Experience: Agentic Security Analysis of 5G Protocol Interactions

摘要

This paper reports our three-year experience building 5GAudit, an LLM-based agentic framework for discovering vulnerabilities in 5G protocol interactions. We review the evolution of 5GAudit through successive redesigns, each driven by fundamental deficiencies uncovered in real deployment. We refine 5GAudit to enable it to conduct agentic cross-protocol/domain/system analysis, perform automatic verifier-in-the-loop validations of vulnerabilities, and go beyond predefined threat models by leveraging CWE (Common Weakness Enumeration) theory to enumerate new vulnerability patterns. Our system successfully discovers 42 0-day vulnerabilities of 5G protocol interactions in open-source 5G software, 20 of which have been assigned CVE numbers to date. We demonstrate 5GAudit as an example to share our lessons learned on applying LLM-based agents to 5G-specific security analysis with the community.