The virtualization and softwarization of 5G and NextG are critical enablers of the shift to flexibility, but they also present a potential attack surface for threats. However, current security research in communication systems focuses on specific aspects of security challenges and lacks a holistic perspective. To address this challenge, a novel systematic fuzzing approach is proposed to reveal, detect, and predict vulnerabilities with and without prior knowledge assumptions from attackers. It also serves as a digital twin platform for system testing and defense simulation pipeline. Three fuzzing strategies are proposed: Listen-and-Learn (LAL), Synchronize-and-Learn (SyAL), and Source-and-Learn (SoAL). The LAL strategy is a black-box fuzzing strategy used to discover vulnerabilities without prior protocol knowledge, while the SyAL strategy, also a black-box fuzzing method, targets vulnerabilities more accurately with attacker-accessible user information and a novel probability-based fuzzing approach. The white-box fuzzing strategy, SoAL, is then employed to identify and explain vulnerabilities through fuzzing of significant bits. Using the srsRAN 5G platform, the LAL strategy identifies 129 RRC connection vulnerabilities with an average detection duration of 0.072s. Leveraging the probability-based fuzzing algorithm, the SyAL strategy outperforms existing models in precision and recall, using significantly fewer fuzzing cases. SoAL detects three man-in-the-middle vulnerabilities stemming from 5G protocol vulnerabilities. The proposed solution is scalable to other open-source and commercial 5G platforms and protocols beyond RRC. Extensive experimental results demonstrate that the proposed solution is an effective and efficient approach to validate 5G security; meanwhile, it serves as real-time vulnerability detection and proactive defense.

翻译：5G和下一代移动通信（NextG）的虚拟化与软件化是实现灵活性转型的关键使能技术，但也为威胁提供了潜在攻击面。然而，当前通信系统的安全研究主要聚焦于特定方面的安全挑战，缺乏整体视角。为应对这一挑战，本文提出了一种新型系统性模糊测试方法，可在攻击者拥有或不拥有先验知识假设的前提下，揭示、检测并预测漏洞。该方法同时作为系统测试与防御推演管线的数字孪生平台。我们提出了三种模糊测试策略：侦听学习（LAL）、同步学习（SyAL）和源端学习（SoAL）。LAL策略是一种黑盒模糊测试方法，用于在无协议先验知识时发现漏洞；SyAL策略同样为黑盒模糊测试，但通过攻击者可访问的用户信息及新型基于概率的模糊测试方法，能更精准地定位漏洞。随后采用白盒模糊测试策略SoAL，通过针对关键比特位的模糊测试来识别并解释漏洞。基于srsRAN 5G平台，LAL策略可识别129个RRC连接漏洞，平均检测时长为0.072秒。利用基于概率的模糊测试算法，SyAL策略在精度与召回率上均优于现有模型，且使用的模糊测试用例显著更少。SoAL检测出三个源于5G协议漏洞的中间人攻击漏洞。本方案可扩展至其他开源及商业5G平台，以及RRC协议以外的场景。大量实验结果表明，所提方案是验证5G安全性的有效且高效方法，同时可实现实时漏洞检测与主动防御。