This paper presents HyFuzz, a hybrid intelligent fuzz testing platform designed to enhance the security validation of next generation (NextG) mobile networks. HyFuzz integrates symbolic formal analysis with adaptive fuzzing to enable the discovery of vulnerabilities that emerge from subtle state inconsistencies and session level command manipulations. Specifically, HyFuzz demonstrates support for multi step intra session fuzzing, where carefully crafted command sequences cause persistent state desynchronization between User Equipment (UE) and the network. Complementing this, HyFuzz employs formal guided deep fuzzing, directing fuzzing efforts to high risk protocol states identified by symbolic analysis. Through a dual mode architecture supporting both virtual (ZMQ) and over the air (OTA) fuzzing, HyFuzz provides an extensible testbed for low level and behavioral vulnerability discovery. Experimental results across 1,281 test cases reveal 1,105 failure instances, including stealthy failures that manifest only under extended interaction contexts. Our findings suggest HyFuzz provides a foundational capability toward more realistic and semantically rich vulnerability detection in modern mobile infrastructure.

The reliability of 5G systems and their applications in a complex, dynamic, and heterogeneous environment requires rigorous testing and real-time detection for system vulnerabilities and unintended emergent behaviors. In this paper, fuzz testing is performed on 5G systems by randomly injecting and permuting control commands into the system under test (SUT) of the 5G radio resource control (RRC) authentication and authorization process, emulating Man-In-The-Middle (MITM) attacks to trigger potential vulnerabilities and unintended behaviors. The fuzzed system behaviors contain information that could indicate the system's health status, and potential vulnerabilities, and, more importantly, it enables the causation analysis in the SUT to detect the location and type of attacks or abnormal inputs from the profiling of the impacted behaviors. We then propose a Real-time Framework for Root Cause Analyses (RAFT) in NextG Vulnerability Detection based on analyzing the random fragments of the log file generated during the communication process. By processing the random fragments of the logging profiles captured during fuzz testing with the continuous bag-of-words (CBOW) Model, we extract the information of states and states transitions and perform causal analysis to identify the root cause for vulnerability detection in the 5G system. The novelty of our framework lies in the creation and analysis of the information extraction that does not require capturing the entire log file instead only the log file fragments to achieve high accuracy. This approach enables real-time detection and deployment to real-life scenarios where access to the entire logging profile is difficult to obtain or unavailable. The presented framework RAFT directly adapts to various machine learning (ML) models, which allow the adaptation to hardware with various computation complexity from internet-of-things (IoT) to Radio Access Network (RAN) servers. The experimental results show a significant performance gain and are thoroughly evaluated by the accuracy and area under the curve (AUC) results. In particular, we show that the proposed framework can attain a high AUC value ($0.92\leq\text{AUC} < 0.96$) by accessing only a 70% fragment of the original log file while maintaining a higher accuracy. In addition, we find that RAFT reduces the time complexity by more than 5% as the fragment size reduces to 70% of the original log file. The causation analysis nature of RAFT summarizes vulnerability information into essential root causes that can be easily transmitted within the network in real-time and turned into guidance for back-end engineers. The unique advantages of RAFT, including accurate causation with information fragments, reliable performance without large training datasets and less computation complexity guarantee a wide range of use cases and deployment environment of RAFT.

The 5G authentication and key agreement protocol (AKA) is intended to provide security assurance for users, net-work operators, and machine-to-machine communications. It is a critical component of everyday life and national infrastructure. In this paper, we conduct a high-resolution and in-depth formal analysis of the AKA protocol, addressing hidden assumptions stemming from the underlying dependencies among entities. We categorize the direct properties among identifiers in each protocol session into confidentiality, integrity, authentication, and accounting. We further uncover the indirect dependencies among identifiers through the propagation of assumptions in the designed dependency graph. The formal models are generated from both the direct and indirect dependencies and are verified using Pro Verif. Our approach reveals four major vulnerability types across four sub-procedures. This includes three vulner-abilities previously identified in existing research, as well as one newly discovered vulnerability type. The solutions proposed to address these vulnerabilities have been validated through formal verification and over-the-air (OTA) testing. We present the first formal models that consider hidden assumptions and their propagation in 5G, and demonstrate the fragility of the 5G-AKA protocol through experimental practice. We have also included formally verified fixes for the encountered vulnerabilities.

The paper proposes a protocol-independent Listen-and -Learn (LAL) based fuzzing system, which provides a systematic solution for vulnerabilities and unintended emergent behavior detection with sufficient automation and scalability, for 5G and nextG protocols and large-scale open programmable stacks. We use the relay model as our base and capture and interpret packets without prior knowledge of protocols imple-mentation. Radio Resource Control (RRC) is selected proof of concept of the proposed system. Our fuzzing architecture incorporates two abstractions of different dimension fuzzing-command-level and bit-level, and the proposed LAL fuzzing framework focuses on command-level fuzzing covering potential attacks by autonomously generating a comprehensive fuzzing case set. Our analysis of 39 RRC states successfully illustrates 129 vulnerabilities resulting in RRC connection establishment failure from 205 command-level fuzzing cases and reveals insights into exploitable vulnerabilities in each channel of RRC procedure. Furthermore, to assess risks and prevent potential vulnerability, we use the Long Short-Term Memory (LSTM) based model to perform a deep analysis of transaction states in sequenced commands. With the LSTM based model, we efficiently predict more than 95% connection failure at an average duration of 0.059 seconds after the fuzzing attack and provide sufficient time for proactive defense before RRC connection completion or failure, with an average of 3.49 seconds. The rapid vulnerability prediction capability also enables proactive defenses to potential attacks. The proposed fuzzing system offers sufficient automation, scalability, and usability to improve 5G security assurance, and could be used for existing and newly released protocols and stacks validation and real-time system vulnerability detection and prediction.

Efficient and precise detection of vulnerabilities in 5G protocols and implementations is crucial for ensuring the security of its application in critical infrastructures. However, with the rapid evolution of 5G standards and the trend towards softwarization and virtualization, this remains a challenge. In this paper, we present an automated Fuzz Testing Digital Twin Framework that facilitates systematic vulnerability detection and assessment of unintended emergent behavior, while allowing for efficient fuzzing path navigation. Our framework utilizes assembly-level fuzzing as an acceleration engine and is demonstrated on the flagship 5G software stack: srsRAN. The introduced digital twin solution enables the simulation, verification, and connection to 5G testing and attack models in real-world scenarios. By identifying and analyzing vulnerabilities on the digital twin platform, we significantly improve the security and resilience of 5G systems, mitigate the risks of zero-day vulnerabilities, and provide comprehensive testing environments for current and newly released 5G systems.