{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,27]],"date-time":"2026-08-27T11:21:58Z","timestamp":1787829718959,"version":"build-2784847793"},"reference-count":23,"publisher":"MDPI AG","issue":"17","license":[{"start":{"date-parts":[[2026,8,27]],"date-time":"2026-08-27T00:00:00Z","timestamp":1787788800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100010418","name":"Institute of Information & Communications Technology Planning & Evaluation","doi-asserted-by":"publisher","award":["RS-2024-00438156"],"award-info":[{"award-number":["RS-2024-00438156"]}],"id":[{"id":"10.13039\/501100010418","id-type":"DOI","asserted-by":"publisher"}]},{"award":["RS-2024-00438156"],"award-info":[{"award-number":["RS-2024-00438156"]}],"id":[{"id":"https:\/\/ror.org\/01g0hqq23","id-type":"ROR","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>As fifth-generation (5G) networks evolve toward open and software-based architectures, security verification of the NG Application Protocol (NGAP) between the radio access network and the 5G core has become increasingly important. This paper proposes a stateful security verification methodology that combines stateful fuzzing with specification-guided security verification. The methodology derives an Access and Mobility Management Function (AMF) state model, mutation types, and expected behaviors from Third Generation Partnership Project (3GPP) specifications. For each attack scenario, it establishes the required connection state through normal NGAP procedures, injects a mutated message, and compares the observed AMF responses and processing logs with the specification-defined expected behavior. We evaluated four open-source 5G core implementations using 324 attack scenarios per implementation, resulting in 1296 tests. Of these, 877 produced sufficient evidence to interpret the AMF processing outcome, yielding an interpretable outcome rate of 67.7%. The evaluation covered 27 of the 40 uplink NGAP message types and identified 32 specification violations, including 11 security vulnerabilities, none of which caused a core to crash. These results demonstrate the importance of jointly considering connection states and specification-defined behavior in NGAP security verification.<\/jats:p>","DOI":"10.3390\/s26175415","type":"journal-article","created":{"date-parts":[[2026,8,27]],"date-time":"2026-08-27T10:58:21Z","timestamp":1787828301000},"page":"5415","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["A Stateful Fuzzing Methodology for Security Verification of 5G Core Equipment"],"prefix":"10.3390","volume":"26","author":[{"ORCID":"https:\/\/orcid.org\/0009-0002-1244-1420","authenticated-orcid":false,"given":"Seungjoon","family":"Na","sequence":"first","affiliation":[{"name":"Department of Cybersecurity, Kookmin University, Seoul 02707, Republic of Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4449-5821","authenticated-orcid":false,"given":"Hwankuk","family":"Kim","sequence":"additional","affiliation":[{"name":"Department of Information Security, Cryptography and Mathematics, Kookmin University, Seoul 02707, Republic of Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2026,8,27]]},"reference":[{"key":"ref_1","unstructured":"3GPP (2025). NG-RAN; NG Application Protocol (NGAP), 3GPP. Technical Specification TS 38.413, Version 18.7.0."},{"key":"ref_2","unstructured":"3GPP (2024). System Architecture for the 5G System (5GS), 3GPP. Technical Specification TS 23.501, Version 18.4.0."},{"key":"ref_3","unstructured":"3GPP (2025). Security Architecture and Procedures for 5G System, 3GPP. Technical Specification TS 33.501, Version 18.7.0."},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Salazar, Z., Nguyen, H.N., Mallouli, W., Cavalli, A.R., and Montes de Oca, E. (2021). 5Greplay: A 5G network traffic fuzzer\u2014Application to attack injection. Proceedings of the 16th International Conference on Availability, Reliability and Security (ARES), Vienna, Austria, 17\u201320 August 2021, ACM. Article 106.","DOI":"10.1145\/3465481.3470079"},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Mancini, F., Da Canal, S., and Bianchi, G. (2024). AMFuzz: Black-box fuzzing of 5G core networks. Proceedings of the 19th Wireless On-Demand Network Systems and Services Conference (WONS), Chamonix, France, 29\u201331 January 2024, IEEE.","DOI":"10.23919\/WONS60642.2024.10449510"},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Hu, Y., Yang, W., Cui, B., Zhou, X., Mao, Z., and Wang, Y. (2021). Fuzzing method based on selection mutation of partition weight table for 5G core network NGAP protocol. Innovative Mobile and Internet Services in Ubiquitous Computing, Springer.","DOI":"10.1007\/978-3-030-79728-7_15"},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"4544","DOI":"10.1109\/TR.2025.3607106","article-title":"Toward a robust ingress for open-sourced 5G core network","volume":"74","author":"Hsu","year":"2025","journal-title":"IEEE Trans. Reliab."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Sun, Y., Liu, X., Sun, Q., Wang, J., Tian, L., and Liu, J. (2025). 5GC-Fuzz: Finding deep stateful vulnerabilities in 5G core network with black-box fuzzing. Proceedings of the IEEE International Conference on Computer Communications (INFOCOM), London, UK, 19\u201322 May 2025, IEEE.","DOI":"10.1109\/INFOCOM55648.2025.11044489"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Bennett, N., Zhu, W., Simon, B., Kennedy, R., Enck, W., Traynor, P., and Reaves, B. (2024). RANsacked: A domain-informed approach for fuzzing LTE and 5G RAN-core interfaces. Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS), Salt Lake City, UT, USA, 14\u201318 October 2024, ACM.","DOI":"10.1145\/3658644.3670320"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Kim, H., Lee, J., Lee, E., and Kim, Y. (2019). Touching the untouchables: Dynamic security analysis of the LTE control plane. Proceedings of the IEEE Symposium on Security and Privacy, San Francisco, CA, USA, 20\u201322 May 2019, IEEE.","DOI":"10.1109\/SP.2019.00038"},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Hussain, S.R., Echeverria, M., Karim, I., Chowdhury, O., and Bertino, E. (2019). 5GReasoner: A property-directed security and privacy analysis framework for 5G cellular network protocol. Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS), London, UK, 11\u201315 November 2019, ACM.","DOI":"10.1145\/3319535.3354263"},{"key":"ref_12","unstructured":"Park, C.J., Bae, S., Oh, B., Lee, J., Lee, E., Yun, I., and Kim, Y. (2022). DoLTEst: In-depth downlink negative testing framework for LTE devices. Proceedings of the 31st USENIX Security Symposium, Boston, MA, USA, 10\u201312 August 2022, ACM."},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Son, M., Kim, K., Oh, B., and Kim, Y. (2025, January 13\u201317). CITesting: Systematic testing of context integrity violations in LTE core networks. Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS), Taipei, Taiwan.","DOI":"10.1145\/3719027.3765230"},{"key":"ref_14","unstructured":"Dong, Y., Yang, T., Al Ishtiaq, A., Rashid, S.M.M., Ranjbar, A., Tu, K., Wu, T., Mahmud, M.S., and Hussain, S.R. (2025, January 13\u201315). CoreCrisis: Threat-guided and context-aware iterative learning and fuzzing of 5G core networks. Proceedings of the 34th USENIX Security Symposium, Seattle, WA, USA."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"18298","DOI":"10.1109\/ACCESS.2022.3151000","article-title":"A systematic analysis of 5G networks with a focus on 5G core security","volume":"10","author":"Tang","year":"2022","journal-title":"IEEE Access"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Dumitru-Guzu, M., and Vl\u0103deanu, C. (2024). A vulnerability assessment of open-source implementations of fifth-generation core network functions. Future Internet, 16.","DOI":"10.3390\/fi16010001"},{"key":"ref_17","unstructured":"3GPP (2024). Non-Access-Stratum (NAS) Protocol for 5G System (5GS), 3GPP. Technical Specification TS 24.501, Version 18.4.0."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"109301","DOI":"10.1016\/j.comnet.2022.109301","article-title":"Tutorial on communication between access networks and the 5G core","volume":"216","author":"Silveira","year":"2022","journal-title":"Comput. Netw."},{"key":"ref_19","unstructured":"Ella Networks (2026, July 24). Ella Core: Open-Source Mobile Core for Private Networks. Available online: https:\/\/github.com\/ellanetworks\/core."},{"key":"ref_20","unstructured":"Open5GS (2026, July 24). Open5GS: Open-Source Implementation for 5G Core and EPC. Available online: https:\/\/open5gs.org."},{"key":"ref_21","unstructured":"Free5GC (2026, July 24). Free5GC: Open-Source 5G Core Network. Available online: https:\/\/free5gc.org."},{"key":"ref_22","unstructured":"(2026, July 24). OpenAirInterface Software Alliance. OAI Core Network. Available online: https:\/\/openairinterface.org\/core-network\/."},{"key":"ref_23","unstructured":"G\u00fcng\u00f6r, A. (2026, July 24). UERANSIM: Open Source 5G UE and RAN (gNodeB) Implementation. Available online: https:\/\/github.com\/aligungr\/UERANSIM."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/17\/5415\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,8,27]],"date-time":"2026-08-27T11:00:25Z","timestamp":1787828425000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/17\/5415"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,8,27]]},"references-count":23,"journal-issue":{"issue":"17","published-online":{"date-parts":[[2026,9]]}},"alternative-id":["s26175415"],"URL":"https:\/\/doi.org\/10.3390\/s26175415","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,8,27]]}}}