{"id":"https://openalex.org/W4411551050","doi":"https://doi.org/10.1109/tdsc.2025.3582093","title":"5Ghoul: Unleashing Chaos on 5G Edge Devices via Stateful Multi-Layer Fuzzing","display_name":"5Ghoul: Unleashing Chaos on 5G Edge Devices via Stateful Multi-Layer Fuzzing","publication_year":2025,"publication_date":"2025-06-23","ids":{"openalex":"https://openalex.org/W4411551050","doi":"https://doi.org/10.1109/tdsc.2025.3582093"},"language":"en","primary_location":{"id":"doi:10.1109/tdsc.2025.3582093","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2025.3582093","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5075004359","display_name":"Matheus E. Garbelini","orcid":"https://orcid.org/0000-0002-8169-9874"},"institutions":[{"id":"https://openalex.org/I152815399","display_name":"Singapore University of Technology and Design","ror":"https://ror.org/05j6fvn87","country_code":"SG","type":"education","lineage":["https://openalex.org/I152815399"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Matheus E. Garbelini","raw_affiliation_strings":["Singapore University of Technology and Design, Singapore"],"raw_orcid":"https://orcid.org/0000-0002-8169-9874","affiliations":[{"raw_affiliation_string":"Singapore University of Technology and Design, Singapore","institution_ids":["https://openalex.org/I152815399"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5046784317","display_name":"Zewen Shang","orcid":null},"institutions":[{"id":"https://openalex.org/I152815399","display_name":"Singapore University of Technology and Design","ror":"https://ror.org/05j6fvn87","country_code":"SG","type":"education","lineage":["https://openalex.org/I152815399"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Zewen Shang","raw_affiliation_strings":["Singapore University of Technology and Design, Singapore"],"raw_orcid":"https://orcid.org/0000-0002-5227-691X","affiliations":[{"raw_affiliation_string":"Singapore University of Technology and Design, Singapore","institution_ids":["https://openalex.org/I152815399"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Shijie Luo","orcid":"https://orcid.org/0009-0006-3067-3419"},"institutions":[{"id":"https://openalex.org/I152815399","display_name":"Singapore University of Technology and Design","ror":"https://ror.org/05j6fvn87","country_code":"SG","type":"education","lineage":["https://openalex.org/I152815399"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Shijie Luo","raw_affiliation_strings":["Singapore University of Technology and Design, Singapore"],"raw_orcid":"https://orcid.org/0009-0006-3067-3419","affiliations":[{"raw_affiliation_string":"Singapore University of Technology and Design, Singapore","institution_ids":["https://openalex.org/I152815399"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5088928000","display_name":"Sudipta Chattopadhyay","orcid":"https://orcid.org/0000-0002-4843-5391"},"institutions":[{"id":"https://openalex.org/I152815399","display_name":"Singapore University of Technology and Design","ror":"https://ror.org/05j6fvn87","country_code":"SG","type":"education","lineage":["https://openalex.org/I152815399"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Sudipta Chattopadhyay","raw_affiliation_strings":["Singapore University of Technology and Design, Singapore"],"raw_orcid":"https://orcid.org/0000-0002-4843-5391","affiliations":[{"raw_affiliation_string":"Singapore University of Technology and Design, Singapore","institution_ids":["https://openalex.org/I152815399"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100606009","display_name":"Sumei Sun","orcid":"https://orcid.org/0000-0002-1701-8122"},"institutions":[{"id":"https://openalex.org/I115228651","display_name":"Agency for Science, Technology and Research","ror":"https://ror.org/036wvzt09","country_code":"SG","type":"government","lineage":["https://openalex.org/I115228651"]},{"id":"https://openalex.org/I4210161496","display_name":"A*STAR Graduate Academy","ror":"https://ror.org/059yjzn93","country_code":"SG","type":"education","lineage":["https://openalex.org/I115228651","https://openalex.org/I4210161496"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Sumei Sun","raw_affiliation_strings":["I2R, A*Star, Singapore","I R, A*Star, Singapore"],"raw_orcid":"https://orcid.org/0000-0002-1701-8122","affiliations":[{"raw_affiliation_string":"I2R, A*Star, Singapore","institution_ids":["https://openalex.org/I115228651"]},{"raw_affiliation_string":"I R, A*Star, Singapore","institution_ids":["https://openalex.org/I4210161496"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5061300609","display_name":"Ernest Kurniawan","orcid":"https://orcid.org/0000-0001-5347-4769"},"institutions":[{"id":"https://openalex.org/I115228651","display_name":"Agency for Science, Technology and Research","ror":"https://ror.org/036wvzt09","country_code":"SG","type":"government","lineage":["https://openalex.org/I115228651"]},{"id":"https://openalex.org/I4210161496","display_name":"A*STAR Graduate Academy","ror":"https://ror.org/059yjzn93","country_code":"SG","type":"education","lineage":["https://openalex.org/I115228651","https://openalex.org/I4210161496"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Ernest Kurniawan","raw_affiliation_strings":["I2R, A*Star, Singapore","I R, A*Star, Singapore"],"raw_orcid":"https://orcid.org/0000-0001-5347-4769","affiliations":[{"raw_affiliation_string":"I2R, A*Star, Singapore","institution_ids":["https://openalex.org/I115228651"]},{"raw_affiliation_string":"I R, A*Star, Singapore","institution_ids":["https://openalex.org/I4210161496"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":2645,"currency":"USD","value_usd":2645},"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.13055081,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"22","issue":"6","first_page":"6230","last_page":"6247"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12162","display_name":"Cellular Automata and Applications","score":0.9861000180244446,"subfield":{"id":"https://openalex.org/subfields/1703","display_name":"Computational Theory and Mathematics"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12162","display_name":"Cellular Automata and Applications","score":0.9861000180244446,"subfield":{"id":"https://openalex.org/subfields/1703","display_name":"Computational Theory and Mathematics"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12611","display_name":"Neural Networks and Reservoir Computing","score":0.9830999970436096,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10022","display_name":"Semiconductor Quantum Structures and Devices","score":0.9690999984741211,"subfield":{"id":"https://openalex.org/subfields/3107","display_name":"Atomic and Molecular Physics, and Optics"},"field":{"id":"https://openalex.org/fields/31","display_name":"Physics and Astronomy"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/fuzz-testing","display_name":"Fuzz testing","score":0.9223234057426453},{"id":"https://openalex.org/keywords/stateful-firewall","display_name":"Stateful firewall","score":0.8727577924728394},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6929678916931152},{"id":"https://openalex.org/keywords/layer","display_name":"Layer (electronics)","score":0.5112128257751465},{"id":"https://openalex.org/keywords/enhanced-data-rates-for-gsm-evolution","display_name":"Enhanced Data Rates for GSM Evolution","score":0.5101562142372131},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.38982415199279785},{"id":"https://openalex.org/keywords/telecommunications","display_name":"Telecommunications","score":0.1350698471069336},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.12933820486068726},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.10743644833564758},{"id":"https://openalex.org/keywords/materials-science","display_name":"Materials science","score":0.0839286744594574},{"id":"https://openalex.org/keywords/nanotechnology","display_name":"Nanotechnology","score":0.07237911224365234}],"concepts":[{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.9223234057426453},{"id":"https://openalex.org/C22927095","wikidata":"https://www.wikidata.org/wiki/Q1784206","display_name":"Stateful firewall","level":3,"score":0.8727577924728394},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6929678916931152},{"id":"https://openalex.org/C2779227376","wikidata":"https://www.wikidata.org/wiki/Q6505497","display_name":"Layer (electronics)","level":2,"score":0.5112128257751465},{"id":"https://openalex.org/C162307627","wikidata":"https://www.wikidata.org/wiki/Q204833","display_name":"Enhanced Data Rates for GSM Evolution","level":2,"score":0.5101562142372131},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.38982415199279785},{"id":"https://openalex.org/C76155785","wikidata":"https://www.wikidata.org/wiki/Q418","display_name":"Telecommunications","level":1,"score":0.1350698471069336},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.12933820486068726},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.10743644833564758},{"id":"https://openalex.org/C192562407","wikidata":"https://www.wikidata.org/wiki/Q228736","display_name":"Materials science","level":0,"score":0.0839286744594574},{"id":"https://openalex.org/C171250308","wikidata":"https://www.wikidata.org/wiki/Q11468","display_name":"Nanotechnology","level":1,"score":0.07237911224365234},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tdsc.2025.3582093","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2025.3582093","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":16,"referenced_works":["https://openalex.org/W2626006124","https://openalex.org/W2929535634","https://openalex.org/W2987215725","https://openalex.org/W2990286122","https://openalex.org/W3024280588","https://openalex.org/W3048340936","https://openalex.org/W3136586396","https://openalex.org/W3177044699","https://openalex.org/W3194394634","https://openalex.org/W3216250204","https://openalex.org/W4200405708","https://openalex.org/W4226344376","https://openalex.org/W4297099995","https://openalex.org/W4315629744","https://openalex.org/W4382396178","https://openalex.org/W4382396221"],"related_works":["https://openalex.org/W2511770387","https://openalex.org/W3120811337","https://openalex.org/W2129975948","https://openalex.org/W2591875911","https://openalex.org/W2736754676","https://openalex.org/W4287833485","https://openalex.org/W4401906987","https://openalex.org/W4401907763","https://openalex.org/W4404407863","https://openalex.org/W4387191767"],"abstract_inverted_index":{"In":[0],"this":[1],"paper,":[2],"we":[3,95],"present5Ghoul,":[4],"a":[5,25,155],"framework":[6,111],"to":[7,33,39,50,59,74,85,88,148],"systematically":[8],"discover":[9],"and":[10,55,104,107,137,165],"replicate":[11],"security":[12,116,178],"vulnerabilities":[13,62,117,144],"on":[14,63],"arbitrary":[15],"5":[16,100],"G":[17,101],"edge":[18],"devices":[19],"(UE).":[20],"At":[21],"the":[22,40,46,52,174],"core":[23],"of5Ghoulis":[24],"stateful":[26],"fuzzing":[27,53],"strategy":[28],"that":[29],"provides":[30],"full":[31],"control":[32],"arbitrarily":[34],"manipulate":[35],"any":[36],"packet":[37,76],"down":[38,87],"data":[41,89],"link":[42,90],"layer.":[43,91],"Moreover,5Ghoulautomatically":[44],"constructs":[45],"protocol":[47],"state":[48],"machines":[49],"guide":[51],"process":[54],"employs":[56],"novel":[57],"strategies":[58],"reliably":[60],"exploit":[61],"commercial-off-the-shelf":[64],"(COTS)":[65],"UEs":[66,102,128],"over-the-air.":[67],"The":[68],"design":[69],"choices":[70],"in5Ghoulwere":[71],"carefully":[72],"taken":[73],"allow":[75],"manipulation":[77],"in":[78,81,119,126],"real-time,":[79],"which,":[80],"turn":[82],"allowed":[83],"us":[84],"fuzz":[86],"As":[92],"of":[93,122,140,158],"today,":[94],"have":[96,145,149],"evaluated5Ghoulwith":[97],"seven":[98],"COTS":[99,127,142],"(smartphones":[103],"USB":[105],"modems)":[106],"one":[108],"open":[109,173],"source":[110],"(OpenAirInterface).5Ghoulhas":[112],"uncovered":[113],"12":[114],"unknown":[115],"(14":[118],"total)":[120],"out":[121],"which":[123],"ten":[124],"exist":[125],"(ten":[129],"CVEs":[130],"assigned)":[131],"from":[132,163],"major":[133],"vendors":[134],"(e.g.,":[135],"Qualcomm":[136,164],"MediaTek).":[138],"Moreover,":[139],"these":[141,169],"UE":[143],"been":[146],"confirmed":[147],"high":[150],"severity.":[151],"We":[152,171],"also":[153],"won":[154],"bug":[156],"bounty":[157],"over":[159],"20":[160],"K":[161],"USD":[162],"MediaTek":[166],"for":[167,176],"discovering":[168],"vulnerabilities.":[170],"envision5Ghoulto":[172],"door":[175],"5G":[177],"testing":[179],"at":[180],"scale.":[181]},"counts_by_year":[],"updated_date":"2026-08-21T09:56:20.448147","created_date":"2025-10-10T00:00:00"}