A Capability Taxonomy of Rogue Cellular Infrastructure

This concept paper defines the family of rogue cellular infrastructure generatively, from a single structural asymmetry: a user equipment (UE) must act on unauthenticated Access Stratum (AS) information, including system information, cell selection and reselection, neighbor lists, and barring flags, before Non-Access Stratum (NAS) authentication runs. The trust decision precedes the trust check.

From that asymmetry the paper derives a small set of capability primitives, organized as read, write, and control operations over three targets: the UE's world-model, its identity and state, and the communication path. The five primitives (inject, suppress, steer, extract, interpose) span the full connection lifecycle, from selection through connected traffic. They compose to reproduce catalogued devices such as the IMSI catcher, the Stingray, the fabricated network, and the relay as special cases, and they predict combinations that are not yet catalogued. The framework is falsifiable at the primitive level: each capability must name the unauthenticated procedure and protocol state that permit it.

The paper then establishes a correspondence between the attack primitives and the observables available to trajectory-based detection, and shows the correspondence is partial. The write primitives are detectable in trajectory space; the read and path-control primitives are not, which marks where complementary detection methods are required. An appendix extends the framework from single rogue elements to the adversarial network, covering both coordinated multiplicity and fabricated ecologies.