and smallest working set (8.8 MB) among the eleven detectors benchmarked.

Fifth- and sixth-generation cellular networks remain exposed to a spectrum of threats ranging from the stealthy and targeted false base station (FBS) to the systemic distributed denial-of-service (DDoS) and signaling-storm attacks. The elevation of artificial intelligence (AI) to a native network capability by the International Telecommunication Union Radiocommunication Sector (ITU-R) framework for International Mobile Telecommunications-2030 (IMT-2030) has made learning-based defense the dominant response. This survey examines that response across the three threats jointly, advancing as a design position the view that effective defense is best served when AI is integrated into the radio access network (RAN) and core as a native function rather than appended as an external classifier. We organize the literature by five technique families, namely classical machine learning, deep learning, generative models, federated learning, and large language and agentic models, and for each we record not only how it detects an attack but where in the Open RAN (O-RAN) architecture it is deployed, mapping the surveyed methods onto the user equipment, the near-real-time and non-real-time RAN Intelligent Controller, and the 5G-core network function. Three observations organize the account: the three threats form a data-scarcity gradient that illuminates the progression of techniques; the deployment dimension, the question of where and how, is the one the primary literature most often omits and the one a practitioner most needs; and several threat-technique combinations that the architecture permits remain unexplored. Drawing on a semi-systematic review of 177 studies, the survey consolidates the datasets and reported performance that make learning feasible, examines the adversarial robustness of the defenses themselves, and sets out a forward agenda toward quantum-AI-native defense within the RAN.