A Stateful Fuzzing Methodology for Security Verification of 5G Core Equipment

Abstract

As fifth-generation (5G) networks evolve toward open and software-based architectures, security verification of the NG Application Protocol (NGAP) between the radio access network and the 5G core has become increasingly important. This paper proposes a stateful security verification methodology that combines stateful fuzzing with specification-guided security verification. The methodology derives an Access and Mobility Management Function (AMF) state model, mutation types, and expected behaviors from Third Generation Partnership Project (3GPP) specifications. For each attack scenario, it establishes the required connection state through normal NGAP procedures, injects a mutated message, and compares the observed AMF responses and processing logs with the specification-defined expected behavior. We evaluated four open-source 5G core implementations using 324 attack scenarios per implementation, resulting in 1296 tests. Of these, 877 produced sufficient evidence to interpret the AMF processing outcome, yielding an interpretable outcome rate of 67.7%. The evaluation covered 27 of the 40 uplink NGAP message types and identified 32 specification violations, including 11 security vulnerabilities, none of which caused a core to crash. These results demonstrate the importance of jointly considering connection states and specification-defined behavior in NGAP security verification.