False base stations -- IMSI catchers, Stingrays -- are devices that
impersonate legitimate base stations, as a part of malicious activities like
unauthorized surveillance or communication sabotage. Detecting them on the
network side using 3GPP standardized measurement reports is a promising
technique. While applying predetermined detection rules works well when an
attacker operates a false base station with an illegitimate Physical Cell
Identifiers (PCI), the detection will produce false negatives when a more
resourceful attacker operates the false base station with one of the legitimate
PCIs obtained by scanning the neighborhood first. In this paper, we show how
Machine Learning (ML) can be applied to alleviate such false negatives. We
demonstrate our approach by conducting experiments in a simulation setup using
the ns-3 LTE module. We propose three robust ML features (COL, DIST, XY) based
on Reference Signal Received Power (RSRP) contained in measurement reports and
cell locations. We evaluate four ML models (Regression Clustering, Anomaly
Detection Forest, Autoencoder, and RCGAN) and show that several of them have a
high precision in detection even when the false base station is using a
legitimate PCI. In our experiments with a layout of 12 cells, where one cell
acts as a moving false cell, between 75-95\% of the false positions are
detected by the best model at a cost of 0.5\% false positives.