# US 12,764,539 B2 · Mitigating malicious exploitation of network devices > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,764,539 B2 - Document ID: US12764539B2 - Status: Granted - Kind: B2 - Application number: 18/379,017 - Filed: 2023-10-11 - Published: 2025-04-17 - Granted: 2026-10-13 - Earliest claimed: 2023-10-11 - Assignees: T-Mobile Innovations LLC - Applicants: T-Mobile Innovations LLC - Inventors: Raymond Emilio Reeves; Simon Youngs; Mark Douglas Peden; Thomas Michael Koch - Web page: https://patentgrep.com/patent/US12764539B2 ## CPC - H04W 12/122: Counter-measures against attacks; Protection against rogue devices - H04W 12/08: Access security - H04W 12/72: Subscriber identity - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Systems and methods are provided for mitigating malicious attacks by IMSI-catchers. IMSI-catchers act as “fake” towers to intercept mobile device traffic and obtain private user data. These unauthorized devices pose a serious risk to user privacy. Aspects herein detect the presence of IMSI-catchers using RF footprints of cell sites to detect changes in RF footprint metrics that indicate the presence of IMSI-catchers. Once detected, beamforming techniques can be used to target a specific area surrounding the IMSI-catcher with a high-powered beamform that emits at a power level higher than the IMSI-catcher in order to reacquire any user devices that may have unknowingly connected to the IMSI-catcher. ## Claims ### Claim 1 A system for mitigating malicious attacks, the system comprising: one or more processors; and one or more computer-readable media storing computer-usable instructions that, when executed by the one or more processors, cause the one or more processors to: identify a radio frequency (RF) footprint for one or more cell sites, wherein the RF footprint comprises one or more RF footprint metrics; identify a change in at least one RF footprint metric of the one or more RF footprint metrics at a first cell site; based on the change in the at least one RF footprint metric, determine a presence of an unauthorized device; and in response to determining the presence of the unauthorized device, initiate a dynamic power level adjustment to change a current power level of the first cell site to a power level higher than the current power level, wherein the dynamic power level adjustment causes one or more user devices that connected to the unauthorized device to reconnect to the first cell site. ### Claim 2 (depends on 1) The system of claim 1, wherein the at least one RF footprint metric is a decrease in a number of user devices connected to the first cell site. ### Claim 3 (depends on 1) The system of claim 1, wherein the change in the at least one RF footprint metric is identified based on a comparison to a historical baseline of RF footprint metrics for the first cell site. ### Claim 4 (depends on 1) The system of claim 1, further comprising reducing the power level higher than the current power level back to the current power level when the authorized device is no longer detected. ### Claim 5 (depends on 1) The system of claim 1, wherein the unauthorized device is an international mobile subscriber identity (IMSI)-catcher. ### Claim 6 (depends on 1) The system of claim 1, further comprising receiving feedback data from at least one user device that connected to the unauthorized device, wherein the feedback data includes at least an identifier of the unauthorized device. ### Claim 7 (depends on 6) The system of claim 6, further comprising creating an exclusion list including the identifier of the unauthorized device to prevent the at least one user device from connecting to the unauthorized device. ### Claim 8 A system for mitigating malicious attacks, the system comprising: one or more processors; and one or more computer-readable media storing computer-usable instructions that, when executed by the one or more processors, cause the one or more processors to: identify a radio frequency (RF) footprint for one or more cell sites, wherein the RF footprint comprises one or more RF footprint metrics; identify a change in at least one RF footprint metric of the one or more RF footprint metrics at a first cell site compared to a baseline RF footprint for the first cell site; identify a loss of service for a plurality of user devices at the first cell site; based on the change in the at least one RF footprint metrics and the loss of service, determine a presence of an unauthorized device; and in response to determining the presence of the unauthorized device, initiate a dynamic power level adjustment to change a current power level of the first cell site to a power level higher than both the current power level and a power level associated with the unauthorized device, wherein the dynamic power level adjustment causes one or more user devices of the plurality of user devices that connected to the unauthorized device to reconnect to the first cell site. ### Claim 9 (depends on 8) The system of claim 8, wherein the unauthorized action is an international mobile subscriber identity (IMSI)-catcher. ### Claim 10 (depends on 8) The system of claim 8, wherein the processor is further configured to receive feedback data from at least one user device of the plurality of user devices, wherein the feedback data includes at least an identifier of the unauthorized device. ### Claim 11 (depends on 10) The system of claim 10, wherein the processor is further configured to create an exclusion list including the identifier of the unauthorized device to prevent the at least one user device from connecting to the unauthorized device. ### Claim 12 (depends on 8) The system of claim 8, wherein the processor is further configured to communicate the exclusion list to the plurality of user devices. ### Claim 13 (depends on 8) The system of claim 8, wherein the processor is further configured to maintain the power level higher than both the current power level and a power level associated with the unauthorized device until the unauthorized device is not detected. ### Claim 14 (depends on 8) The method of claim 8, wherein the dynamic power level adjustment comprises transmitting a targeted beamform to an area surrounding the unauthorized device. ### Claim 15 A method for mitigating malicious attacks, the method comprising: identifying a radio frequency (RF) footprint for one or more cell sites, wherein the RF footprint comprises one or more RF footprint metrics; identifying a change in at least one of RF footprint metrics of the one or more RF footprint metrics at a first cell site; based on the change in the at least one RF footprint metrics, determining a presence of an unauthorized device; and in response to determining the presence of the unauthorized device, initiating a dynamic power level adjustment to change a current power level of the first cell site to a power level higher than the current power level, wherein the dynamic power level adjustment causes one or more user devices that connected to the unauthorized device to reconnect to the first cell site. ### Claim 16 (depends on 15) The method of claim 15, wherein the unauthorized action is an international mobile subscriber identity (IMSI)-catcher. ### Claim 17 (depends on 15) The method of claim 15, further comprising receiving feedback data from at least one user device that connected to the unauthorized device, wherein the feedback data includes at least an identifier of the unauthorized device. ### Claim 18 (depends on 17) The method of claim 17, further comprising creating an exclusion list including the identifier of the unauthorized device to prevent the at least one user device from connecting to the unauthorized device. ### Claim 19 (depends on 17) The method of claim 17, further comprising assigning a confidence level to unauthorized device detections based on the UE feedback data. ### Claim 20 (depends on 15) The method of claim 15, reducing the power level higher than the current power level back to the current power level when the authorized device is no longer detected.