CN110753349A - Method and device for identifying pseudo base station - Google Patents

Abstract

The invention discloses a method and device for identifying a pseudo base station. Since the pseudo base station is mainly used to obtain user IMSI or send spam short messages, and cannot provide complete services for users, the traffic ratio between the control plane and the user plane of the pseudo base station is legal and legal. Compared with base stations, there are obvious differences. The present invention proposes for the first time the basic idea of identifying base station types through traffic analysis on the control plane and the user plane, which effectively improves the accuracy of identifying pseudo base stations, and can complete the identification before the user terminal accesses the pseudo base stations. The ability of user terminals to prevent being adsorbed by fake base stations, protect the security of user identity information, and prevent users from receiving spam text messages or fraudulent information. It is of great significance to crack down on illegal and criminal acts of pseudo base stations and maintain social information security.

Description

Method and device for identifying pseudo base station

technical field

The invention belongs to the technical field of communication, and in particular relates to a method and device for identifying a pseudo base station.

Background technique

A fake base station is an illegal radio communication device that pretends to be a legitimate base station of an operator to deceive user terminals to access, steal and embezzle user information, send fraudulent short messages and other illegal activities, which pose great hidden dangers to public security. Therefore, how to identify the pseudo base station is one of the important security issues in wireless communication. How the pseudo base station is implemented and its capabilities largely depend on the corresponding network, such as GSM, 4G, etc. Due to the security vulnerability of one-way authentication in the GSM network, the terminal cannot verify the identity of the base station. The fake base station can easily attract the terminal, steal and steal user identity information, send spam text messages, and even conduct man-in-the-middle attacks, that is, the fake base station acts as a terminal and legitimate The middleman between the base stations conducts eavesdropping and tampering of information.

With the development of wireless communication technology, 4G network has been commercialized on a large scale. 4G uses two-way authentication to make up for the security problems exposed by GSM. However, the problem of pseudo base stations has not been completely solved, and pseudo base stations for 4G networks have emerged. The principle of the 4G pseudo base station mainly includes: in order to obtain the user IMSI, the pseudo base station triggers the terminal to make a TAU (Tracking Area Update) request, and replies with the EMM reason #9, that is, "UE identity cannot be derived by the network" The rejection signaling forces the The terminal reports its own IMSI; or makes the terminal reply its own identity information through the Identity Request in the Attach process; the pseudo base station can redirect the terminal to the GSM network through Connection Release after rejecting the terminal's Attach request, using the one-way authentication vulnerability of the GSM network conduct further attacks.

For the problem of fake base stations, the industry mainly focuses on three aspects: identification, positioning and tracking of fake base stations, and forensics methods. The present invention mainly focuses on the identification problem of pseudo base stations. At present, the technologies for identifying pseudo base stations can be divided into the following three categories:

1) Identify the pseudo base station according to the access parameter characteristics:

In order to attract a large number of terminals, the pseudo base station needs to set relatively extreme parameters related to cell selection and reselection, so as to frequently trigger the terminals to perform cell reselection, TAU update and other processes. For example, in a GSM network, relevant parameters include the minimum access level of a cell, a cell reselection bias, and the like. The terminal selects whether to perform access by judging whether the access parameters of the cell to be accessed conform to the characteristics of the pseudo base station, so as to reduce the risk of accessing the pseudo base station.

2) The operator identifies the pseudo base station according to the abnormal signaling:

The pseudo base station needs to kick out the access terminal after obtaining the user's IMSI or sending spam short messages. Therefore, there will be a large number of unknown terminals requesting access in the legal cells around the pseudo base station. The operator can find out the abnormal area of signaling through signaling analysis, and judge whether there is a pseudo base station in the area. Due to the existence of the pseudo base station, the terminals in the coverage area of the pseudo base station will receive a large number of spam text messages, and the call drop or even the denial of service will occur, which will reduce the user experience and cause complaints. Operators can analyze whether there are fake base stations in the complaint area by summarizing complaint cases.

3) Identify the pseudo base station according to the abnormal behavior after access:

If the terminal receives a large number of spam short messages after completing the access process or some network functions cannot be implemented, the terminal can determine whether to access the pseudo base station by itself.

To sum up, the prior art has the following defects and deficiencies:

1) Limitations: At present, the vast majority of technologies for identifying pseudo base stations can only identify GSM pseudo base stations.

2) Accuracy: With the isomerization of the network structure, the setting of network parameters becomes more complex and diverse, and it is difficult to guarantee the accuracy of identifying the pseudo base station according to the characteristics of the access parameters.

3) Prevention capability: The two methods of identifying the pseudo base station by analyzing the signaling abnormalities in the network and identifying the pseudo base station according to the abnormal behavior after access are unavoidable for the terminal to be adsorbed by the pseudo base station. Only after being kicked out of access to the public network by the pseudo base station, the terminal can report abnormal signaling and wait for the operator to judge and deal with it.

SUMMARY OF THE INVENTION

Aiming at the technical problems in the prior art, the present invention provides a method and device for identifying pseudo base stations, the purpose of which is to improve the accuracy of pseudo base station identification and enhance the ability of terminals to prevent being adsorbed by pseudo base stations.

In order to solve the above-mentioned technical problems, the present invention is solved by the following technical solutions:

A method for identifying a pseudo base station, comprising the following steps:

Step 1: Detect the PRACH of the cell to be accessed, monitor the random access process of the user requesting access, and extract the C-RNTI corresponding to each user among the N successfully accessed users;

Step 2: within the time T, blindly detect the PDCCH according to the C-RNTI corresponding to each user, and obtain the resource allocation information of the PDSCH of each user;

Step 3: According to the resource allocation information of the PDSCH of each user obtained in step 2, the traffic ratio of the control plane and the user plane in the PDSCH of each user in the statistical time T;

Step 4: Determine whether the cell to be accessed is a pseudo base station according to the traffic ratio between the control plane and the user plane in the PDSCH for each of the N users.

Further, the step 1 specifically includes the following steps:

Step 1.1: Detect the PRACH of the cell to be accessed, and obtain the corresponding RA-RNTI of the user requesting access;

Step 1.2: use the RA-RNTI to detect the PDCCH, and obtain the MSG2 on the PDSCH; obtain the TC-RNTI and the PUSCH resource allocation information of the MSG3 through the ULGrant included in the MSG2;

Step 1.3: monitor MSG3 according to the PUSCH resource allocation information of MSG3; obtain the user's identity for conflict resolution from MSG3;

Step 1.4: After monitoring MSG3, use TC-RNTI to detect PDCCH, and obtain MSG4 on PDSCH;

Step 1.5: If the acquired MSG4 contains the user's identity for conflict resolution, the user's random access procedure is successful, and C-RNTI=TC-RNTI.

Further, the step 3 is specifically: distinguishing the control plane and user plane traffic according to the LCID of the MAC subheader, and obtaining the PDCP packet length through the PDCP layer header, and counting the control plane and the user plane in the PDSCH within the T time of each user. and calculate the traffic ratio between the control plane and the user plane in the PDSCH within each user T time.

Further, the step 4 specifically includes the following steps:

Step 4.1: determine whether the traffic ratio of the control plane and the user plane in the PDSCH of each user is higher than the preset first threshold value within the time T;

Step 4.2: According to the judgment result of Step 4.1, count the number of users whose traffic ratio between the control plane and the user plane in the PDSCH in the time T is higher than the first threshold among the N users, denoted as M;

Step 4.3: if the value of M/N is greater than the preset second threshold, determine that the cell to be accessed is a pseudo base station; otherwise, determine that the cell to be accessed is a legal base station;

Wherein, the first threshold is the threshold of the traffic ratio between the control plane and the user plane corresponding to time T; the second threshold is the number M of users whose traffic ratio between the control plane and the user plane is higher than the first threshold, accounting for the total detected users Scale threshold for number N.

Further, the first threshold and the second threshold are obtained through neural network training in advance.

Further, the first threshold and the second threshold are obtained through support vector machine training in advance.

Further, the step 4 is specifically:

The detection model is obtained through neural network or support vector machine training in advance; the access network type, the number of users N, the time T and the traffic ratio of the control plane and the user plane of the corresponding users are input into the detection model; if the cell to be accessed is pseudo When the cell is a base station, the detection model outputs the cell to be accessed as a pseudo base station; if the cell to be accessed is a legal base station, the detection model outputs the cell to be accessed as a legal base station.

Further, the following steps are also included:

Step 5: After judging that the cell to be accessed is a pseudo base station, the user terminal blacklists the cell to be accessed, performs cell selection again, and executes steps 1 to 4 until it is determined that the cell to be accessed is a legitimate base station ;

Step 6: After accessing the legal cell, the user terminal reports the abnormal information to the legal base station.

A device for identifying a pseudo base station, comprising:

The monitoring module is used to detect the PRACH of the cell to be accessed, monitor the random access process of the user requesting access, and extract the C-RNTI corresponding to each user among the N users who have successfully accessed; , respectively blindly detect the PDCCH according to the C-RNTI corresponding to each user, and obtain the resource allocation information of the PDSCH of each user;

A statistics module, used for statistics of the traffic ratio between the control plane and the user plane in the PDSCH of each user described in the time T;

The judgment module is used for judging whether the cell to be accessed is a pseudo base station according to the traffic ratio of the control plane and the user plane in the PDSCH of each user in the time T; Whether the traffic ratio between the control plane and the user plane is higher than the preset first threshold; according to the judgment result, count the ratios of the traffic between the control plane and the user plane in the PDSCH within the time T of the N users that are higher than the first threshold. The number of users, denoted as M; if the value of M/N is greater than the preset second threshold, it is determined that the cell to be accessed is a pseudo base station; otherwise, the cell to be accessed is determined to be a legal base station;

Wherein, the first threshold is the threshold of the traffic ratio between the control plane and the user plane corresponding to time T; the second threshold is the number M of users whose traffic ratio between the control plane and the user plane is higher than the first threshold, accounting for the total detected users Scale threshold for number N.

Further, it also includes: a reporting module, configured to blacklist the cell to be accessed when the cell to be accessed is a pseudo base station, and report abnormal information to the legal base station.

Compared with the prior art, the present invention has at least the following beneficial effects: a method for identifying a pseudo base station according to the present invention, by detecting the PRACH of the cell to be accessed, monitoring the random access process of the user requesting access, and after N successful accesses Among the entered users, the C-RNTI corresponding to each user is extracted; within the time T, the PDCCH is blindly detected according to the C-RNTI corresponding to each user, and the resource allocation information of each user's PDSCH is obtained; The traffic ratio of the control plane and the user plane in the PDSCH of each user; according to the traffic ratio of the control plane and the user plane in the PDSCH of each user among the N users, it is judged whether the cell to be accessed is a pseudo base station; Whether the traffic ratio between the control plane and the user plane in the PDSCH within the T period is higher than the preset first threshold; according to the judgment result, it is calculated that the traffic ratio of the control plane and the user plane in the PDSCH within the T period of the N users is higher than the first threshold. The number of users with a threshold is denoted as M; if the value of M/N is greater than the preset second threshold, the cell to be accessed is determined to be a pseudo base station; otherwise, the cell to be accessed is determined to be a legitimate base station. Since the pseudo base station is mainly used to obtain user IMSI or send spam short messages, and cannot provide complete services for users, the traffic ratio between the control plane and the user plane of the pseudo base station is obviously different from that of the legal base station. The basic idea of identifying base station types with user plane traffic analysis can effectively improve the accuracy of identifying pseudo base stations, and can complete the identification before user terminals access pseudo base stations, enhance the ability of user terminals to prevent being adsorbed by pseudo base stations, and protect user identity information Safe to prevent users from receiving spam or scam messages. It is of great significance to crack down on illegal and criminal acts of pseudo base stations and maintain social information security.

In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below, and are described in detail as follows in conjunction with the accompanying drawings.

Description of drawings

In order to illustrate the technical solutions in the specific embodiments of the present invention more clearly, the following briefly introduces the accompanying drawings used in the description of the specific embodiments. Obviously, the accompanying drawings in the following description are some embodiments of the present invention. , for those of ordinary skill in the art, other drawings can also be obtained based on these drawings without any creative effort.

FIG. 1 is a schematic diagram of an application scenario of an example of the present invention.

FIG. 2 is a flowchart of a method for identifying a 4G pseudo base station according to an example of the present invention.

Detailed ways

In order to make the purposes, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of them. example. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

First, for ease of understanding, the principle of the random access process involved in each embodiment is briefly introduced here.

The user terminal accesses the cell to be accessed through the random access process. The contention-based random access process is divided into the following four steps:

In the first step, the user terminal sends a random access preamble on PRACH;

In the second step, after receiving the random access preamble sent by the user terminal, the base station returns a random access response to the user terminal, and the random access response is called MSG2;

MSG2 includes the temporary identifier TC-RNTI allocated by the base station for the user terminal and the PUSCH resource allocation of MSG3;

The contention-based random access procedure needs to complete the access conflict resolution through the third and fourth steps. In the third step, the messages sent by the user terminal to the base station are collectively referred to as MSG3; in the fourth step, the messages sent by the base station to the user terminal are collectively referred to as MSG4;

In the third step, after receiving MSG2, the user terminal sends MSG3 to the base station on the PUSCH resource allocation of MSG3;

The MSG3 contains an identity for conflict resolution. When the user terminal is in a connected state, the identity for conflict resolution is C-RNTI; when the user terminal is in a disconnected state, the identity for conflict resolution is C-RNTI. It is identified as S-TMSI or a random number generated by the user terminal;

In the fourth step, the base station completes conflict resolution after receiving MSG3, and sends MSG4 to the user terminal; the user terminal receives MSG4, and if the user terminal detects that MSG4 contains its own identity for conflict resolution, it is considered a random access process. Success, the temporary identifier TC-RNTI becomes C-RNTI.

During the random access process, no security context is established between the base station and the user terminal, and messages between the base station and the user terminal are all sent in plaintext. Therefore, the C-RNTI of successfully accessing the user terminal can be obtained by monitoring the random access process of the user terminal.

An application scenario of the present invention is shown in FIG. 1 , which includes a 4G pseudo base station, a plurality of user equipments adsorbed by the pseudo base station, and a user equipment to be accessed. Among them, many users who are attracted by the pseudo base station do not have the ability to identify the pseudo base station and initiate access requests to the 4G pseudo base station. Before initiating an access request, the user to be accessed judges whether the cell to be accessed is a pseudo base station by using the method for identifying a pseudo base station provided by the present invention.

The application scenario of the present invention should not be limited to FIG. 1, and can be used in the initial access process of the user terminal, the cell reselection process, and the like.

As shown in FIG. 2, as a specific embodiment of the present invention, a method for identifying a pseudo base station includes the following steps:

Step 1: Detect the PRACH of the cell to be accessed, monitor the random access process of the user requesting access, and extract the C-RNTI corresponding to each user among the N users who have successfully accessed.

Specifically include the following steps:

Step 1.1: Detect the PRACH of the cell to be accessed, and obtain the corresponding RA-RNTI of the user requesting access;

Step 1.2: use the RA-RNTI to detect the PDCCH, and obtain the MSG2 on the PDSCH; obtain the TC-RNTI and the PUSCH resource allocation information of the MSG3 through the ULGrant included in the MSG2;

Step 1.3: monitor MSG3 according to the PUSCH resource allocation information of MSG3; obtain the user's identity for conflict resolution from MSG3;

Step 1.4: After monitoring MSG3, use TC-RNTI to detect PDCCH, and obtain MSG4 on PDSCH;

Step 1.5: If the acquired MSG4 contains the user's identity for conflict resolution, the user's random access procedure is successful, and C-RNTI=TC-RNTI.

Through the above steps, N successful access users and the C-RNTI corresponding to each user are obtained.

Step 2: During the time T, blindly detect the PDCCH according to the C-RNTI corresponding to each user, and obtain the resource allocation information of the PDSCH of each user.

Step 3: Counting the traffic ratio of the control plane and the user plane in the PDSCH of each user within the time T, specifically: distinguishing the traffic of the control plane and the user plane according to the LCID of the MAC subheader, and obtaining the length of the PDCP packet through the PDCP layer header. The traffic size of the control plane and the user plane in the PDSCH in each user T time, and calculate the traffic ratio of the control plane and the user plane in the PDSCH in each user T time.

Encryption of user data and encryption and integrity protection of control signaling are provided by the PDCP layer. Therefore, regardless of whether the data in the PDSCH is encrypted or integrity protected, the PDCP layer header and the MAC layer header can be obtained.

Each MAC subheader contains a Logical Channel ID (LCID). The LCID indicates whether the payload part of the corresponding MAC subheader is a MAC control element, and if not, indicates which logical channel the MAC SDU belongs to.

Step 4: Determine whether the cell to be accessed is a pseudo base station according to the traffic ratio between the control plane and the user plane in the PDSCH within the time T of each user among the N users.

Since the pseudo base station is mainly used to obtain user IMSI or send spam short messages, and cannot provide users with complete services, the traffic ratio between the control plane and the user plane of the pseudo base station is significantly different from that of the legitimate base station.

Specifically, as a certain preferred embodiment, the following steps are included:

Step 4.1: Determine whether the traffic ratio of the control plane and the user plane in the PDSCH within each user T time is higher than the preset first threshold;

Step 4.2: According to the judgment result of Step 4.1, count the number of users whose traffic ratio between the control plane and the user plane in the PDSCH in the PDSCH is higher than the first threshold within T time among the N users, which is denoted as M;

Step 4.3: if the value of M/N is greater than the preset second threshold, determine that the cell to be accessed is a pseudo base station; otherwise, determine that the cell to be accessed is a legal base station;

Wherein, the first threshold is the threshold of the traffic ratio between the control plane and the user plane corresponding to time T; the second threshold is the ratio of the number of users M whose traffic ratio between the control plane and the user plane is higher than the first threshold to the total number of detected users N threshold. The first threshold and the second threshold are obtained in advance through neural network training or through support vector machine training in advance.

As another preferred embodiment, the judgment is performed by using a detection model trained in advance by methods such as a neural network or a support vector machine. The input information of the detection model includes: the access network type, the number of users N, the time T, and the traffic ratio between the control plane and the user plane of the corresponding user; the output information of the detection model includes: whether the cell to be accessed is a pseudo base station or legitimate base station. That is to say, the detection model is obtained through neural network or support vector machine training in advance; the access network type, the number of users N, the time T, and the traffic ratio between the control plane and the user plane of the corresponding users are input into the detection model; if the cell to be accessed is When it is a pseudo base station, the detection model outputs the cell to be accessed as a pseudo base station; if the cell to be accessed is a legal base station, the detection model outputs the cell to be accessed as a legal base station.

Step 5: After judging that the cell to be accessed is a pseudo base station, the user terminal blacklists the cell to be accessed, and performs steps 1 to 4 to re-select the cell until it is determined that the cell to be accessed is a legitimate base station.

Step 6: After accessing the legal cell, the user terminal reports the abnormal information to the legal base station; wherein, the abnormal information may include one of the following: the physical ID of the cell to be accessed that is judged to be the pseudo base station, the access network type, The time when the pseudo base station is detected and the location of the user terminal, the number of detected users N, the time T, and the detected traffic ratio between the control plane and the user plane of each user, etc.

For example, before the user terminal using the method of the present invention accesses the cell to be accessed, through step 1, it detects 8 user terminals that successfully access the cell, and obtains the information of each user terminal that successfully accesses the cell. C-RNTI. As shown in Table 1:

Table 1 Successfully accessed user terminal and corresponding C-RNTI

User terminals (N=8) 1 2 3 4 5 6 7 8 C-RNTI (decimal) 19841 19681 12381 10848 12684 12952 13558 10472

Through step 2, within 1 minute, the PDCCH is blindly detected according to the C-RNTI corresponding to each user terminal, and the PDSCH resource allocation of each user terminal is obtained. Through step 3, within the 1 minute, according to the PDSCH resource allocation of each user terminal obtained in step 2, the traffic ratio between the control plane and the user plane in the PDSCH of each user terminal is counted. As shown in table 2:

Table 2 Successfully accessed user terminals and the corresponding traffic ratio between the control plane and the user plane

User terminals (N=8) 1 2 3 4 5 6 7 8 CP/UP 73% 95% 80% 78% 93% 87% 67% 85%

Among them, CP represents the Control Plane, that is, the control plane; UP represents the User Plane, that is, the user plane; CP/UP represents the traffic ratio between the control plane and the user plane.

Through step 4, it is determined whether the cell to be accessed is a pseudo base station.

In this example, the first threshold is set to 70% and the second threshold is set to 80%. Specifically, according to the first threshold and the traffic ratio between the control plane and the user plane of the user terminals 1-8 in Table 2, the number of user terminals M=7 whose traffic ratio between the control plane and the user plane is higher than the first threshold can be obtained; according to With N=8, M/N=87.5% can be obtained. Since M/N=87.5% is greater than the second threshold, it is determined that the cell to be accessed is a pseudo base station.

The user terminal may blacklist the cell to be accessed that is determined to be a pseudo base station, perform cell selection again, and perform steps 1 to 4 until it is determined that the cell to be accessed is a legitimate base station.

After accessing the legal cell, the user terminal reports abnormal information to the legal base station.

It should be noted here that the values of the parameters N, M, the first threshold and the second threshold are not limited to the values in this example.

The present invention is a device for identifying a pseudo base station, comprising:

The monitoring module is used to detect the PRACH of the cell to be accessed, monitor the random access process of the user requesting access, and extract the C-RNTI corresponding to each user among the N users who have successfully accessed; and use it within T time , blindly detect the PDCCH according to the C-RNTI corresponding to each user, and obtain the resource allocation information of each user's PDSCH; the specific implementation means are: detecting the PRACH of the cell to be accessed, and obtaining the corresponding RA-RNTI of the user requesting access; Use the RA-RNTI to detect the PDCCH, and obtain the MSG2 on the PDSCH; obtain the TC-RNTI and the PUSCH resource allocation information of the MSG3 through the UL Grant included in the MSG2; monitor the MSG3 according to the PUSCH resource allocation information of the MSG3; obtain the user from the MSG3 After monitoring MSG3, use TC-RNTI to detect PDCCH and obtain MSG4 on PDSCH; if the obtained MSG4 contains the user's identity for conflict resolution, the random access process of the user is successful , C-RNTI=TC-RNTI.

The statistics module is used to count the traffic ratio between the control plane and the user plane in the PDSCH of each user within T time.

The judgment module is used for judging whether the cell to be accessed is a pseudo base station according to the traffic ratio of the control plane and the user plane in the PDSCH within the time T of each user among the N users; Whether the traffic ratio between the plane and the user plane is higher than the preset first threshold; according to the judgment result, count the number of users whose traffic ratio between the control plane and the user plane in the PDSCH in the T time period of the N users is higher than the first threshold, denoted as M; if the value of M/N is greater than the preset second threshold, it is determined that the cell to be accessed is a pseudo base station; otherwise, it is determined that the cell to be accessed is a legal base station; wherein, the first threshold is the control corresponding to time T The threshold of the traffic ratio between the plane and the user plane; the second threshold is the ratio threshold of the number of users M whose traffic ratio of the control plane and the user plane is higher than the first threshold to the total number of detected users N.

The reporting module is used for blacklisting the cell to be accessed when the cell to be accessed is a pseudo base station, and reporting abnormal information to the legal base station.

Finally, it should be noted that the above-mentioned embodiments are only specific implementations of the present invention, and are used to illustrate the technical solutions of the present invention, but not to limit them. The protection scope of the present invention is not limited thereto, although referring to the foregoing The embodiment has been described in detail the present invention, those of ordinary skill in the art should understand: any person skilled in the art who is familiar with the technical field within the technical scope disclosed by the present invention can still modify the technical solutions described in the foregoing embodiments. Or can easily think of changes, or equivalently replace some of the technical features; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be covered in the present invention. within the scope of protection. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims (10)

1. a method for identifying pseudo base station, is characterized in that, comprises the following steps: Step 1: Detect the PRACH of the cell to be accessed, monitor the random access process of the user requesting access, and extract the C-RNTI corresponding to each user among the N successfully accessed users; Step 2: within the time T, blindly detect the PDCCH according to the C-RNTI corresponding to each user, and obtain the resource allocation information of the PDSCH of each user; Step 3: According to the resource allocation information of the PDSCH of each user obtained in step 2, the traffic ratio of the control plane and the user plane in the PDSCH of each user in the statistical time T; Step 4: Determine whether the cell to be accessed is a pseudo base station according to the traffic ratio between the control plane and the user plane in the PDSCH for each of the N users. 2. The method for identifying a pseudo base station according to claim 1, wherein the step 1 specifically comprises the following steps: Step 1.1: Detect the PRACH of the cell to be accessed, and obtain the corresponding RA-RNTI of the user requesting access; Step 1.2: use the RA-RNTI to detect the PDCCH, and obtain the MSG2 on the PDSCH; obtain the TC-RNTI and the PUSCH resource allocation information of the MSG3 through the ULGrant included in the MSG2; Step 1.3: monitor MSG3 according to the PUSCH resource allocation information of MSG3; obtain the user's identity for conflict resolution from MSG3; Step 1.4: After monitoring MSG3, use TC-RNTI to detect PDCCH, and obtain MSG4 on PDSCH; Step 1.5: If the acquired MSG4 contains the user's identity for conflict resolution, the user's random access procedure is successful, and C-RNTI=TC-RNTI. 3. The method for identifying a pseudo base station according to claim 1, wherein the step 3 is specifically: distinguishing the control plane and user plane traffic according to the LCID of the MAC subheader, and obtaining the PDCP packet through the PDCP layer header Length, count the traffic size of the control plane and the user plane in the PDSCH for each user T time, and calculate the traffic ratio of the control plane and the user plane in the PDSCH for each user T time. 4. The method for identifying a pseudo base station according to claim 1, wherein the step 4 specifically comprises the following steps: Step 4.1: determine whether the traffic ratio of the control plane and the user plane in the PDSCH of each user is higher than the preset first threshold value within the time T; Step 4.2: According to the judgment result of Step 4.1, count the number of users whose traffic ratio between the control plane and the user plane in the PDSCH in the time T is higher than the first threshold among the N users, denoted as M; Step 4.3: if the value of M/N is greater than the preset second threshold, determine that the cell to be accessed is a pseudo base station; otherwise, determine that the cell to be accessed is a legal base station; Wherein, the first threshold is the threshold of the traffic ratio between the control plane and the user plane corresponding to time T; the second threshold is the number M of users whose traffic ratio between the control plane and the user plane is higher than the first threshold, accounting for the total detected users Scale threshold for number N. 5 . The method for identifying a pseudo base station according to claim 4 , wherein the first threshold and the second threshold are obtained through neural network training in advance. 6 . 6 . The method for identifying a pseudo base station according to claim 4 , wherein the first threshold and the second threshold are obtained through support vector machine training in advance. 7 . 7. The method for identifying a pseudo base station according to claim 1, wherein the step 4 is specifically: The detection model is obtained through neural network or support vector machine training in advance; the access network type, the number of users N, the time T and the traffic ratio of the control plane and the user plane of the corresponding users are input into the detection model; if the cell to be accessed is pseudo When the cell is a base station, the detection model outputs the cell to be accessed as a pseudo base station; if the cell to be accessed is a legal base station, the detection model outputs the cell to be accessed as a legal base station. 8. The method for identifying a pseudo base station according to claim 1, further comprising the steps of: Step 5: After judging that the cell to be accessed is a pseudo base station, the user terminal blacklists the cell to be accessed, performs cell selection again, and executes steps 1 to 4 until it is determined that the cell to be accessed is a legitimate base station ; Step 6: After accessing the legal cell, the user terminal reports the abnormal information to the legal base station. 9. A device for identifying a pseudo base station, comprising: The monitoring module is used to detect the PRACH of the cell to be accessed, monitor the random access process of the user requesting access, and extract the C-RNTI corresponding to each user among the N users who have successfully accessed; , respectively blindly detect the PDCCH according to the C-RNTI corresponding to each user, and obtain the resource allocation information of the PDSCH of each user; A statistics module, used for statistics of the traffic ratio between the control plane and the user plane in the PDSCH of each user described in the time T; The judgment module is used for judging whether the cell to be accessed is a pseudo base station according to the traffic ratio of the control plane and the user plane in the PDSCH of each user in the time T; Whether the traffic ratio between the control plane and the user plane is higher than the preset first threshold; according to the judgment result, count the ratios of the traffic between the control plane and the user plane in the PDSCH within the time T of the N users that are higher than the first threshold. The number of users, denoted as M; if the value of M/N is greater than the preset second threshold, it is determined that the cell to be accessed is a pseudo base station; otherwise, the cell to be accessed is determined to be a legal base station; Wherein, the first threshold is the threshold of the traffic ratio between the control plane and the user plane corresponding to time T; the second threshold is the number M of users whose traffic ratio between the control plane and the user plane is higher than the first threshold, accounting for the total detected users Scale threshold for number N. 10 . The device for identifying a pseudo base station according to claim 9 , further comprising: a reporting module, configured to blacklist the cell to be accessed when the cell to be accessed is a pseudo base station. 11 . , and report the abnormal information to the legitimate base station.

Images