A security vulnerability detection method for a 5G core network

Abstract

The application provides a security vulnerability detection method for a 5G core network, comprising: a terminal generates a test case and a test case sequence, the test case and the test case sequence are constructed according to a protocol message level of a non-access stratum (NAS) protocol message; the test case is used for detecting a first type of vulnerability under a static condition, and the test case sequence is used for detecting a second type of vulnerability under a dynamic condition; the terminal sends the test case and the test case sequence to the core network through a base station; the core network receives the test case and the test case sequence, and performs analysis and processing on the test case and the test case sequence based on an internal logic of the core network; the core network obtains a result of the analysis and processing, and monitors whether the core network has the first type of vulnerability or the second type of vulnerability according to the result of the analysis and processing; the first type of vulnerability is a vulnerability caused by processing of an abnormal message, and the second type of vulnerability is a vulnerability caused in a state transition process, and the method improves comprehensiveness and accuracy of testing.

Description

Technical Field

[0001] The present invention relates to the field of communication technologies, and in particular to a method for detecting security vulnerabilities in a 5G core network. Background Art

[0002] As a key protocol in the 5G control plane, the Non-Access Stratum (NAS) protocol undertakes important functions such as access management, mobility management, and session management, and is closely related to processes such as registration, authentication, location update, and session control. However, due to insufficient security considerations for sensitive processes such as initial message exchange during the design phase, as well as inconsistencies with standards during the implementation phase, the NAS protocol itself still has many design and implementation flaws. These flaws can cause security issues such as denial of service, location tracking, or leakage of sensitive user information, which in turn have a serious impact on the data security and privacy of the 5G core network and terminal UEs. Therefore, studying and ensuring the security of the 5G core network is of great significance to the security of 5G networks.

[0003] Currently, a large amount of research and testing frameworks are designed for 4G systems and rely on the specific properties and security models of 4G protocols. This makes these research results difficult to directly apply to 5G systems, which face different threat scenarios. Existing fuzz testing frameworks and security analysis tools focus on the terminal side, with relatively few testing frameworks for the core network. This results in flawed core network vulnerability detection. Furthermore, while fuzz testing is widely used for security detection of unknown vulnerabilities, existing 4G fuzz testing solutions are unable to directly detect security vulnerabilities in the 5G core network due to the unique characteristics of the 5G NAS protocol in terms of connection establishment, data format, and process interaction. Summary of the Invention

[0004] In order to solve the above-mentioned problems existing in the prior art, the present invention provides a security vulnerability detection method for 5G core network.

[0005] The technical problem to be solved by the present invention is achieved through the following technical solutions:

[0006] The present invention provides a security vulnerability detection method for a 5G core network, which is applied to a 5G communication system. The 5G communication system includes: a terminal, a base station, and a core network, including:

[0007] The terminal generates test cases and test case sequences. The test cases and test case sequences are constructed based on the protocol message hierarchy of the non-access stratum (NAS) protocol message. The protocol message hierarchy includes the message header level, information component level, field level, and bit level. The test cases are used to detect the first type of vulnerability under static conditions, and the test case sequences are used to detect the second type of vulnerability under dynamic conditions.

[0008] The terminal sends the test case and test case sequence to the core network through the base station;

[0009] The core network receives the test cases and test case sequences and parses and processes them based on its internal logic.

[0010] The core network obtains the results of the parsing process and monitors whether the core network has the first type of vulnerability or the second type of vulnerability based on the results of the parsing process; the first type of vulnerability is a vulnerability caused by processing malformed messages, and the second type of vulnerability is a vulnerability caused during the state transfer process.

[0011] Optionally, the terminal generates test cases and test case sequences, including:

[0012] Generate NAS protocol messages;

[0013] Based on NAS protocol messages, determine the protocol message hierarchy;

[0014] Selecting a level from the protocol message level to obtain a selected level;

[0015] Perform corresponding fusion mutation processing on the selected layer and fill it into the structured message template to construct a test case;

[0016] A finite state machine model is established according to the internal transfer state of the core network, and a test case sequence is formed using the finite state machine model.

[0017] Optionally, a finite state machine model is established according to the internal transition state of the core network, and a test case sequence is formed using the finite state machine model, including:

[0018] According to the finite state machine model, the path search is performed on the state set under the depth-first search algorithm to generate a state detection path set;

[0019] Perform detection path selection on the state detection path set to obtain the transfer path to be detected;

[0020] According to the transfer path to be detected and the NAS protocol message, an initial sequence of test cases is generated, and the initial sequence of test cases is filled into the message template to form a test case sequence.

[0021] Optionally, the test case sequence is sent to the core network in a predetermined order to guide the core network to transfer according to the state corresponding to the test case sequence.

[0022] Optionally, the message header level generation method includes: random generation, sequential enumeration, and free enumeration;

[0023] The information component level generation mode includes length variation, byte flip, arithmetic variation, byte replacement, and byte exchange.

[0024] The field level generation mode includes random generation, boundary value generation, reserved value enumeration, and free enumeration.

[0025] The bit level generation mode includes bit flip, bit XOR, bit AND, bit set, and bit exchange.

[0026] Optionally, the state set of the core network includes an initial state, a registration initialization, an authentication initialization, an identity initialization, an authentication completion, a security mode function (SMC) initialization, an SMC completion, a registration intermediate state, a registration completion, a deregistration initialization, and a final state.

[0027] The events triggering the state transition in the state set include receiving a registration request, sending an authentication request, sending a registration rejection, sending an identity request, receiving an identity response, receiving an authentication response, receiving an authentication rejection, sending an SMC command request, receiving an SMC completion reply, receiving an SMC rejection, sending a registration acceptance, receiving a registration completion, receiving a deregistration request, and sending a deregistration acceptance.

[0028] Optionally, the generation of the test case further includes generating the test case based on the corresponding NAS protocol message version to ensure that the test case covers the protocol version and message type of the NAS protocol message.

[0029] Optionally, the core network obtains the result of the parsing processing, and monitors whether the first type of vulnerability or the second type of vulnerability exists in the core network according to the result of the parsing processing, including:

[0030] The core network obtains log information when processing the test case or the test case sequence, and uses the log information as the result of the parsing processing.

[0031] The log information is used to determine whether the first type of vulnerability or the second type of vulnerability exists in the core network.

[0032] Optionally, the security vulnerability detection method for the 5G core network further includes:

[0033] After detecting that the core network has the first type of vulnerability or the second type of vulnerability, a report containing the first type of vulnerability or the second type of vulnerability is generated and sent to a preset security management system for further vulnerability analysis and repair.

[0034] The present invention provides a security vulnerability detection method for a 5G core network, which is applied to a 5G communication system. The 5G communication system includes: a terminal, a base station and a core network, including: the terminal generates a test case and a test case sequence, the test case and the test case sequence are constructed according to the protocol message hierarchy of a non-access layer NAS protocol message; the protocol message hierarchy includes: a message header level, an information component level, a field level and a bit level; the test case is used to detect a first type of vulnerability under static conditions, and the test case sequence is used to detect a second type of vulnerability under dynamic conditions; the terminal sends the test case and the test case sequence to the core network through the base station; the core network receives the test case and the test case sequence, and parses and processes the test case and the test case sequence based on its own internal logic; the core network obtains a result of the parsing process, and monitors whether the core network has a first type of vulnerability or a second type of vulnerability based on the result of the parsing process; the first type of vulnerability is a vulnerability caused by processing malformed messages, and the second type of vulnerability is a vulnerability caused during a state transfer process. In the present invention, by designing and generating test cases and test case sequences for NAS protocol messages, various situations in which the core network processes malformed messages in different formats can be fully covered, thereby improving the breadth and depth of the test. In addition, by designing a test case sequence, vulnerabilities caused by the core network during state transitions are detected, thereby improving the comprehensiveness and accuracy of the test. Finally, since the detection process of the inventive method is efficient and highly automated, the efficiency and quality of core network security vulnerability detection can be significantly improved, thereby reducing the detection cost.

[0035] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 A schematic diagram of a process for detecting security vulnerabilities in a 5G core network according to an embodiment of the present invention;

[0037] Figure 2 A schematic diagram of the structure of a finite state machine model corresponding to the core network provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0038] The present invention will be further described in detail below with reference to specific examples, but the embodiments of the present invention are not limited thereto.

[0039] In order to improve the comprehensiveness and accuracy of core network vulnerability detection while reducing detection costs, an embodiment of the present invention provides a security vulnerability detection method for a 5G core network, which is applied to a 5G communication system. The 5G communication system includes: a terminal, a base station, and a core network. Figure 1 The present invention provides a flow chart of a method for detecting security vulnerabilities in a 5G core network. Figure 1 Shown, including:

[0040] S101. The terminal generates a test case and a test case sequence.

[0041] The test cases and test case sequences are constructed according to the protocol message hierarchy of the non-access stratum NAS protocol message. In the embodiment of the present invention, the protocol message hierarchy may include: message header level, information component level, field level and bit level.

[0042] Test cases are used to detect the first type of vulnerabilities under static conditions, and test case sequences are used to detect the second type of vulnerabilities under dynamic conditions.

[0043] Examples of static vulnerability include buffer overflow, format string vulnerability, integer overflow, null pointer dereference, and insufficient input validation.

[0044] Examples of vulnerabilities under dynamic conditions include: state transition errors, race conditions, or state recovery failures.

[0045] Optionally, the message header level generation method includes: random generation, sequential enumeration and free enumeration.

[0046] The generation methods at the information component level include: length mutation, byte flipping, arithmetic mutation, byte replacement, and byte swapping.

[0047] Field-level generation methods include random generation, boundary value generation, reserved value enumeration, and free enumeration.

[0048] Bit-level generation methods include: bit flip, bit XOR, bit AND, bit set, and bit swap.

[0049] It should be noted that random generation can specifically involve randomly generating a message header; sequential enumeration can specifically enumerate all possible message header configurations in a certain order; free enumeration can specifically involve manually or through a tool selecting specific message header configurations for testing; length mutation can specifically involve changing the length of an information component; byte flipping can specifically involve flipping certain bytes in an information component; arithmetic mutation can specifically involve performing operations such as addition, subtraction, multiplication, and division on the values ​​in an information component; byte replacement can specifically involve replacing certain bytes in an information component with other values; byte swapping can specifically involve changing the order of bytes in an information component; random generation can specifically involve randomly generating field values; boundary value generation can specifically involve generating boundary values ​​(minimum, maximum, or median) for a field; reserved value enumeration can specifically involve enumerating certain reserved values ​​in a field; free enumeration can specifically involve manually or through a tool selecting specific field values ​​for testing. Bit flipping can specifically involve flipping certain bits in a field; bit setting can specifically involve setting certain bits to 1; bit AND can specifically involve performing an AND operation on certain bits; bit XOR can specifically involve performing an XOR operation on certain bits; and bit swapping can specifically involve changing the order of bits in a field.

[0050] Optionally, S101 may specifically include:

[0051] Generate NAS protocol messages;

[0052] Based on NAS protocol messages, determine the protocol message hierarchy;

[0053] Selecting a level from the protocol message level to obtain a selected level;

[0054] Perform corresponding fusion mutation processing on the selected layer and fill it into the structured message template to construct a test case;

[0055] A finite state machine model is established according to the internal transfer state of the core network, and a test case sequence is formed using the finite state machine model.

[0056] It should be noted that, in the embodiment of the present invention, the corresponding fusion and mutation processing is performed on the selected layer, which may include, for example, bit flipping, bit XOR, bit AND, bit setting, and bit swapping.

[0057] Optionally, the generation of the test case further includes: generating the test case based on the corresponding NAS protocol message version to ensure that the test case covers the protocol version and message type of the NAS protocol message.

[0058] For example, the test case is as follows:

[0059] Test case 1:

[0060] msgtype:registration_request

[0061] state:before_registration_request

[0062] meta:

[0063] ue_security_capability.present:true

[0064] mobile_identity_5gs.type:guti

[0065] hdrs:{}

[0066] ies:{}

[0067] fields:{}

[0068] octets:

[0069] registration_type_5gs.octet1:12

[0070] 测试用例2:

[0071] msgtype:registration_request

[0072] state:after_registration_request

[0073] meta:

[0074] ue_security_capability.present:true

[0075] mobile_identity_5gs.type:guti

[0076] hdrs:

[0077] security_header_type:2

[0078] mac:25

[0079] ies:

[0080] ng_ksi.content:hex1b07

[0081] fields:{}

[0082] octets:{}

[0083] Test case 1 is a regular test case that does not participate in a pairing combination. Its message type and metadata remain consistent with those specified in the test rules. The test state is before the test message is sent (before_registration_request). The bit-level parameter is registration_type_5gs, and the first byte of the component is 12. This value is obtained by flipping the fourth bit of the seed value 19 specified in the test rule, that is, from 0b00010011 to 0b00001100, verifying the effectiveness of the mutation strategy. All other parameters are empty. Test case 2 is a test case that participates in a pairing combination. Its test state is after the test message is sent (after_registration_request). The values ​​of the three parameters, security_header_type, mac, and ng_ksi, are 2, 25, and hex1b07, respectively, all of which comply with the corresponding test rules and verify the effectiveness of the generation strategy and length mutation.

[0084] Furthermore, when selecting a layer within the protocol message hierarchy, you can flexibly choose a single layer or a combination of multiple layers based on test requirements. As you can see, testing through layer combinations can save time and improve test efficiency. Furthermore, the selected layers are populated into structured message templates, primarily for standardized message processing, enabling core network recognition.

[0085] Optionally, a finite state machine model is established according to the internal transition state of the core network, and a test case sequence is formed using the finite state machine model, including:

[0086] According to the finite state machine model, the path search is performed on the state set under the depth-first search algorithm to generate a state detection path set;

[0087] Perform detection path selection on the state detection path set to obtain the transfer path to be detected;

[0088] According to the transfer path to be detected and the NAS protocol message, an initial sequence of test cases is generated, and the initial sequence of test cases is filled into the message template to form a test case sequence.

[0089] For example, Figure 2 This is a schematic diagram of the structure of the finite state machine model corresponding to the core network provided in the embodiment of the present invention. Figure 2 As shown, the core network state set includes: initial state S0, registration initialization S1, authentication initialization S2, identification initialization S3, authentication completion S4, security mode function SMC initialization S5, SMC completion S6, registration intermediate state S7, registration completion S8, deregistration initialization S9 and final state Se.

[0090] Specifically, S0 represents the initial state of the finite state machine, during which the core network is in a waiting state, awaiting a registration request. In S1, the core network has received the registration request and is performing initial registration processing. The core network can then proceed to the next step based on different events. In S2, the core network is authenticating the user. The core network will send an authentication request to the user and wait for a response; in the S3 state, the core network will initialize the identity, send an identity request to the user and wait for the user's identity response; when the core network enters the S4 state, it means that the authentication process has been completed and the user has successfully passed the authentication; when the core network enters the S5 state, it will process session-related requests; when the core network enters the S6 state, the SMC process has been successfully completed and the core network has completed the relevant operations of session management; S7 is an intermediate state, indicating that the registration operation has not been fully completed and the core network is waiting for further processing steps; when the core network enters the S8 state, it indicates that the registration operation has been completely successful and the user registration has been completed; the S9 state indicates that the core network has started to process the logout operation and is processing the initial logout request; Se is the terminal state of the finite state machine, indicating that all registration and logout operations have been completed and the core network has entered the final state.

[0091] The events that trigger state transitions in the state set include: receiving a registration request E0, sending an authentication request E1, sending a registration rejection E2, sending an identification request E3, receiving an identification response E4, receiving an authentication response E5, receiving an authentication rejection E6, sending an SMC command request E7, receiving an SMC completion reply E8, receiving an SMC rejection E9, sending a registration acceptance E10, receiving a registration completion E11, receiving a deregistration request E12, and sending a deregistration acceptance E13.

[0092] Specifically, E0 represents that the core network receives a new registration request, triggering the core network to enter a registration initialization state S1 from an initial state S0. In the registration initialization state S1, the core network receives an authentication request E1, triggering the core network to enter an authentication initialization state S2. E2 represents that the core network decides to reject the registration request at a certain stage, triggering the core network to enter a final state Se. In the registration initialization state S1, the core network receives an identity request E3, triggering the core network to enter an identity initialization state S3. After the core network receives an identity response E4, the core network continues the next operation from the identity initialization state S3 and enters the authentication initialization state S2. E5 represents that the core network receives an authentication response in the authentication initialization state S2, completes user authentication, and enters an authentication completion state S4. When the core network receives an authentication rejection E6 in the authentication process, the core network enters the final state Se, indicating that the authentication fails and the registration is rejected. After the core network completes the authentication, the core network sends an SMC command request E7 and enters an SMC initialization state S5. When the core network receives a reply E8 of SMC completion, the core network enters an SMC completion state S6. When the core network receives an SMC rejection E9, the core network enters the final state Se. After the core network completes the SMC and other necessary operations, the core network sends a registration acceptance E10 message, indicating that the registration operation is about to be completed. When the core network receives confirmation information of registration completion E11, the core network enters a registration completion state S8, marking the completion of the entire registration process. E12 represents that the core network receives a deregistration request, triggering the core network to enter a deregistration initialization state S9 from the current state. When the core network processes the deregistration request, the core network sends a deregistration acceptance E13, and finally the core network enters the final state Se, indicating that the deregistration process is completed.

[0093] The processing logic of the depth-first search algorithm is as follows:

[0094] (1) Starting from the initial state S0, the algorithm depth-first traverses all possible state transition paths in turn.

[0095] (2) Whenever a leaf node (terminal state) is reached, the current path is returned, and all visited states and events are recorded as a complete state transition path.

[0096] (3) In the recursive process, all possible state transition paths are generated by splicing the state of the previous node, the event, and the path of the next node.

[0097] (4) By backtracking to the initial node, a complete set of state detection paths can be obtained.

[0098] Exemplarily, the generation process of the test case sequence is as follows:

[0099] Taking S0→S1→S2→S4 as an example, three test cases need to be designed, as follows:

[0100] Transition state (1) sends a registration request (S0→S1), that is, constructs a legal registration_request message containing the terminal's registration information, such as ue_security_capability and mobile_identity.

[0101] msgtype:registration_request

[0102] state:before_registration_request

[0103] meta:

[0104] ue_security_capability.present:true

[0105] mobile_identity_5gs.type:guti

[0106] octets:

[0107] registration_type_5gs.octet1:12

[0108] Transition state (2) sends an authentication request (S1→S2), that is, constructs an authentication_request message, which includes the identity of the terminal to be authenticated and the parameters required by the network for authentication.

[0109] msgtype:authentication_request

[0110] state:after_registration_request

[0111] meta:

[0112] ue_security_capability.present:true

[0113] mobile_identity_5gs.type:guti

[0114] hdrs:

[0115] security_header_type:2

[0116] mac:25

[0117] ies:

[0118] ng_ksi.content:hex1b07

[0119] Transition state (3) receives and processes the authentication response (S2→S4), that is, constructs an authentication_response message, indicating that the terminal has successfully passed the authentication and the core network has confirmed the identity of the terminal.

[0120] msgtype:authentication_response

[0121] state:after_authentication_request

[0122] meta:

[0123] authentication_result:success

[0124] ng_ksi.content:hex1b07

[0125] The transition states (1)(2)(3) together constitute the test case sequence.

[0126] S102: The terminal sends the test case and test case sequence to the core network through the base station.

[0127] It should be noted that the test case sequence is sent to the core network in a predetermined order to guide the core network to transfer according to the state corresponding to the test case sequence.

[0128] S103: The core network receives the test case and the test case sequence, and parses and processes the test case and the test case sequence based on its own internal logic.

[0129] Specifically, in the embodiment of the present invention, the test cases and test case sequences may be run on the core network, and the test cases and test case sequences may be parsed according to the core network's own operating logic.

[0130] S104: The core network obtains the result of the analysis process, and monitors whether the core network has the first type of vulnerability or the second type of vulnerability based on the result of the analysis process.

[0131] The first type of vulnerability is caused by processing malformed messages, and the second type of vulnerability is caused by the state transfer process.

[0132] Optionally, S104 may specifically include:

[0133] The core network obtains log information when processing the test case or test case sequence, and uses the log information as the result of the parsing process;

[0134] Use log information to determine whether the core network has Type 1 or Type 2 vulnerabilities.

[0135] The present invention provides an embodiment of a security vulnerability detection method for the 5G core network. By designing and generating test cases and test case sequences for NAS protocol messages, it can comprehensively cover various situations when the core network processes malformed messages in different formats, thereby improving the breadth and depth of the test. In addition, by designing a test case sequence to detect vulnerabilities caused by the core network during state transition, the comprehensiveness and accuracy of the test are improved. Finally, since the detection process of the invention method is efficient and highly automated, it can significantly improve the efficiency and quality of core network security vulnerability detection and reduce the detection cost.

[0136] Optionally, the security vulnerability detection method for the 5G core network further includes:

[0137] After detecting the existence of a first-category vulnerability or a second-category vulnerability in the core network, a report containing the first-category vulnerability or the second-category vulnerability is generated and sent to the preset security management system for further vulnerability analysis and repair.

[0138] The method provided in the embodiment of the present invention can be applied to electronic devices. Specifically, the electronic devices can be desktop computers, portable computers, smart mobile terminals, servers, etc., which are not limited in the embodiment of the present invention.

[0139] It should be noted that the terms "first," "second," and the like are used to distinguish similar objects and are not necessarily used to describe a particular order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate, so that the embodiments of the present invention described herein can be implemented in sequences other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are merely examples of devices and methods consistent with certain aspects of the present invention.

[0140] In the description of this specification, the reference terms "one embodiment," "some embodiments," "examples," "specific examples," or "some examples" mean that the specific features or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features or characteristics described can be combined in any suitable manner in any one or more embodiments or examples. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification.

[0141] Although the present invention is described herein in conjunction with various embodiments, in the process of implementing the claimed invention, those skilled in the art can understand and implement other variations of the above-mentioned disclosed embodiments by viewing the drawings and the disclosed content. In the description of the present invention, the word "comprising" does not exclude other components or steps, "one" or "an" does not exclude multiple situations, and the meaning of "multiple" is two or more, unless otherwise clearly and specifically defined. In addition, certain measures are recorded in different embodiments, but this does not mean that these measures cannot be combined to produce good results.

[0142] The above is a further detailed description of the present invention in conjunction with specific preferred embodiments, and the specific implementation of the present invention cannot be considered to be limited to these descriptions. For those skilled in the art of the present invention, several simple deductions or substitutions can be made without departing from the concept of the present invention, and all of these should be considered to fall within the scope of protection of the present invention.

Claims

1. A security vulnerability detection method for a 5G core network, applied to a 5G communication system, the 5G communication system comprising: The terminal, base station and core network are characterized by including: The terminal generates a test case and a test case sequence, wherein the test case and the test case sequence are constructed based on a protocol message hierarchy of a non-access stratum (NAS) protocol message; the protocol message hierarchy includes a message header level, an information component level, a field level, and a bit level; the test case is used to detect a first type of vulnerability under static conditions, and the test case sequence is used to detect a second type of vulnerability under dynamic conditions; The terminal sends the test case and the test case sequence to the core network through the base station; The core network receives the test case and the test case sequence, and parses and processes the test case and the test case sequence based on its own internal logic; The core network obtains a result of the parsing process, and monitors whether the core network has the first type of vulnerability or the second type of vulnerability based on the result of the parsing process; the first type of vulnerability is a vulnerability caused by processing malformed messages, and the second type of vulnerability is a vulnerability caused during state transition; The core network state set includes: initial state, registration initialization, authentication initialization, identification initialization, authentication completion, security mode function SMC initialization, SMC completion, registration intermediate state, registration completion, deregistration initialization and final state; The events that trigger state transitions in the state set include: receiving a registration request, sending an authentication request, sending a registration rejection, sending an identification request, receiving an identification response, receiving an authentication response, receiving an authentication rejection, sending an SMC command request, receiving an SMC completion reply, receiving an SMC rejection, sending a registration acceptance, receiving a registration completion, receiving a deregistration request, and sending a deregistration acceptance.

2. The method for detecting security vulnerabilities in a 5G core network according to claim 1, wherein: The terminal generates a test case and a test case sequence, including: Generate NAS protocol messages; Determining a protocol message hierarchy based on the NAS protocol message; Selecting a level from the protocol message levels to obtain a selected level; Performing corresponding fusion and mutation processing on the selected layer and then filling the result into a structured message template to construct the test case; A finite state machine model is established according to the internal transfer state of the core network, and the test case sequence is formed using the finite state machine model.

3. The method for detecting security vulnerabilities in a 5G core network according to claim 2, wherein: The step of establishing a finite state machine model according to the internal transition state of the core network and forming the test case sequence using the finite state machine model includes: According to the finite state machine model, a path search is performed on the state set under the processing of a depth-first search algorithm to generate a state detection path set; Performing detection path selection on the state detection path set to obtain a transfer path to be detected; A test case initial sequence is generated according to the transfer path to be detected and the NAS protocol message, and the test case initial sequence is filled into the message template to form the test case sequence.

4. The method for detecting security vulnerabilities in a 5G core network according to claim 1, wherein: The test case sequence is sent to the core network in a predetermined order to guide the core network to transfer according to the state corresponding to the test case sequence.

5. The method for detecting security vulnerabilities in a 5G core network according to claim 1, wherein: The generation methods of the message header level include: random generation, sequential enumeration and free enumeration; The information component level generation methods include: length mutation, byte flipping, arithmetic mutation, byte replacement and byte swapping; The field-level generation methods include: random generation, boundary value generation, reserved value enumeration, and free enumeration; The bit-level generation methods include: bit flipping, bit XOR, bit AND, bit setting and bit swapping.

6. The method for detecting security vulnerabilities in a 5G core network according to claim 1, wherein: The generation of the test case further includes: generating the test case based on the corresponding NAS protocol message version to ensure that the test case covers the protocol version and message type of the NAS protocol message.

7. The method for detecting security vulnerabilities in a 5G core network according to claim 1, wherein: The core network obtains a result of the analysis process, and monitors whether the core network has the first type of vulnerability or the second type of vulnerability based on the result of the analysis process, including: The core network obtains log information when processing the test case or the test case sequence, and uses the log information as the result of the parsing process; The log information is used to determine whether the core network has the first type of vulnerability or the second type of vulnerability.

8. The method for detecting security vulnerabilities in a 5G core network according to any one of claims 1 to 7, wherein: The security vulnerability detection method for the 5G core network also includes: After detecting the existence of the first type of vulnerability or the second type of vulnerability in the core network, a report containing the first type of vulnerability or the second type of vulnerability is generated and sent to a preset security management system for further vulnerability analysis and repair.

Images