[论文解读] Systematic Meets Unintended: Prior Knowledge Adaptive 5G Vulnerability Detection via Multi-Fuzzing

Jingda Yang, Ying Wang+2 more|arXiv (Cornell University)|May 14, 2023

Hate Speech and Cyberbullying Detection被引用 7

一句话总结

论文提出基于数字孪生的、带先验知识自适应模糊测试框架，包含 LAL、SyAL、SoAL 策略，用于检测 5G 漏洞和非预期的新兴行为，在 srsRAN 上验证，发现 129 个漏洞并提升召回率。

ABSTRACT

The virtualization and softwarization of 5G and NextG are critical enablers of the shift to flexibility, but they also present a potential attack surface for threats. However, current security research in communication systems focuses on specific aspects of security challenges and lacks a holistic perspective. To address this challenge, a novel systematic fuzzing approach is proposed to reveal, detect, and predict vulnerabilities with and without prior knowledge assumptions from attackers. It also serves as a digital twin platform for system testing and defense simulation pipeline. Three fuzzing strategies are proposed: Listen-and-Learn (LAL), Synchronize-and-Learn (SyAL), and Source-and-Learn (SoAL). The LAL strategy is a black-box fuzzing strategy used to discover vulnerabilities without prior protocol knowledge, while the SyAL strategy, also a black-box fuzzing method, targets vulnerabilities more accurately with attacker-accessible user information and a novel probability-based fuzzing approach. The white-box fuzzing strategy, SoAL, is then employed to identify and explain vulnerabilities through fuzzing of significant bits. Using the srsRAN 5G platform, the LAL strategy identifies 129 RRC connection vulnerabilities with an average detection duration of 0.072s. Leveraging the probability-based fuzzing algorithm, the SyAL strategy outperforms existing models in precision and recall, using significantly fewer fuzzing cases. SoAL detects three man-in-the-middle vulnerabilities stemming from 5G protocol vulnerabilities. The proposed solution is scalable to other open-source and commercial 5G platforms and protocols beyond RRC. Extensive experimental results demonstrate that the proposed solution is an effective and efficient approach to validate 5G security; meanwhile, it serves as real-time vulnerability detection and proactive defense.

研究动机与目标

• 在复杂、可编程堆栈中推动对 5G/下一代的整体安全性测试。
• 开发一个数字孪生平台，使跨协议的系统化、自适应模糊测试成为可能。
• 提出三种模糊测试策略（Listen-and-Learn、Synchronize-and-Learn、Source-and-Learn），在知识假设上各有差异。
• 量化漏洞检测效率，并展示实时检测与防御能力。

提出的方法

• 引入基于数字孪生的漏洞测试平台，连接 MITM 中继、srsRAN、Open5GS 与 ZMQ 以实现互操作性。
• 定义三种模糊测试策略：LAL（黑箱）、SyAL（带概率的灰箱模糊测试）、SoAL（白箱位级模糊测试）。
• 实现基于概率的模糊测试方法，将所需模糊测试用例数量从线性增长降至对数增长。
• 使用状态-事务图记录并分析命令级与位级模糊状态，结合基于 LSTM 的预测。
• 在 srsRAN 上演示 RRC 协议模糊测试，发现 129 个漏洞，平均检测时间 0.072s。
• 提供一个可扩展到其他 5G/Open-RAN 平台和协议的数字孪生框架。

Figure 1: Definition of fuzz testing region.

实验结果

研究问题

• RQ1 先验知识如何影响 5G 漏洞检测的模糊测试效果？
• RQ2 基于数字孪生的多模糊测试框架是否能够检测到 5G 协议中的漏洞和非预期的新兴行为？
• RQ3 概率化模糊测试在减少模糊测试用例数量方面的效率提升是多少？
• RQ4 LAL、SyAL、SoAL 在识别和预测 RRC 漏洞及 MITM 威胁方面的有效性如何？

主要发现

• 在 LAL 框架下识别出 RRC 协议中的 129 个漏洞。
• SyAL 结合基于概率的模糊测试在显著减少模糊测试用例数量的同时实现更高的准确性/召回率。
• SoAL 发现了源于 5G 协议弱点的三种中间人攻击漏洞。
• LAL 可以在协议无关的情况下工作，并能适应新的 5G 堆栈与协议。
• 状态-事务分析结合 LSTM 预测器可提升漏洞预测与早期预警能力。

Figure 2: Overview of 5G fuzz testing methods.