Detecting IMSI-Catchers by Characterizing Identity Exposing Messages in Cellular Traffic

Our work first seeks to identify all messages that a (GSM/UMTS/LTE) base station can use to force a device to transmit its IMSI according to cellular standards, ultimately producing 53 unique "IMSI-exposing messages". We then create a new detection metric called the "IMSI-exposing ratio" that calculates the ratio of connections including at least one IMSI-exposing messages to the total number of connections in a small time window. The theory behind this metric is that IMSI-Catchers must transmit one of these messages per device to operate, meanwhile legitimate base stations do not need to perform this operation. Furthermore, legitimate base stations will actively minimize the number of IMSI-exposing messages to protect the identifiers associated with the user.