The evolution of 5G and future-G technologies has led to the development of an open, distributed, and multi-vendor architecture known as Open Radio Access Network (O-RAN). While O-RAN offers greater flexibility and stimulates innovation, it also introduces potential issues such as bugs, inconsistencies, and vulnerabilities. In this paper, we present a novel model-based fuzzing system, ARCANE, to address these challenges. Unlike existing fuzzing techniques that struggle with the complexity and dynamism of O-RAN, ARCANE distinguishes itself by employing a smart, model-based approach. It first analyzes O-RAN specifications using a Large Language Model (LLM) and incorporates a unique method that integrates passive model learning to refine the model. With this refined model, ARCANE designs an O-RAN-aware, model-based fuzzing scheme that maintains high efficiency by adhering to O-RAN's specific semantics and syntax. We implement ARCANE and evaluate it on the OAI5G. It finds 9 root bugs from three categories, all having serious security implications. ARCANE has shown superior efficiency and coverage compared to state-of-the-arts.

The advent of 5G promises high bandwidth with the introduction of mmWave technology recently, paving the way for throughput-sensitive applications. However, our measurements in commercial 5G networks show that frequent handovers in 5G, due to physical limitations of mmWave cells, introduce significant under-utilization of the available bandwidth. By analyzing 5G link-layer and TCP traces, we uncover that improper interactions between these two layers causes multiple inefficiencies during handovers. To mitigate these, we propose M2HO, a novel device-centric solution that can predict and recognize different stages of a handover and perform state-dependent mitigation to markedly improve throughput. M2HO is transparent to the firmware, base stations, servers, and applications. We implement M2HO and our extensive evaluations validate that it yields significant improvements in TCP throughput with frequent handovers.