5g control plane directed fuzzing method

Abstract

This invention provides a 5G control plane-guided fuzz testing method. It establishes a legitimate test context by extracting preceding signaling sequences from real interactions, reducing the probability of test inputs being rejected at shallow levels due to a lack of preceding protocol states or session dependencies, and enhancing the reachability of deep processing branches. It constructs a field-level protocol analysis database, enabling tests to have protocol semantic awareness capabilities, avoiding the disruption of field boundaries, length mappings, and cross-field consistency constraints caused by traditional byte-level random mutations, significantly reducing invalid inputs and improving the ability to trigger deep vulnerabilities. Simultaneously, it continuously updates the sparseness of state transition paths through test feedback, enabling test scheduling to have adaptive optimization capabilities, dynamically focusing on insufficiently covered boundary paths and low-frequency abnormal branches, achieving guided and efficient testing of high-value targets.

Description

Technical Field

[0001] This invention relates to the field of mobile communication networks, specifically to the fields of mobile communication network security, protocol testing and vulnerability discovery, and more specifically, to a 5G control plane-guided fuzz testing method. Background Technology

[0002] As the architecture of fifth-generation mobile communication networks (5G networks) continues to evolve towards service-oriented, virtualized, and cloud-based architectures, control plane protocols play a crucial role in key functions such as network access, registration and authentication, session establishment, mobility management, and network element discovery. Compared to traditional network protocols, the 5G core network control plane involves collaborative interactions between multiple network elements, including the Access and Mobility Management Function (AMF), Session Management Function (SMF), and Network Repository Function (NRF). Different protocol phases exhibit clear state progression relationships, context dependencies, and cross-field consistency constraints. Furthermore, control plane messages typically employ layered encapsulation and complex information element organization, generally including length fields, enumeration fields, conditional occurrence fields, identifier fields, and cross-field dependencies. This places high demands on the structural integrity, semantic consistency, and temporal legality of input messages in protocol implementation. Therefore, anomaly detection and vulnerability discovery related to the implementation of 5G core network control plane protocols have become an important direction in mobile communication security research.

[0003] In terms of control plane security testing, several research methods have emerged in the existing technology, including negative-oriented testing, domain knowledge-guided testing, and fuzz testing.

[0004] With the development of protocol fuzzing techniques, related research has begun to explore applying network protocol fuzzing methods to stateful interaction scenarios. For example, the paper "AFLNet: A Greybox Fuzzer for Network Protocols" proposes a greybox fuzzing method for network protocol implementations. Building upon the traditional greybox fuzzing framework, it introduces the utilization of network protocol response sequences and session states, enabling the test input generation and scheduling process to consider the stateful characteristics of protocol interactions to some extent. Subsequently, fuzzing methods focusing on protocol interfaces and stateful network services have further developed.

[0005] However, existing technologies have at least the following problems:

[0006] First, the test input lacks protocol structure constraints. 5G control plane messages generally have a multi-layered structure, including message headers, information elements, length fields, identifier fields, and conditional occurrence fields. Traditional byte-level random mutations can easily disrupt field boundaries, length mapping relationships, enumeration constraints, and cross-field consistency requirements, causing the message to become invalid at the outer parsing stage and unable to enter the subsequent service processing path.

[0007] Second, target signaling is difficult to process in a legitimate context. Many control plane logics are only triggered after the pre-context establishment, authentication, security negotiation, or session establishment are completed. If the tester sends target signaling independently from an empty state, the target signaling may be rejected by the target network element in shallow processes due to the lack of necessary protocol state and context prefix.

[0008] Third, the allocation of test resources lacks targeted guidance. Different candidate signaling messages differ in their potential to trigger anomalies and their ability to advance status. If a uniform testing strategy is adopted for all candidate signaling messages, resources are easily wasted repeatedly on the high-frequency main path, instead of prioritizing coverage of low-frequency, low-coverage branches that are more likely to trigger anomaly handling logic.

[0009] It should be noted that the background information presented here is only for illustrating relevant information about the present invention to aid in understanding the technical solution of the present invention, and does not imply that the relevant information is necessarily prior art. The relevant information was submitted and disclosed together with the present invention, and should not be considered prior art unless there is evidence that the relevant information was disclosed before the filing date of the present invention. Summary of the Invention

[0010] Therefore, the purpose of this invention is to overcome the shortcomings of the prior art and provide a control surface-guided fuzzy testing method.

[0011] The objective of this invention is achieved through the following technical solution:

[0012] According to a first aspect of the present invention, a control plane-guided fuzz testing method is provided, comprising the following steps: S1: constructing a protocol analysis database containing multiple field-level protocol knowledge entries based on protocol specification text related to the target control plane protocol and real control plane interaction samples, wherein each knowledge entry is used to describe the protocol attributes and recommended mutation strategies of a specified field in a 5G control plane protocol message; S2: establishing a control plane state transition model, statistically analyzing the historical coverage count of each state transition path in the model based on historical control plane interaction data, and determining the path sparseness from each state to its successor state based on the historical coverage count; S3: evaluating the test value of each candidate signaling in the candidate signaling set from multiple dimensions, determining the joint score of each candidate signaling based on the test value of the candidate signaling and the path sparseness of its path, and selecting the target test signaling from the candidate signaling set according to the joint score. S4: Based on the target test signaling, identify the corresponding target test node in the actual control plane interaction process, and extract the preceding signaling sequence before the target test node from the process. The preceding signaling sequence is used to enable the target network element to enter the expected protocol state and session context corresponding to the target test node. S5: Based on the online man-in-the-middle execution module deployed between the target network elements, forward the preceding signaling sequence in sequence transparently, and perform selective replacement, injection, or field-level guided mutation on the target test signaling according to the protocol analysis database when it reaches the target test node to obtain the test message and send it. S6: Collect the execution feedback of the target network element in response to the test message to obtain the test interaction sample for this test, and add the test interaction sample to the historical interaction data of the control plane to update the historical coverage and path sparseness of each state transition path used in subsequent tests. This scheme achieves at least the following beneficial technical effects: Firstly, by establishing a legitimate test context using preceding messages from real interactions, it reduces the probability of test inputs being rejected at shallow stages due to a lack of preceding protocol states, session context, or dependencies between different messages. This increases the likelihood of target signaling being processed in a real protocol environment and enhances the reachability of subsequent deeper processing branches. Secondly, by using a protocol analysis database to record field-level protocol attributes and recommended mutation strategies in a structured manner, the testing process gains protocol semantic awareness, avoiding the disruption of field boundaries, length mapping relationships, and cross-field consistency constraints caused by traditional byte-level random mutations. This significantly reduces the proportion of invalid test inputs and improves the parsability of test messages and the ability to trigger deep vulnerabilities. Furthermore, by continuously feeding test interaction samples back to historical interaction data to update path sparseness, test scheduling gains adaptive optimization capabilities, dynamically adjusting subsequent test directions and gradually focusing on under-covered state transition paths.

[0013] Optionally, in step S5, the online man-in-the-middle execution module is an online test execution component deployed between two target network elements. It is used to identify, intercept, transparently forward, and conditionally trigger control plane messages passing through the two target network elements in real time. Specifically, for each passing control plane message, it identifies whether its location has reached the currently set target test node. If not, the message is transparently forwarded to the corresponding target network element as is to ensure the original business process continues and maintains the business's session context, state machine position, and cross-message dependencies. If so, the original message is intercepted, processed, and then sent again. The processing method includes at least one of the following: keeping the original message and forwarding it directly; replacing the original message with a pre-selected target test signaling; and performing field-level guided mutation based on the recommended mutation strategy in the field-level protocol knowledge entries of the protocol analysis database, based on the original message or target test signaling. This scheme can achieve at least the following beneficial technical effects: establishing an online man-in-the-middle execution link between target network elements, intercepting and identifying passing control plane messages in real time, thereby providing the test system with a continuously perceptible and continuously controllable online execution entry point, rather than relying on offline message splicing or independent injection. Control plane messages that have not yet reached the target test node are forwarded transparently as is, avoiding premature changes to existing message relationships and state transitions in the pre-processing stage. This ensures that the target flow reaches the corresponding protocol state at the target test node first. Selective replacement, field-level guided mutation, or injection is performed on control plane messages that have reached the target test node, allowing for localized, targeted modifications around the target node during the testing process. This makes test results easier to locate, analyze, and reproduce. Transparent forwarding, target node identification, and localized modifications are integrated into a unified online execution flow, enabling context establishment and target testing to be completed continuously within the same link, rather than relying on multiple independent execution modules. This integrated structure is more suitable for stable operation in real business environments, possessing good engineering feasibility and protocol environment adaptability.

[0014] Optionally, the protocol analysis database can be constructed by: using a large language model to perform information alignment analysis, attribute extraction, and structured organization on the protocol specification text and real control plane interaction samples, resulting in structured extracted content that merges information from both sides; and using the large language model to organize the structured extracted content into field-level protocol knowledge entries, each of which includes field type, semantic role, value constraints, dependencies, location range in the message, and recommended mutation strategy. This approach can achieve at least the following beneficial technical effects: Automated information alignment analysis, attribute extraction, and structured organization of the protocol specification text and real control plane interaction samples using a large language model significantly reduces the workload of manually reading the protocol specification item by item and manually organizing field relationships and coding positions, making the construction process of the protocol analysis database scalable and reusable. By merging information from both the specification side and the sample side, the resulting field-level protocol knowledge entries contain both abstract semantic constraints and dependencies, as well as specific message location ranges, providing precise guidance for subsequent field location, constraint checking, and guided mutation.

[0015] Optionally, field-level guided mutation includes: selecting target fields to be disturbed from various fields of the current object based on field type, semantic role, and value constraints; the current object being the original message or a pre-selected target test signaling; mapping the abstract target field to be disturbed to a modifiable position in the current object based on the position range of the target field recorded in the protocol analysis database; generating corresponding disturbance values ​​for the modifiable positions according to the recommended mutation strategy; and performing linked adjustments on other fields that have length mapping relationships, consistency constraint relationships, or conditional occurrence relationships with the target field based on the disturbance values ​​and dependencies to obtain the test message. This scheme can achieve at least the following beneficial technical effects: by selecting target fields to be disturbed through comprehensive analysis of field type, semantic role, and value constraints, the mutation operation focuses on key positions that are more likely to affect the protocol processing logic, avoiding a large amount of invalid input caused by indiscriminate byte disturbances. Accurately mapping abstract fields to modifiable positions in the original message based on the position range recorded in the protocol analysis database ensures the accuracy and executability of field-level mutation. Based on the recommended mutation strategy, targeted perturbation values ​​are generated, and in conjunction with dependencies, related fields that have length mapping, consistency constraints, or conditional occurrence relationships with the target field are adjusted in a coordinated manner. This achieves a balance between keeping the message as processable as possible and creating abnormal states with test value, thereby significantly increasing the probability of the test message passing the basic parsing check and enhancing the ability to trigger deep processing branches and abnormal handling logic.

[0016] Optionally, step S2 includes: representing the control plane interaction process as a sequence of gradual state changes triggered by control plane signaling, and defining a control plane state transition model containing a finite set of states; based on historical control plane interaction data containing real control plane interaction samples and test interaction samples, counting the number of transitions between each state; using the control plane state transition model to estimate the state transition probability based on the number of state transitions, and determining the path sparseness of each path based on the state transition probability, wherein the path sparseness is inversely proportional to the state transition probability. This scheme can achieve at least the following beneficial technical effects: it can identify state transition paths with insufficient coverage in the current test from the control plane protocol process level, so as to reduce the repeated consumption of test resources on high-frequency backbone paths and improve the ability to explore boundary scenarios, abnormal paths and subsequent deep processing branches.

[0017] Optionally, step S3 includes: evaluating the test value of each candidate signaling in the candidate signaling set from the dimensions of attack cost, attack complexity, attack undetectability, attack benefit, and signaling vulnerability, or a combination thereof; multiplying the test value of the candidate signaling by the path rarity of its path as the joint score of each candidate signaling; and selecting target test signaling from the candidate signaling set in descending order of the joint score. This scheme can achieve at least the following beneficial technical effects: comprehensively evaluating the test value of candidate signaling from multiple dimensions such as attack cost, attack complexity, attack undetectability, attack benefit, and signaling vulnerability, so that signaling selection no longer relies on a single indicator, and can comprehensively characterize the comprehensive characteristics of candidate signaling in terms of resource input, technical threshold, concealment, potential impact, and implementation vulnerability. Multiplying the test value by the path rarity to form a joint score takes into account both the need for path exploration and the benefit of signaling testing, enabling test scheduling to simultaneously identify signaling located on low-coverage paths and signaling with high test value, avoiding target selection being determined solely by a single coverage information or a single value score. Selecting target test signaling based on joint scoring ranking can prioritize the allocation of limited testing resources to candidates with greater security impact and testing benefits, thereby increasing the effective feedback ratio and vulnerability discovery efficiency per unit of testing resources and enhancing the ability to hit low-coverage, high-value targets.

[0018] Optionally, the test value may be determined as follows:

[0019]

[0020] in, This indicates the order of attack cost, attack complexity, attack undetectability, attack gain, and signaling vulnerability, from 1st to 5th. The product of the quantized values ​​of each dimension, This scheme achieves at least the following beneficial technical effects: It defines test value using the geometric mean of quantified values ​​across dimensions, creating a multiplicative coupling relationship between dimensions rather than a simple linear summation. Only when candidate signaling performs exceptionally well across multiple dimensions can a high comprehensive score be obtained, effectively filtering out signaling objects with truly high test value. The formula structure is sensitive to changes in the values ​​of each dimension, distinguishing subtle differences between different candidate signaling across dimensions and avoiding problems of overly concentrated or insufficiently discriminative scoring results.

[0021] According to a second aspect of the present invention, a computer device / apparatus / system is provided, including a memory, a processor, and a computer program / instructions stored in the memory, wherein the processor executes the computer program / instructions to implement the steps of the method described in the first aspect.

[0022] According to a third aspect of the present invention, a computer program product is provided, comprising a computer program / instructions that, when executed by a processor, implement the steps of the method described in the first aspect. Attached Figure Description

[0023] The embodiments of the present invention will be further described below with reference to the accompanying drawings, wherein:

[0024] Figure 1 This is a flowchart illustrating the control surface-guided fuzzy testing method according to an embodiment of the present invention.

[0025] Figure 2 This is a schematic diagram illustrating the construction process of the protocol analysis database according to an embodiment of the present invention;

[0026] Figure 3 This is a schematic diagram of the control plane state transition model according to an embodiment of the present invention;

[0027] Figure 4 This is a schematic diagram of the deployment architecture of an online man-in-the-middle execution module according to an embodiment of the present invention. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0029] As mentioned in the background section, existing technologies suffer from problems such as a lack of protocol structure constraints on test inputs, difficulty in processing target signaling in a legitimate context, and a lack of targeted guidance in the allocation of test resources.

[0030] While conducting research on 5G control plane vulnerability discovery, the inventors found that the main reason for this is that existing technologies directly apply general fuzzing methods to 5G control plane scenarios. Although this can continuously send a large number of packets, many of these packets are rejected by the target network element at the message parsing, consistency verification, or process legality check stages due to a lack of field-level constraint maintenance capabilities. Even if some packets can pass outer-layer parsing, they cannot enter subsequent deep processing flows due to the lack of preceding protocol states and session context. Existing methods mainly focus on how to generate more test inputs, but do not address the crucial issue of how to ensure that test inputs are based on legitimate test contexts and are focused on targeting more valuable test nodes.

[0031] Further analysis revealed that the core technical challenge of 5G control plane testing lies not in simply generating messages, but in embedding test inputs into an established legitimate test context without disrupting real business processes. Based on this, the inventors proposed a method that eliminates the need for manually constructing a complete pre-process from an empty state. Instead, it extracts the preceding signaling sequence from the actual control plane interaction process and replays or transparently forwards it in the original order during runtime, allowing the target network element to enter the protocol state and session context corresponding to the target test node. When the process reaches the target test node, selective replacement, injection, or online mutation of the current target signaling is then performed.

[0032] Furthermore, considering that if all candidate signaling is still tested uniformly, the testing budget will still be heavily consumed on high-frequency, low-return paths, the inventors further represent the control plane interaction process as a gradual state change process driven by control signaling, and calculate path rarity based on the state changes observed during the actual control plane interaction process and replay execution. Simultaneously, the testing value of candidate signaling is defined from multiple dimensions, and candidate signaling is selected based on a joint score calculated from the testing value and path rarity, with a focus on testing candidate signaling on low-frequency, high-return paths to more quickly identify relevant abnormal logic.

[0033] Based on the above considerations, this application proposes a 5G control plane guided fuzzy testing method. First, a field-level protocol analysis database is constructed using protocol specification texts and real control plane interaction samples to support subsequent field location, constraint checking, and guided mutation. Second, a control plane state transition model is established based on the real control plane interaction process and replay execution process, and path sparseness is calculated based on state transition statistics. On this basis, a comprehensive value assessment of candidate signaling is performed to determine the target signaling that deserves priority testing. Third, the preceding signaling sequence before the target test node is extracted during the real control plane interaction process, and the corresponding protocol state and session context are established through online transparent forwarding or in-sequence replay. When the process progresses to the target test node, the target signaling is selectively replaced, injected, or subjected to field-level guided mutation. Finally, the processed test message is sent to the target network element, and anomaly feedback results are collected. This method reuses legitimate preceding messages formed by real business processes and concentrates test resources more effectively on target test nodes and target fields that are more likely to trigger subsequent deep processing flows and anomaly logic.

[0034] It should be noted that the method of this application is applicable to vulnerability mining of protocols such as Non-Access Stratum (NAS) protocols, Next Generation Application Protocol (NGAP), Packet Forwarding Control Protocol (PFCP), and Hypertext Transfer Protocol version 2 (HTTP / 2) based on Service-Based Interface (SBI) in the 5G control plane. Indicatively, it is mainly applicable to 5G control plane protocols with a clear field structure, a pre- and post-state flow, and the ability to be collected, parsed, forwarded, replaced, or re-encoded in a test environment. Therefore, protocols such as NAS, NGAP, PFCP, and SBI / HTTP / 2 are well-suited to the technical solution of this application. However, the method of this application cannot be directly applied to pure user plane data protocols, physical layer or radio frequency waveform layer objects, encrypted integrity protection messages for which plaintext cannot be obtained or cannot be re-encoded, and proprietary protocols lacking a parseable field structure and real-world sample support.

[0035] According to one embodiment of the present invention, see Figure 1 This invention provides a control surface-guided fuzzy testing method, comprising steps S1, S2, S3, S4, S5, and S6. To better understand this invention, each step is described in detail below with reference to specific embodiments.

[0036] Step S1: Based on the protocol specification text related to the target control plane protocol and the actual control plane interaction samples, construct a protocol analysis database containing multiple field-level protocol knowledge entries. Each knowledge entry is used to describe the protocol attributes and recommended mutation strategies of a specified field in the 5G control plane protocol message.

[0037] According to one embodiment of the present invention, the construction method of the protocol analysis database includes: using a large language model to perform information alignment analysis, attribute extraction and structured organization on the protocol specification text and the actual control plane interaction samples to obtain structured extracted content that merges information from both sides; using a large language model to organize the structured extracted content into field-level protocol knowledge entries, each field-level protocol knowledge entry including field type, semantic role, value constraints, dependency relationship, position range in the message and recommended mutation strategy.

[0038] According to one embodiment of the present invention, such as Figure 2 As shown, the first step involves acquiring the protocol specification text (specification-side information) and real control plane interaction samples (sample-side information) related to the target control plane protocol. The protocol specification text includes definition paragraphs, field structure tables, enumeration tables, constraint statements, and consistency requirements related to the target message. The real control plane interaction samples include the original signaling byte stream, the parsed field tree, the field hierarchy path, and the offset, length, and / or bit range information of the fields in the original byte stream. While the protocol analysis database can be manually constructed according to requirements in this step, the workload is substantial. To reduce the workload, a large language model can be used to perform alignment analysis, attribute extraction, and structured organization of the protocol specification-side evidence and sample-side evidence, and the results can be organized into field-level protocol knowledge entries. To ensure consistency in subsequent program calls, all fields can be uniquely identified using field names with hierarchical paths, and the knowledge entries can be uniformly written into the protocol analysis database.

[0039] According to one embodiment of the present invention, alignment analysis refers to mapping abstract field definitions in the protocol specification text to specific field instances in real control plane interaction samples (real signaling samples), forming field-level knowledge records that can be directly accessed later. Attribute extraction refers to automatically identifying and extracting attribute information of specified dimensions related to protocol fields from unstructured protocol specification text and real control plane interaction samples. Structured organization refers to standardizing the format of the extracted scattered attribute information, ultimately organizing it into a unified and standardized data format that merges information from both sides, i.e., structured content extraction. The illustrative construction process is as follows:

[0040] First, extract two types of input information from the target message: one is the protocol specification text, including message definition, information element structure, field description, enumeration values, length constraints, conditional occurrence relationships and consistency requirements; the other is the real control plane interaction sample, including the raw byte stream in the real packet capture, the parsed field tree, the field hierarchy path, the field values, and the offset, length or bit range of the field in the original message.

[0041] Then, using a large language model, the information elements and field directories contained in the target message are identified from the normative text, and the actual field instances and their encoded positions are identified from the samples. Based on information such as message type, information element identifier, field name, field hierarchy path, field order, field type, and value range, the fields in the normative text are matched with the fields in the samples to achieve alignment. For multi-level nested or identically named fields, field names with hierarchical paths are used for unique identification to avoid mismatches. After matching, attribute extraction and structuring are performed to obtain structured extracted content that merges information from both sides.

[0042] Finally, a large language model is used to organize the structured extracted content from both sides of the information into unified field-level protocol knowledge entries (field-level knowledge records). The specification side primarily provides field semantics, types, value constraints, and dependencies; the sample side primarily provides the actual values ​​and the location range in the original message. If a certain attribute lacks sufficient evidence, it is marked as unknown or null in the field-level protocol knowledge entry. This alignment result is subsequently used for field location, constraint checking, dependency linkage processing, and field-level guided mutation.

[0043] According to an example of the present invention, an illustrative protocol analysis database is as follows:

[0044]

[0045] This example uses a JSON-like structure to illustrate the field types, semantic roles, value ranges, dependencies, original message location methods, and recommended mutation strategies for recording a message. Specifically:

[0046] "message_type": "PFCP.SessionEstablishmentRequest" indicates that the message type corresponding to the current protocol analysis database record is PFCP Session Establishment Request, i.e., a PFCP session establishment request message. Subsequent field records all belong to this type of message.

[0047] "fields" indicates the beginning of the definition of the set of fields contained in this message. The content below describes the various identifiable, locatable, and mutable protocol fields within this message.

[0048] "node_id" indicates that the field currently being described is named node_id. This field is used to represent node identification information and is a field or information element in the PFCP message.

[0049] "type": "identifier" indicates that the field type is an identifier. This type of field is typically used to identify a network element, node, session, or context object, rather than a regular numeric or boolean field.

[0050] "role": "identity" indicates that the semantic role of this field is identity identification. In other words, the role of this field in protocol processing is to identify the identity of a communication entity or node, for example, to distinguish different PFCP nodes.

[0051] "range": null, indicating that no fixed range of values ​​for this field is given in the current database record. Null here does not mean the field has no constraints, but rather that an explicit enumeration range, maximum value, minimum value, or fixed set of values ​​has not yet been written in this example. For identifier fields, their values ​​are usually related to the deployment environment, node configuration, or runtime context, and therefore may not be represented by a fixed range.

[0052] "dependencies": null indicates that no explicit dependencies between this field and other fields are recorded in the current example. An empty (null) value here means that no dependencies have been found or filled in yet. For example, if a field must change simultaneously with a length field, quantity field, session identifier, or condition field, then a dependency could be recorded here; however, it is not listed in this example.

[0053] "byte_scope" indicates the starting point describing the location range of this field in the original message byte stream. This part tells subsequent mutation programs which field position or byte range in the original message to modify if the node_id field needs to be modified.

[0054] "ref": "IE[NodeID].value" indicates that the node_id field corresponds to the position IE[NodeID].value in the original message parsing structure. Here, IE[NodeID] represents the Node ID information element, and value represents the actual value within that information element. Subsequent mutations primarily modify the value of the Node ID information element, rather than the entire information element header or other irrelevant fields.

[0055] "mutation" indicates the start of a description of the recommended mutation strategy for this field. This section guides the fuzzing module on the type of perturbation method to use when performing field-level guided mutations on this field.

[0056] "recommended": ["byte_flip"] indicates that the recommended mutation method for this field is byte flipping. That is, within the byte range corresponding to this field, one or more bytes are flipped, replaced, or perturbed to test the target network element's ability to handle changes in node identifier values.

[0057] "aggressive": ["special_value"] indicates that a more aggressive mutation method can be used for this field, which is to replace it with a special value. For example, this field can be replaced with all zeros, all ones, boundary length values, abnormal format values, repeating pattern values, or other special identifier values, which can be used to test the target network element's parsing, verification, and anomaly handling logic for abnormal node identifiers.

[0058] Step S2: Establish a control plane state transition model, count the historical coverage times of each state transition path in the model based on the historical interaction data of the control plane, and determine the path rarity from each state to its successor state based on the historical coverage times.

[0059] In this step, the system counts the number of transitions from the current state to each successive state based on the state evolution model, and calculates the empirical transition probability and path rarity of each successive state transition accordingly, thereby providing a basis for the sorting and screening of subsequent candidate signaling.

[0060] According to one embodiment of the present invention, step S2 includes steps S21, S22, and S23. Wherein:

[0061] Step S21: Represent the control plane interaction process as a sequence of gradual state changes triggered by control plane signaling, and define a control plane state transition model containing a finite set of states.

[0062] According to one embodiment of the present invention, the control plane service process is represented as a sequence of gradual state changes triggered by control plane signaling, rather than simply performing superficial statistics on the original message bytes or transmission and reception results. This allows the test system to directly identify less-tested areas around the protocol state change process. For ease of formal description, let the system state at discrete time step t ("state" refers to the protocol stage or context state of the modeled object in the control plane process; that is, the current state of the system, such as "UE not yet connected," "UE connected," "registration process in progress," "registration completed," etc.) be a random variable X. t ∈S={s1,s2,…,s n}, where S is the finite set of states corresponding to the current modeling object, s n This represents the nth state.

[0063] According to one example of the invention, such as Figure 3 As shown, the target control surface interaction process is represented as a gradual state change process driven by control signaling, and a control surface state transition model is established accordingly. Wherein:

[0064] UE (User Equipment) represents user equipment (such as mobile phones and other terminals).

[0065] NAS (Non-Access Stratum) represents the non-access stratum, which is the signaling protocol layer between the UE and the core network.

[0066] AMF (Access and Mobility Management Function) is a control plane network element in the 5G core network, responsible for UE access control, mobility management, and NAS signaling processing.

[0067] RRC (Radio Resource Control) is a signaling protocol layer between the UE and the base station, responsible for the establishment, configuration, maintenance, and release of radio connections.

[0068] gNB (Next Generation Node B), representing a 5G base station, is a core device of the 5G radio access network, responsible for transmitting and receiving radio signals and processing RRC signaling.

[0069] CM-IDLE (Connection Management - IDLE) represents the connection management idle state.

[0070] CM-CONNECTED (Connection Management - CONNECTED) represents the connection management connection state.

[0071] RRC-CONNECTED (Radio Resource Control - CONNECTED) represents the radio resource control connection state.

[0072] RRC-INACTIVE (Radio Resource Control - INACTIVE) represents the radio resource control suspended state (inactive state).

[0073] RRC-IDLE (Radio Resource Control - IDLE) represents the radio resource control idle state.

[0074] , indicating state , is the in the finite state set S. The nth state element represents the nth possible state element in the model. Protocol states. For example... Indicates state 1, in Figure 3 This corresponds to the CM-IDLE state. Indicates state 2, in Figure 3 This corresponds to the CM-CONNECTED state.

[0075] , indicating from state Transition to state The transition probability. For example, , representing from state (CM-IDLE) transition to state The transition probability of (CM-IDLE), that is, the self-maintaining probability of the CM-IDLE state. , representing from state (CM-IDLE) transition to state The transition probability of (CM-CONNECTED) is the probability of moving from an idle state to a connected state. , representing from state (CM-CONNECTED) transition to state The transition probability of (CM-IDLE) is the probability of being released from the connected state and entering the idle state. , representing from state (CM-CONNECTED) transition to state The transition probability of (CM-CONNECTED), that is, the self-maintaining probability of the CM-CONNECTED state.

[0076] Step S22: Based on the historical control plane interaction data containing real control plane interaction samples and test interaction samples, count the number of transitions between each state.

[0077] According to one embodiment of the present invention, for the state change sequence observed during the actual control plane interaction process and the replay execution process, the number of transitions between each state is counted. For example, based on the state change sequence observed during the historical interaction process and the replay execution process, the transition from state s is recorded as... i to state s j The number of transitions is N ij = |{ t | X t =s i X t+1 =s j The number of state transitions can be counted using both normal interaction processes and replay execution processes, rather than relying solely on theoretical state machines or single test results to infer path importance. The former reflects common backbone paths in the business flow, while the latter reflects the actual reachable paths of the current testing framework in a real environment.

[0078] Step S23: Use the control surface state transition model to estimate the state transition probability based on the number of state transitions, and determine the path rarity of each path based on the state transition probability. The path rarity is inversely proportional to the state transition probability.

[0079] According to one embodiment of the present invention, the state transition probability is estimated based on the number of transitions between states. For each subsequent state transition in the current state, the path sparseness is calculated based on the corresponding state transition probability, thereby making it easier to discover boundary state transition paths and low-frequency anomaly handling paths. The lower the frequency of a path, the higher its path sparseness, indicating that the path is under-covered in the current test and is more worthy of priority exploration. The state transition probability matrix is ​​denoted as P=[p ij ]∈ℝⁿˣⁿ. Where, p ij Indicates the system from state s i Transition to state s j The probability of this is denoted as p. ij = r(X t+1 =s j | X t =s i ), i,j∈{1,…,n}, and satisfy When state s i There is a successor transition in the sample, that is At that time, the empirical estimate of the state transition probability is:

[0080]

[0081] Therefore, we can define from state si to state s j The path rarity of the state transition is:

[0082]

[0083] in, >0 indicates a smoothing term. Usually, a small positive value is used, such as 10. -6 If a sufficient statistical sample is available, then A value not exceeding 1% of the minimum non-zero empirical transition probability can be used to ensure computational stability.

[0084] This step identifies path sparseness through control plane state transition modeling and low-coverage path identification mechanisms. Instead of judging test value solely based on whether a single message receives a response, it represents the control plane interaction process as a gradual state change driven by control plane signaling. Based on normal interaction processes and replay execution processes, it statistically analyzes state transition frequencies, estimates state transition probabilities, and further calculates the rarity of state transition paths—that is, path sparseness—to identify low-frequency state transition paths with insufficient coverage. Path sparseness serves as a crucial basis for path selection and test scheduling, assigning higher exploration priority to low-frequency, low-coverage paths, thus preventing test resources from being repeatedly consumed on high-frequency backbone processes.

[0085] Step S3: Evaluate the test value of each candidate signaling in the candidate signaling set from multiple dimensions, and determine the joint score of each candidate signaling based on the test value of the candidate signaling and the path rarity of the path it is on, and select the target test signaling from the candidate signaling set according to the joint score.

[0086] According to one embodiment of the present invention, step S3 includes steps S31, S32, and S33.

[0087] Step S31: Evaluate the test value of each candidate signaling in the candidate signaling set from the dimensions of attack cost, attack complexity, attack undetectability, attack gain, and signaling vulnerability, or a combination thereof.

[0088] According to one embodiment of the present invention, instead of using an average testing approach, the present invention quantitatively evaluates candidate signaling from multiple dimensions, including attack cost, attack complexity, attack undetectability, attack gains, and signaling vulnerability, and forms a test value (comprehensive value score) for the candidate signaling based on normalization. This test value not only reflects whether a signaling is prone to triggering anomalies, but also reflects its comprehensive test value in terms of state changes, entry into subsequent deep processing flows, and return on unit test investment, thereby making test resource allocation more targeted.

[0089] According to one embodiment of the present invention, the illustrative evaluation method for each dimension is as follows:

[0090] (1) Attack cost Cos Eff

[0091] This dimension is used to assess the explicit resource input required to manipulate a certain type of signaling. The assessment can include statistics on the equipment requirements, deployment conditions, network element access conditions, access permissions, additional configuration costs, and time costs required to conduct tests on this type of signaling. For example, if a certain type of signaling can be tested simply by replacing or modifying an existing man-in-the-middle module, the cost is lower. Eff The value is relatively high; if additional equipment, additional permissions, complex deployment, or a long environment preparation time is required, the cost will be high, Cos Eff The value is relatively low.

[0092] (2) Attack complexity Com Eff

[0093] This dimension is used to assess the technical threshold for manipulating a certain type of signaling. Assessment factors include whether it requires mastering complex protocol details, obtaining key context information, strict requirements on trigger timing, the need for coordination among multiple network elements or multiple rounds of messages, and the need to maintain cross-message dependencies. For example, if candidate signaling can be directly replaced or mutated at a single target node, and has low requirements for timing and context, then the complexity is low. Eff The value is relatively high; if multi-step interaction, precise timing, or multiple context fields are required, the complexity is high. Eff The value is relatively low.

[0094] (3) Attacks that are undetectable Atk Undt

[0095] This dimension assesses the ease with which candidate signaling can be detected and blocked by existing legitimacy checks, anomaly detection, log alerts, or protection mechanisms. The assessment can consider factors such as protocol phase, message protection status, field legitimacy, ease of triggering explicit error codes, ease of generating abnormal logs, and ease of identification by protection rules. For example, if a certain type of signaling, after mutation, still easily passes outer parsing and basic consistency checks, and is not likely to immediately trigger alarms or reject responses, then Atk... Undt The value should be relatively high; if the mutation makes it easy for the parser, validity check, or protection mechanism to directly block it, the value should be relatively low.

[0096] (4) Attack Gains Atk Rewd

[0097] This dimension is used to assess the potential impact of successfully manipulating a certain type of signaling. For the 5G control plane, the focus can be on whether it affects key functions such as registration, authentication, session establishment and modification, mobility management, identity information processing, policy control, and context establishment or release. For example, if abnormal handling of a certain type of signaling could lead to denial of service, state inconsistency, context errors, session anomalies, incorrect policy issuance, or interruption of critical processes, then Atk... Rewd The value should be relatively high; if the signaling only affects a local, non-critical, or easily recoverable process, the value should be relatively low.

[0098] (5) Signaling vulnerability Sig Vul

[0099] This dimension is used to assess the likelihood of a certain type of signaling exposing security vulnerabilities in its implementation and deployment. The assessment can be combined with publicly available vulnerability information, historical anomaly trigger records, crash / timeout / rejection response scenarios in existing tests, protocol parsing complexity, field nesting depth, number of optional fields, number of length fields, number of cross-field dependencies, and implementation processing chain length. For example, if a certain type of signaling has a complex field structure, is historically more prone to triggering anomalies, or involves a long processing chain and many consistency constraints, then Sig... Vul The value should be relatively high; if the structure is simple, the processing path is short, and historical test feedback is stable, then the value should be relatively low.

[0100] According to one embodiment of the present invention, the comprehensive value score Δ of candidate signaling m is defined as:

[0101]

[0102] in, This represents the product of the quantized values ​​of Z dimensions. .

[0103] Indicatively, assuming all five dimensions are included, the overall value score Δ of candidate signaling m can be defined as:

[0104]

[0105] Among them, Cos Eff Indicates the cost of an attack, reflecting the explicit resource investment required to manipulate a particular type of signaling; Com Eff Atk represents attack complexity, used to characterize the implicit barriers required to carry out this type of signaling manipulation. It mainly reflects the degree of mastery of protocol details, the difficulty of obtaining key contextual information, the accuracy of triggering timing, and the complexity of multi-step interactive coordination; Undt Atk indicates the undetectability of an attack, characterizing the ease with which such manipulation of signaling can be detected or blocked, given existing legitimacy checks, anomaly detection, and protection mechanisms.Rewd Indicates the attack gain, used to characterize the potential impact of successfully manipulating this type of signaling; Sig Vul This represents signaling vulnerability, used to characterize the relative degree to which a certain type of signaling is exposed to security flaws in the implementation and deployment environment; all of the above dimensions can be normalized to the [0,1] interval.

[0106] Step S32: The product of the test value of the candidate signaling and the path rarity of its path is used as the joint score of each candidate signaling.

[0107] According to one embodiment of the present invention, this step jointly calculates the comprehensive value score of the candidate signaling and the path sparseness of its corresponding state transition path to obtain a joint score for the candidate signaling. For example, in the case of s i to s j Regarding the state transition, let A(s) i ,s j If is the observable set of candidate signaling, then the joint score is defined as:

[0108] Score(m|s i ,s j = Δ(m)·R(s) i ,s j ), m∈A(s i ,s j )

[0109] Where Δ(m) is the comprehensive value of candidate signaling m, and R(s) i ,s j ) indicates the state s i to state s j The rarity of state transition paths.

[0110] Step S33: Select the target test signaling from the candidate signaling set in descending order of joint score.

[0111] According to one embodiment of the present invention, candidate signaling is sorted and filtered based on the joint score. Candidate signaling with higher joint scores is identified as target test signaling or added to the target test signaling set. After the target test signaling is selected, the system records its corresponding target state transition and target test node location, and directly feeds back the joint score result to the target test node selection and online execution stages. This allows target selection to be dynamically adjusted based on path statistics and value assessment results for subsequent online execution. Thus, this joint guidance mechanism avoids target selection being determined solely by a single coverage information or a single value score, enabling the simultaneous identification of signaling located on low-coverage paths and signaling with inherently high testing value. This prioritizes limited testing resources for candidate signaling with greater security impact and testing benefits, improving the effective feedback ratio and vulnerability discovery efficiency per unit of testing resources.

[0112] Step S4: Based on the target test signaling, identify the corresponding target test node in the real control plane interaction process, and extract the preceding signaling sequence of the target test node from the process. The preceding signaling sequence is used to enable the target network element to enter the expected protocol state and session context corresponding to the target test node.

[0113] According to one embodiment of the present invention, based on the target test signaling determined in step S3, the corresponding target test node is identified in the actual control plane interaction process, and the preceding signaling sequence before the target test node is extracted. By directly inheriting the preceding message relationships in the actual service flow, the subsequent test input has a contextual basis that more closely matches the actual protocol processing conditions. The target test node refers to the position where the target test signaling should be sent, received, or processed in a complete control plane service flow. The preceding signaling sequence refers to the message sequence that, after execution according to the original service flow order, enables the target network element to enter the expected protocol state and session context corresponding to the target test node. Subsequently, the original sending direction, message order, and session binding relationship of the preceding signaling sequence are maintained, and transparent forwarding or in-order replay is performed, instead of arbitrarily rearranging the preceding messages or sending them one by one as independent messages. This allows for a more complete preservation of the dependencies in the preceding state establishment process. In other words, in the subsequent replay of the preceding signaling sequence, the focus is on maintaining the order of state changes, message sequence, and dependencies between different messages in the real business process; only when the online execution process reaches the target test node will the current target signaling be replaced, injected, or subjected to field-level guided mutation.

[0114] Intuitively, firstly, the system searches for message instances matching the target test signaling from the current session trajectory formed during offline normal interaction samples or online transparent forwarding. Matching criteria include protocol type, message type, message direction, session identifier, transaction identifier, UE identifier, network element identifier, and the service process stage of the message. After identifying the target message instance, the system marks the location of that message as the target test node. Secondly, the system extracts the message sequence preceding the target test node from the session trajectory as the preceding signaling sequence for that target test node. This preceding signaling sequence includes registration, authentication, security negotiation, session establishment, context establishment, or other pre-interaction messages required for the target network element to enter the corresponding state. Simultaneously, the message order, transmission / reception direction, key context fields, and state progression relationship of the preceding signaling are recorded for subsequent online execution phases to replay in the original order or transparently forward. Through this step, the trigger position of each target test signaling in the real service process can be determined, and the preceding context required for the target network element to reach that position can be obtained.

[0115] Step S5: Based on the online man-in-the-middle execution module deployed between the target network elements, the preceding signaling sequence is forwarded transparently in sequence, and selective replacement, injection or field-level guided mutation is performed on the target test signaling according to the protocol analysis database at the target test node to obtain the test message and send it.

[0116] According to an embodiment of the present invention, in step S5, the online man-in-the-middle execution module is an online test execution component deployed between two target network elements, used to identify, intercept, transparently forward, and conditionally trigger control plane messages passing through the two target network elements in real time; wherein, for each passing control plane message, it is identified whether its location has reached the currently set target test node; if not, the message is transparently forwarded to the corresponding target network element as is to ensure that the original business process continues to advance and maintain the session context, state machine position, and cross-message dependencies of the business; if so, the original message is intercepted, processed, and then sent out, the processing method including at least any of the following: keeping the original message and forwarding it directly; replacing the original message with a pre-selected target test signaling; and performing field-level guided mutation based on the recommended mutation strategy in the field-level protocol knowledge entries of the protocol analysis database based on the original message or target test signaling. In other words, messages that do not reach the target test node are forwarded transparently as is; for messages that do reach the target test node, they can be sent or injected according to a preset test strategy, including allowing them to pass as is, replacing candidate seeds, and sending or injecting them after online field-level guided mutation. This integrates context establishment of preceding messages, target node identification, guided mutation, and selective injection into a single online test loop, enabling stable testing in a real control plane interaction environment. The purpose of this step is to ensure that the testing process is always embedded in the real business flow, rather than being sent independently of the business context, thus providing the target message with an execution environment that naturally satisfies protocol state constraints. This step maintains the legality and business continuity of the preceding stages, enabling guided fuzzing to be performed stably within the real control plane business flow. While maintaining message parsing and execution as much as possible, it allows for more precise, controllable, and context-consistent testing operations on key fields that are more likely to affect protocol processing semantics, applying more effective test perturbations and thus improving the ability to trigger deep vulnerabilities.

[0117] According to one embodiment of the present invention, an online man-in-the-middle execution module is deployed between two target network elements. The man-in-the-middle execution module refers to an online test execution component deployed between the control plane communication links of the two target network elements. Its function is to perform replacement, injection, or field-level guided mutation on specific messages arriving at the target test node while maintaining the normal forwarding of preceding service messages. This module can be understood as a controlled online proxy / forwarding module used to take over control plane communication between the two network elements in an authorized test environment. Its illustrative implementation may include:

[0118] First, an online forwarding link is established between the two target network elements. For example, it can be deployed between the UE / gNB and the core network control plane elements, or between network elements such as the AMF, SMF, NRF, and UPF control interfaces. This module establishes connections with both communicating parties, receives control plane messages from one end, processes them, and forwards them to the other end.

[0119] Secondly, the module has an internal protocol adaptation unit to identify different control plane protocols and message types. For different protocols such as NAS, NGAP, PFCP, and SBI / HTTP2, the module determines which session and process the current message belongs to and whether it has reached the preset target test node based on information such as protocol header, message direction, session identifier, transaction identifier, UE identifier, and flow identifier.

[0120] Secondly, the module sets up a context maintenance unit to record the message order, sending and receiving direction, session identifier, status progress, and target node position in the current business process. For messages that have not reached the target test node, the module does not modify the content but forwards them transparently as is to ensure that the preceding processes such as registration, authentication, session establishment, and context establishment proceed in the normal order.

[0121] When the current message is detected to have arrived at the target test node, the module invokes the test processing unit to perform corresponding operations according to the preset strategy, including: directly allowing the original message to pass, replacing the original message with candidate test signaling, injecting additional candidate test signaling, or invoking the field-level guided mutation process before sending. If field-level mutation is performed, subsequent field-level mutation steps will complete field location, value perturbation, dependency linkage processing, and re-encoding based on the protocol analysis database.

[0122] Finally, the module includes a feedback recording unit to record the processed message sending results and the feedback from the target network element, including response messages, error codes, timeouts, connection releases, status rollbacks, exception logs, or process exceptions. These feedback results can be used to subsequently determine whether the test input triggered exception handling logic and to update the candidate signaling value and path sparseness.

[0123] like Figure 4As shown, the online man-in-the-middle module is deployed in the communication path between the 5G core network (Open5GS) and the radio access and user terminal (UERANSIM). It accesses the SBI interface of each network element in the core network through the listening / injection link (marked by hollow circle lines). The schematic deployment location covers the HTTP / 2 connection between NRF (10.53.22.*:7777) and AMF, SMF, PFCP (8805) connection between SMF and UPF, NGAP (38412) signaling between AMF and gNB, and RRC connection between gNB and UE. Only two nodes connected by a blue link (marked with a solid circle) use a direct communication link, such as the RRC connection between the gNB and the UE. This man-in-the-middle execution module interacts with core network elements to capture abnormal data (such as crash signals) generated during the operation of network elements in real time, and transmits the abnormal data back to the analysis end via the listening / injection link to generate defect descriptions. This enables online monitoring, message injection, and fault analysis of communication between the main test components of the 5G core network (NRF, AMF, SMF, UPF, and other network element functions using the default Open5GS configuration) and the radio access side (gNB and user equipment such as UE1 / UE2 / UE3).

[0124] According to an embodiment of the present invention, the operation of performing field-level guided mutation includes: when the system needs to perform online mutation on the target message, firstly, based on the protocol analysis, the position range information of the fields recorded in the database in the original message is analyzed, and the abstract fields are mapped to the relevant modifiable positions in the original message. Subsequently, combined with the field type, semantic role, value constraints, and recommended mutation strategy, priority fields are selected and corresponding perturbation values ​​are generated. Different guided mutation methods can be adopted for different types of fields. For example: legal enumeration replacement or reserved value replacement is performed on enumeration fields; boundary value perturbation is performed on integer fields; boundary adjustment or length mismatch is performed on length fields; special pattern replacement is performed on identifier fields; and subfield deletion, duplication, or local adjustment is performed on composite fields. When the target field has consistency dependencies or length mapping relationships with other fields, the relevant fields are further processed according to the field dependency information. For example, when a certain length field must be consistent with the subsequent payload length, synchronous repair can be decided according to the test target, or field inconsistency can be created in a predetermined manner; when the appearance of a certain optional field depends on another flag field, the dependent condition field and the dependent field can be modified synchronously.

[0125] As an illustration, during testing, when the online man-in-the-middle execution module recognizes that the current control plane message has reached the target test node, it does not directly perform random byte perturbation on the entire message. Instead, it first locates the target field based on the protocol analysis database, and then makes targeted modifications according to the field type, value constraints, and field dependencies.

[0126] First, after receiving the original control plane message from the target node, the online man-in-the-middle execution module parses the message to determine its protocol type, message type, information element structure, field hierarchy path, and the offset position, length, or bit range of each field in the original message.

[0127] Secondly, the system analyzes the field-level knowledge recorded in the database based on the protocol to determine the target fields that need to be mutated. For example, it can select message type fields, reason value fields, length fields, identifier fields, status fields, optional information elements, conditional occurrence fields, or key fields related to the session context.

[0128] Next, the system generates variant values ​​based on the target field's field type. For enumerated fields, options include boundary enumerated values, reserved values, illegal values, or outliers that are likely to trigger abnormal branches, such as EPS mobility management cause values ​​(EMMCause). For length fields, normal values ​​consistent with the actual payload length can be generated, or slightly larger, slightly smaller, or inconsistent outliers can be generated according to the testing strategy. For identifier fields, they can be replaced with non-existent identifiers, released identifiers, identifiers from other sessions, or boundary values. For Boolean or status fields, inversion, status transitions, or unconventional status combinations can be performed. For optional fields, mutations such as deletion, duplicate insertion, order adjustment, or forced occurrence when conditions are not met can be performed.

[0129] Next, the system checks whether the target field has dependencies on other fields. If the target field is associated with a length field, quantity field, conditional occurrence field, checksum field, session identifier field, or context binding field, synchronization is performed depending on the test objective: one approach is to perform coordinated repair so that the mutated message still meets basic parsing requirements. For example, the length and quantity fields are updated synchronously. Another approach is to intentionally create cross-field inconsistencies, such as modifying the field content without modifying the corresponding length, or retaining the old session identifier but replacing context-related fields, to test the consistency verification and anomaly handling logic of the target network element.

[0130] The system then re-encodes the mutated fields back into the original message structure, generating a mutated control plane message and performing basic validity checks. These checks include at least verifying the correctness of field boundaries, the calculability of message length, the existence of required fields, the completeness of the field hierarchy, and compliance with the requirements of this test strategy. If the mutated result cannot form a sendable message during the encoding stage, it is discarded and regenerated; if a sendable message can be formed, it is sent to the target network element by the online man-in-the-middle execution module.

[0131] Finally, the system records the original message, target field, mutation method, post-mutation value, whether dependency linkage processing was performed, and the feedback result from the target network element for each mutation. Feedback results can include normal response, error response, connection release, timeout, state rollback, abnormal logs, or process anomalies. This feedback will be further used to update candidate signaling value, path sparseness, and subsequent mutation strategies.

[0132] According to one embodiment of the present invention, field-level guided mutation based on a protocol analysis database includes: extracting field-level knowledge such as field type, semantic role, value constraints, dependencies, position in the original message, and recommended mutation strategies from 3GPP protocol specification texts for the 5G control plane and real 5G control plane signaling samples. This makes field selection and mutation strategies more reusable and reduces the workload of reading specifications item by item and organizing field relationships. Fields are uniquely identified using field names with hierarchical paths, and a protocol analysis database is constructed accordingly. This ensures that abstract layer fields correspond one-to-one with their specific positions in the actual protocol structure, avoiding ambiguity caused by fields with the same name in multi-layered nested structures. Field-level guided mutation is performed by combining field type, semantic role, value constraints, and recommended mutation strategies, rather than uniformly perturbing the message content without distinguishing field properties. This allows the testing focus to be concentrated on key fields that are more likely to affect the protocol processing logic. When a target field has a length mapping relationship, consistency constraint relationship, or conditional occurrence relationship with other fields, the system performs synchronous repair, linked modification, or creates field inconsistencies according to a predetermined method based on the dependency relationship, rather than modifying a single field in isolation. This improves message parsingability and deep triggering capability. During the mutation process, the system balances the goals of "keeping the message as processable as possible" and "creating abnormal states with test value," ensuring that test inputs no longer remain largely at the shallow parsing failure stage but can more effectively enter the protocol state machine and business logic layer. This invention does not perform unconstrained random byte perturbation on the original message; instead, it extracts field-level structured protocol knowledge from the protocol specification text and real signaling samples to construct a protocol analysis database. During the online testing phase, based on the field types, semantic roles, value constraints, dependencies, positions in the original message, and recommended mutation strategies in the protocol analysis database, the system performs precise positioning, field-level guided mutation, and dependency linkage processing on the target field. This reduces the proportion of invalid input caused by random byte perturbation, improves the parsingability and executability of test messages, and enhances their ability to affect key protocol logic, thereby increasing the probability of discovering deep vulnerabilities.

[0133] In an optional embodiment, the system first extracts the normal pre-context messages preceding the target node from the actual session establishment process. The online man-in-the-middle execution module then transparently forwards these pre-context messages, propelling the target network element into the session establishment-related state. Subsequently, at the target session establishment request node, the original message is replaced with candidate signaling, and guided perturbations are performed on the length field, node identifier field, and composite information elements using the protocol analysis database. When length dependencies or field consistency relationships exist, the relevant fields are then processed in conjunction with these dependencies. The processed message is then re-injected into the actual process and sent to the target network element to test protocol parsing and context consistency logic.

[0134] In another optional embodiment, the system establishes target test nodes for query requests based on service-oriented interfaces, and during the online execution phase, utilizes a man-in-the-middle execution module to insert candidate signaling or perform field-level mutations at the target query request, such as performing boundary value, out-of-bounds value, or abnormal pattern replacements on key fields in the query parameters. Since such requests can reach the target processing logic without complex context in some scenarios, by jointly guiding the process with path scarcity and signaling value, test resources can be preferentially concentrated on parameter locations that are more likely to trigger implementation issues.

[0135] Step S6: Collect the execution feedback of the target network element in response to the test message to obtain the test interaction sample. Add the test interaction sample to the historical interaction data of the control plane to update the historical coverage count and path sparseness of each state transition path used in subsequent tests.

[0136] According to one embodiment of the present invention, this step mainly involves sending test messages and collecting anomaly feedback. After completing step S5, the obtained test messages are sent to the target network element, and the execution feedback returned by the target network element is continuously collected, including anomaly feedback information. Anomaly feedback includes, but is not limited to, crashes, timeouts, abnormal responses, and anomaly logs related to business logic, state consistency, or resource processing. Subsequently, the system records the target state, target signaling, field disturbance content, execution feedback, and new coverage of state transition paths corresponding to this round of testing, and uses this information as input for subsequent sorting, scheduling, and test decisions.

[0137] To verify the effectiveness of the method described in this application, the inventors also conducted comparative experiments.

[0138] This experiment constructs a 5G control plane test environment based on Open5GS and UERANSIM, and uses the method described in this application as an online agent / man-in-the-middle module connected to the critical control plane link to perform signaling replay, field-level mutation injection, and anomaly feedback collection. The comparison methods selected are AFLNet and 5GReplay. AFLNet represents a general stateful network protocol fuzzing test method, while 5GReplay represents a test method based on real signaling replay and perturbations. The method described in this application, based on real context replay, further combines a protocol analysis database, field-level guided mutation, and signaling value guidance strategies.

[0139] This experiment mainly compares the following aspects:

[0140] Effective mutation ratio and execution throughput: Five typical status point signaling messages, namely PFCP Setup Request, NF Discovery / NFRegister, NG Setup Request, GTP-U Echo Request, and NAS Registration Request, were selected to statistically analyze whether the mutated messages could pass the basic format and consistency checks of the target network element, as well as the number of executions per unit time.

[0141] Path coverage capability: Under the same test time budget, compare the number of protocol processing paths covered by different methods over time.

[0142] Anomaly feedback triggering capability: Based on Open5GS operation logs, the proportion of test cases triggering valid anomaly logs is statistically analyzed under different signaling value score ranges. Valid anomaly logs mainly include feedback related to business logic, state consistency, or system operation status, such as session or context missing, state mismatch, response timeout, and memory allocation failure, but do not include parsing layer discarding due to simple format errors.

[0143] Real defect detection capability: In the Open5GS v2.7.6 environment, the triggering and reproduction of real defects of the method in this application are statistically analyzed and compared with the first stable triggering time of existing methods.

[0144] Experimental results show that:

[0145] First, regarding the effective mutation ratio, AFLNet, lacking awareness of 5G control plane field semantics and dependencies, is prone to violating TLV structure, length field, enumeration constraints, and the existence of necessary fields, resulting in a large number of inputs being rejected early in the parsing process. 5GReplay, by perturbing based on real signaling, achieves a higher effective mutation ratio. Our proposed method further utilizes field boundary identification, value constraint control, and dependency linkage repair, achieving the highest effective mutation ratio across all five state points. For NAS Registration Requests, which are more sensitive to context binding relationships and cross-field consistency, our proposed method still boasts a 3.65% higher effective mutation ratio than 5GReplay.

[0146] Secondly, regarding execution throughput, although the method in this application introduces field parsing, constraint checking, and dependency linkage processing, the throughput of the three methods remains on the same order of magnitude, with only limited fluctuations. This indicates that the protocol-aware processing added in this invention does not significantly reduce overall execution efficiency. In other words, this invention increases the proportion of effective test inputs that can be actually processed by the target network element while basically maintaining execution efficiency.

[0147] Furthermore, regarding path coverage, under the same test time budget, the method in this application achieves faster coverage growth in the early stages of testing than AFLNet and 5GReplay, and ultimately reaches the optimal number of covered paths. This demonstrates that by using context replay to ensure the target network element stably enters the expected protocol state, combined with protocol-aware mutation and value-guided scheduling, new protocol processing branches can be reached more quickly, reducing the consumption of test resources on failed pre-state construction and shallow rejection paths.

[0148] Furthermore, there is a positive correlation between signaling value scores and abnormal feedback. Experimental statistics show that signaling with higher overall value scores is more likely to trigger abnormal logs related to session context, state consistency, or resource processing after mutation and replay. This indicates that the signaling value guidance mechanism of this invention can prioritize testing resources on target signaling and target paths that are more likely to generate high-value feedback, rather than consuming them evenly on low-information inputs.

[0149] Finally, regarding real-world defect discovery, the method described in this application triggered and stably reproduced multiple control plane-related defects in Open5GS v2.7.6, including defects related to protocols such as PFCP, SBI / HTTP / 2, and NAS. Specifically, the PFCP SessionEstablishment Request-related crash defect was first stably triggered stably in approximately 13 hours on average using this method, while AFLNet achieved the same triggering result in an average of approximately 16 hours under the same testing budget and resource configuration. The experiments also discovered or re-triggered several defects or known issues, including CVE-2025-70316 and CVE-2026-30659.

[0150] Therefore, comparative experiments show that the method in this application not only increases the proportion of mutated messages passing basic parsing and consistency checks, but also improves path coverage efficiency, anomaly feedback triggering capability, and real defect exposure efficiency without significantly reducing execution throughput.

[0151] In summary, some embodiments of the method of this application can achieve at least one or more of the following technical effects:

[0152] (1) By using the real control plane interaction prefix to construct a legal state entry, the test no longer depends on manually splicing the complete pre-process from an empty state, which can significantly increase the probability that the target signaling is executed in a legal context.

[0153] (2) By using state transition modeling, path sparseness analysis and signaling value assessment, we can achieve guided allocation of test resources, so that the limited budget can be prioritized for low-coverage, high-return target paths and target signaling, and reduce repeated exploration of high-frequency, low-information inputs.

[0154] (3) By analyzing the field-level guided mutation and dependency linkage processing supported by the protocol analysis database, while keeping the message parsable and executable as much as possible, constrained perturbations are applied to key fields, thereby significantly improving the proportion of effective test inputs.

[0155] (4) By using an online man-in-the-middle execution mechanism, target node-oriented testing is embedded into the real control plane process, so that the test has good engineering feasibility and protocol environment adaptability.

[0156] It should be noted that although the steps are described in a specific order above, it does not mean that the steps must be executed in the above specific order. In fact, some of these steps can be executed concurrently or even in a different order, as long as the required function can be achieved.

[0157] This invention can be a system, method, electronic device, computing device, computer program product and / or computer-readable medium.

[0158] Computer program products mainly refer to software products that implement various aspects of the present invention through computer programs, or hardware products that carry software that implements various aspects of the present invention.

[0159] Computer-readable storage media can be tangible devices that hold and store instructions for use by an instruction execution device. Computer-readable storage media can include, for example, but not limited to, electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination thereof.

[0160] The various embodiments of the present invention have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or technical improvements to the embodiments in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A control surface-guided fuzzy testing method, comprising the following steps: S1: Based on the protocol specification text related to the target control plane protocol and the actual control plane interaction samples, construct a protocol analysis database containing multiple field-level protocol knowledge entries. Each knowledge entry is used to describe the protocol attributes and recommended mutation strategies of a specified field in the 5G control plane protocol message. S2: Establish a control plane state transition model, statistically analyze the historical coverage count of each state transition path in the model based on the historical interaction data of the control plane, and determine the path rarity from each state to its successor state based on the historical coverage count. S3: Evaluate the test value of each candidate signaling in the candidate signaling set from multiple dimensions, and determine the joint score of each candidate signaling based on the test value of the candidate signaling and the path rarity of the path in which it is located. Select the target test signaling from the candidate signaling set according to the joint score. S4: Based on the target test signaling, identify the corresponding target test node in the real control plane interaction process, and extract the preceding signaling sequence before the target test node from the process. The preceding signaling sequence is used to enable the target network element to enter the expected protocol state and session context corresponding to the target test node. S5: Based on the online man-in-the-middle execution module deployed between target network elements, the preceding signaling sequence is forwarded transparently in sequence, and selectively replaced, injected or field-level guided mutation is performed on the target test signaling according to the protocol analysis database when it reaches the target test node to obtain the test message and send it; S6: Collect the execution feedback of the target network element in response to the test message to obtain the test interaction sample, and add the test interaction sample to the historical interaction data of the control plane to update the historical coverage count and path sparseness of each state transition path used in subsequent tests.

2. The method according to claim 1, characterized in that, In step S5, the online man-in-the-middle execution module is an online test execution component deployed between two target network elements, used for real-time identification, interception, transparent forwarding, and conditionally triggered processing of control plane messages passing through the two target network elements; wherein, For each control plane message that passes through, identify whether its location has reached the currently set target test node; If not, the message is transparently forwarded to the corresponding target network element as is to ensure that the original business process continues to proceed and to maintain the business's session context, state machine position, and cross-message dependencies. If so, the original message is intercepted, processed, and then sent again. The processing method includes at least one of the following: Keep the original message and forward it directly; Replace the original message with the pre-selected target test signaling; Based on the original message or target test signaling, field-level guided mutation is performed using the recommended mutation strategy from the field-level protocol knowledge entries in the protocol analysis database.

3. The method according to claim 1, characterized in that, The methods for constructing a protocol analysis database include: Using a large language model, information alignment analysis, attribute extraction, and structured organization are performed on protocol specification text and real control plane interaction samples to obtain structured extracted content that merges information from both sides; The structured extracted content is organized into field-level protocol knowledge entries using a large language model. Each field-level protocol knowledge entry includes field type, semantic role, value constraints, dependency relationship, position range in the message, and recommended mutation strategy.

4. The method according to claim 3, characterized in that, The field-level guided mutations include: Based on the field type, semantic role, and value constraints, select the target field to be disturbed from each field of the current object. The current object is the original message or a pre-selected target test signaling. According to the protocol, the location range of the target field to be disturbed recorded in the database in the current object is analyzed, and the abstract target field to be disturbed is mapped to the modifiable position in the current object. Based on the recommended mutation strategy, corresponding perturbation values ​​for modifiable positions are generated. Then, based on the perturbation values ​​and dependencies, other fields that have length mapping relationships, consistency constraint relationships, or condition occurrence relationships with the target field are adjusted accordingly to obtain test messages.

5. The method according to claim 1, characterized in that, Step S2 includes: The control plane interaction process is represented as a sequence of gradual state changes triggered by control plane signaling, and a control plane state transition model containing a finite set of states is defined. Based on historical control plane interaction data containing real control plane interaction samples and test interaction samples, the number of transitions between each state is counted. The state transition probability is estimated based on the number of state transitions using the control surface state transition model, and the path rarity of each path is determined based on the state transition probability. The path rarity is inversely proportional to the state transition probability.

6. The method according to claim 1, characterized in that, Step S3 includes: The test value of each candidate signaling in the candidate signaling set is evaluated from the dimensions of attack cost, attack complexity, attack undetectability, attack gain, and signaling vulnerability or a combination thereof. The test value of a candidate signaling is multiplied by the path rarity of the path in which it is located, and this product is used as the joint score for each candidate signaling. Target test signaling is selected from the candidate signaling set in descending order of joint score.

7. The method according to claim 6, characterized in that, The test value is determined in the following manner: in, This indicates the order of attack cost, attack complexity, attack undetectability, attack gain, and signaling vulnerability, from 1st to 5th. The product of the quantized values ​​of each dimension, .

8. A computer device / apparatus / system, comprising a memory, a processor, and a computer program / instructions stored in the memory, wherein the processor executes the computer program / instructions to implement the steps of the method according to any one of claims 1-7.

9. A computer program product comprising a computer program / instructions that, when executed by a processor, implement the steps of the method according to any one of claims 1-7.

10. A computer-readable storage medium having a computer program / instructions stored thereon, the computer program / instructions being executed by a processor to implement the steps of the method according to any one of claims 1-7.

Images