Add Cell Fingerprinting Analyzer for detecting unknown cell towers

[qvidal01]

Summary

This PR adds a new analyzer that tracks cell tower identities and detects suspicious changes that could indicate IMSI catcher deployment.

What it does

• Extracts cell identity from SIB1 (System Information Block Type 1) messages:
  • E-UTRA Cell Global Identifier (28-bit cell ID)
  • Tracking Area Code (16-bit TAC)
  • PLMN (Mobile Country Code + Mobile Network Code)
• Builds a baseline of known cells during the first 100 packets
• Alerts when new/unknown cells appear after baseline period
• Detects rapid cell changes (>10 changes in 50 packets) which could indicate a mobile IMSI catcher

Detection Capabilities

• New cell detection: Low severity alert when a previously unseen cell appears
• Rapid cell change detection: Medium severity alert when cells change suspiciously fast (potential mobile stingray in a vehicle)

Configuration

Enabled by default via config.toml:

[analyzers]
cell_fingerprint = true

Testing

• Includes 2 unit tests for the analyzer
• All existing tests pass

Future Enhancement Ideas (noted in code comments)

• Compare against a known-good cell database
• Track signal strength patterns
• Correlate with GPS location (if available)

Test plan

• All 21 tests pass including new analyzer tests
• Manual testing on RC400L device (cross-compilation needed)

🤖 Generated with Claude Code

[untitaker]

@qvidal01 did you manually test that this does not generate false-positives?

[qvidal01]

I haven't ran into an actual stingray so I just have been seeing if I can get a baseline for my area first with existing towers and then waiting to see if I get a different alert

[untitaker]

What I'm asking is whether you ensured this does not turn the line red even when no stingray is present.

[eabase]

Caution

Although this is important and very useful, this is also problematic as it's AI generated and possibly not understood by the author.

@qvidal01
Many questions arise.

• What data do you use for known "good" BTS cells?
• How did you decide from above what is good vs bad? (specific criteria needed)
• Why do you think only 1st 100 packets are enough to build the base-line?
• How long is your baseline "period", and what's the logic to determine it?
• "Detects rapid cell changes (>10 changes in 50 packets)"
  Is this realistic? How does it compare to real life scenario without IC?
• How does this reconcile with neighboring cells?