Abstract

Security analysis of cellular signaling protocols, particularly for false base station detection, requires structured Non-Access Stratum/Radio Resource Control (NAS/RRC) datasets captured from the radio interface. Yet existing approaches either depend on kernel-level access increasingly restricted by modern Android Security-Enhanced Linux (SELinux) policies or require a tethered desktop computer. This study presents MODI (Mobile Observation and Diagnostic Interface), an on-device preprocessing pipeline that converts raw Qualcomm Mobile Data Log (QMDL) binary captures into structured Comma-Separated Values (CSV) files entirely on a rooted Android smartphone. The pipeline implements five sequential stages: binary extraction with High-Level Data Link Control (HDLC) unwrapping, protocol dissection via a cross-compiled Wireshark dissector producing desktop-equivalent output, NAS/RRC message filtering, feature extraction from 352 pre-selected protocol fields, and CSV output with hybrid hexadecimal conversion, yielding 1,408 numeric features per packet. The pipeline maintains Android 11+ compatibility by using a vendor-provided diagnostic binary (diag_mdlog) that operates within the existing SELinux policy without kernel modifications. On-device benchmarks on an Android 13 device show that a 100 MB QMDL file is processed in 61–107 seconds with 40–60% CPU utilization and 200–300 MB peak memory, enabling autonomous field collection of structured NAS/RRC data without desktop infrastructure.