DAEJEON, South Korea — Governments use them to track phones. Criminals drive them through city streets and send texts that look like they came from your bank. For 20 years, researchers have been building tools to catch these fake cell towers. They have tested those tools mostly against fake towers they built themselves.
That loop has left gaps. Researchers at KAIST built a platform called Devilray that reproduces 2,592 distinct fake-base-station behaviors. They ran it against seven existing detection systems, and every one of them missed at least 192. The finding points to a larger problem with how the field tests itself: detectors have been evaluated against the wrong adversary.

An echo chamber
Fake base stations go by several names: IMSI catchers, cell-site simulators, StingRays. They pose as legitimate cell towers and get nearby phones to connect. Once a phone is connected, the fake tower can make it give up the identifier that ties it to its owner or reveal where it is. It can also cut the phone off, push it down to an older and weaker network, or send it messages that never passed through a carrier. Police and intelligence agencies have used these devices for surveillance for years. Criminals now use them for illegal surveillance and for SMS-blaster scams, in which a device carried in a car sends phishing texts to every phone nearby.
The commercial machines are expensive, and their sale and operation are tightly restricted. Universities generally cannot buy one. Carriers and investigative agencies are the ones responsible for finding fake towers in the field, but even they cannot get every model, let alone every new variant.
So researchers do the reasonable thing. They build a fake base station, study the traces it leaves, design a detector that recognizes those traces and report that it works. The next paper improves on the last one, and detection rates climb.
But the attacker in those experiments is one the defender already knows. The attack used to design a detector and the attack used to test it rest on the same assumptions. A detector that scores well may simply be recognizing its own reflection. What the field has lacked, the researchers argue, is adversarial thinking. The question should not be whether a detector catches a known attack. It should be what an attacker would do instead.
"Detection has been built around the attacks we already know," said Yongdae Kim, the KAIST professor of electrical engineering who led the work. "Real attackers don't stay there. Until now, the playing field has tilted toward them."

A standard full of open doors
Attackers have that much room because of how LTE works. When an LTE phone first connects, it does not check whether the base station is genuine. It acts on some messages before any authentication takes place, and it can be pushed down to older generations of network. These are not implementation bugs that a patch can fix. They are written into the standard, so an attacker can choose from many messages and stay fully standard-compliant.
Take the phone's permanent identifier, the main prize for a surveillance device. A fake tower can simply ask for it. That request is the move that Rayhunter, the Electronic Frontier Foundation's open-source detector, watches for. The tower can also send a rejection message that makes the phone reconnect and hand over the identifier without being asked. The standard allows both. A detector watching one door does not see the other.
"LTE is fundamentally broken," Professor Kim said. "It is full of standard-compliant messages that can be used for bad purposes."
Nobody is going to fix that. LTE's security design was settled long ago, and the standards community has moved on to 5G. Yet LTE remains the backbone of mobile service in most of the world. Many 5G networks still lean on it, and 5G phones drop back to LTE whenever 5G is unavailable, or whenever an attacker forces them to. These weaknesses will stay in the field as long as LTE does. As a result, defending against fake base stations looks less like fixing a software bug and more like an ongoing contest: a new attack appears, a detector learns to catch it, the attacker changes. That contest only works if defenders can see the moves attackers are able to make.

Thinking like the attacker
Devilray reverses the usual order. It maps the attacker first and looks at the detectors only afterward.
The team began with a commercial fake base station, a unit sold to law enforcement and intelligence agencies. It is the first such device to be analyzed in an academic study. The device could do several things that academic prototypes rarely model:

• copy the identity of a legitimate tower,
• hop between frequencies,
• run two networks at once,
• dial its power down to cover only a few meters.

The researchers then looked past that single device. They went through prior research and the 3GPP standards that govern cellular networks for other routes to the same ends. They broke a fake-base-station operation into four stages: surveying the local network, launching a fake cell, luring phones to connect, and carrying out the attack. Across those stages they identified seven dimensions an attacker can vary. Twenty-one dependency rules remove combinations that could not occur together in a real exchange. What remained were 2,592 configurations.
Every configuration was then run against real smartphones to confirm that the full procedure completed. That check matters in both directions. An attack space derived only from the specifications could include thousands of combinations no phone would actually accept. A baseline copied from a single commercial device would inherit that device's limits. Devilray is anchored in the real device and extends outward into behaviors the standard permits.
The researchers stress that 2,592 is not a count of attacks seen in the wild, and not a list of 2,592 ways to beat every detector. It is something the field has not had before: a realistic adversary, grounded in a real device and the standard itself, against which detectors can finally be tested.

Seven detectors, seven sets of blind spots
The seven detectors the team tested are publicly available and work on different principles: signaling messages, base station information, radio signals, statistical patterns and machine learning. Every one had blind spots, and most traced back to an assumption built into its design.
Some detectors key on one telltale message, so they missed attacks that reached the same goal by another route. Others flag the unusually strong signal of a cheap fake tower; a fake tower that turns its power down, as the commercial unit can, stays under their thresholds. One statistical detector watches how often phones in an area are asked to reveal their identifiers. A fake tower that collects identifiers patiently, from a fraction of the phones nearby instead of all of them, produced a pattern that looked like an ordinary bus terminal.

The harder question
The deepest blind spot is the one where the attack starts to look like a normal network. The researchers tested this directly. They retrained a machine-learning detector on the Devilray attacks it had missed. On the radio link layer (RRC) model, its detection rate rose from 51 percent to 96 percent, while its false-alarm rate on ordinary carrier traffic nearly quadrupled, from 1.4 percent to 5.3 percent. On the core network layer (NAS) model, the detection rate rose from 27 percent to 63 percent, and its false-alarm rate increased from 4.7 percent to 8.8 percent. When trained on the hardest case, that false-alarm rate reached 15 percent, particularly for the NAS layer model.
A detector that catches everything but constantly flags ordinary networks is of little use, and neither is a quiet one that misses carefully chosen attacks. The problem is not simply to maximize detection. It is to find the boundary between malicious and legitimate behavior when the standard lets an attacker move right up against it.
"The real question is whether we can reduce misses without raising false alarms," Professor Kim said.
The researchers argue that future detectors should report both numbers together. Claiming better coverage without testing against ordinary traffic gives an incomplete picture of whether a detector can actually be deployed.

An attacker for defenders
A platform that can imitate thousands of attack behaviors could also be misused, and the researchers acknowledge the risk. They share Devilray only with vetted researchers and organizations, under controlled access. What defenders have lacked is the same range of behavior to test against. With Devilray, carriers, investigators and detector developers can do that without having to buy every device on the market.
The name is a jab at the StingRay, the commercial device whose name became shorthand for the whole category. A devil ray is a much bigger relative.
The work is already reaching defenders. The team gave EFF the attack cases Rayhunter misses, and the foundation is now working on ways to detect them. The GSMA, the global association of mobile operators, invited the researchers to present Devilray to its Fraud and Security Group. There, standards and industry representatives discussed where fake-base-station detection should go next.
The study was led by KAIST in collaboration with South Korea's National Security Research Institute, Kyung Hee University, the University of Florida and Cape, a U.S. mobile network company. It will be presented in December at ACSAC 2026 in Los Angeles.
Professor Kim's group is now building a detection system of its own. No single vantage point may see enough, so it combines what phones observe, what carriers can see inside their networks and what independent radio sniffers capture. The aim is to detect fake base stations and also to locate them.
"Devilray is not meant to defeat existing detectors," Professor Kim said. "It gives defenders the same choices attackers already have, so that attack and defense can finally advance together." Paper: "Devilray: A Reconfigurable Adversarial Baseline for Revealing Blind Spots in Fake Base Station Detection," IEEE ACSAC 2026, Los Angeles, Dec. 7–11, 2026. arXiv: https://arxiv.org/abs/2605.19232 · Project page and demo videos: https://sites.google.com/view/devilray
Access: Devilray is available to vetted researchers and organizations under controlled access. Requests: https://sites.google.com/view/devilray
Authors: Led by KAIST — Taekkyung Oh and Duckwoo Kim (co-first authors), Beomseok Oh and Yongdae Kim (KAIST); Hansung Bae and Byeongdo Hong (National Security Research Institute); CheolJun Park (Kyung Hee University); Tyler Tucker, Nathaniel Bennett and Patrick Traynor (University of Florida); Sangwook Bae (Cape).
Funding: Institute of Information & communications Technology Planning & Evaluation (IITP) grant funded by the Korea government(MSIT) (No. RS-2024-00441762, Global Advanced Cybersecurity Human Resources Development).
Contact: Professor Yongdae Kim, School of Electrical Engineering, KAIST · yongdaek@kaist.ac.kr