Search papers, labs, and topics across Lattice.
The paper introduces MulCovFuzz, a coverage-guided greybox fuzzer for 5G protocol testing that incorporates a multi-component coverage collection mechanism to monitor code coverage across different 5G system components. By using a scoring function that combines coverage rewards with efficiency metrics, MulCovFuzz guides test case generation more effectively than traditional fuzzers. Evaluation on OpenAirInterface shows MulCovFuzz achieves significant improvements in branch and line coverage, as well as unique crash discovery, and identifies three zero-day vulnerabilities.
MulCovFuzz finds 16% more unique 5G crashes than existing fuzzers, revealing zero-day vulnerabilities that other techniques miss.
As mobile networks transition to 5G infrastructure, ensuring robust security becomes more important due to the complex architecture and expanded attack surface. Traditional security testing approaches for 5G networks rely on black-box fuzzing techniques, which are limited by their inability to observe internal program state and coverage information. This paper presents MulCovFuzz, a novel coverage-guided greybox fuzzing tool for 5G network testing. Unlike existing tools that depend solely on system response, MulCovFuzz implements a multi-component coverage collection mechanism that dynamically monitors code coverage across different components of the 5G system architecture. Our approach introduces a novel testing paradigm that includes a scoring function combining coverage rewards with efficiency metrics to guide test case generation. We evaluate MulCovFuzz on open-source 5G implementation OpenAirInterface. Our experimental results demonstrate that MulCovFuzz significantly outperforms traditional fuzzing approaches, achieving a 5.85\% increase in branch coverage, 7.17\% increase in line coverage, and 16\% improvement in unique crash discovery during 24h fuzzing testing. MulCovFuzz uncovered three zero-day vulnerabilities, two of which were not identified by any other fuzzing technique. This work contributes to the advancement of security testing tools for next-generation mobile networks.
