{"id":"https://openalex.org/W4411551050","doi":"https://doi.org/10.1109/tdsc.2025.3582093","title":"5Ghoul: Unleashing Chaos on 5G Edge Devices via Stateful Multi-Layer Fuzzing","display_name":"5Ghoul: Unleashing Chaos on 5G Edge Devices via Stateful Multi-Layer Fuzzing","publication_year":2025,"publication_date":"2025-06-23","ids":{"openalex":"https://openalex.org/W4411551050","doi":"https://doi.org/10.1109/tdsc.2025.3582093"},"language":"en","primary_location":{"id":"doi:10.1109/tdsc.2025.3582093","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2025.3582093","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5075004359","display_name":"Matheus E. Garbelini","orcid":"https://orcid.org/0000-0002-8169-9874"},"institutions":[{"id":"https://openalex.org/I152815399","display_name":"Singapore University of Technology and Design","ror":"https://ror.org/05j6fvn87","country_code":"SG","type":"education","lineage":["https://openalex.org/I152815399"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Matheus E. Garbelini","raw_affiliation_strings":["Singapore University of Technology and Design, Singapore"],"raw_orcid":"https://orcid.org/0000-0002-8169-9874","affiliations":[{"raw_affiliation_string":"Singapore University of Technology and Design, Singapore","institution_ids":["https://openalex.org/I152815399"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5046784317","display_name":"Zewen Shang","orcid":null},"institutions":[{"id":"https://openalex.org/I152815399","display_name":"Singapore University of Technology and Design","ror":"https://ror.org/05j6fvn87","country_code":"SG","type":"education","lineage":["https://openalex.org/I152815399"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Zewen Shang","raw_affiliation_strings":["Singapore University of Technology and Design, Singapore"],"raw_orcid":"https://orcid.org/0000-0002-5227-691X","affiliations":[{"raw_affiliation_string":"Singapore University of Technology and Design, Singapore","institution_ids":["https://openalex.org/I152815399"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Shijie Luo","orcid":"https://orcid.org/0009-0006-3067-3419"},"institutions":[{"id":"https://openalex.org/I152815399","display_name":"Singapore University of Technology and Design","ror":"https://ror.org/05j6fvn87","country_code":"SG","type":"education","lineage":["https://openalex.org/I152815399"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Shijie Luo","raw_affiliation_strings":["Singapore University of Technology and Design, Singapore"],"raw_orcid":"https://orcid.org/0009-0006-3067-3419","affiliations":[{"raw_affiliation_string":"Singapore University of Technology and Design, Singapore","institution_ids":["https://openalex.org/I152815399"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5088928000","display_name":"Sudipta Chattopadhyay","orcid":"https://orcid.org/0000-0002-4843-5391"},"institutions":[{"id":"https://openalex.org/I152815399","display_name":"Singapore University of Technology and Design","ror":"https://ror.org/05j6fvn87","country_code":"SG","type":"education","lineage":["https://openalex.org/I152815399"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Sudipta Chattopadhyay","raw_affiliation_strings":["Singapore University of Technology and Design, Singapore"],"raw_orcid":"https://orcid.org/0000-0002-4843-5391","affiliations":[{"raw_affiliation_string":"Singapore University of Technology and Design, Singapore","institution_ids":["https://openalex.org/I152815399"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100606009","display_name":"Sumei Sun","orcid":"https://orcid.org/0000-0002-1701-8122"},"institutions":[{"id":"https://openalex.org/I115228651","display_name":"Agency for Science, Technology and Research","ror":"https://ror.org/036wvzt09","country_code":"SG","type":"government","lineage":["https://openalex.org/I115228651"]},{"id":"https://openalex.org/I4210161496","display_name":"A*STAR Graduate Academy","ror":"https://ror.org/059yjzn93","country_code":"SG","type":"education","lineage":["https://openalex.org/I115228651","https://openalex.org/I4210161496"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Sumei Sun","raw_affiliation_strings":["I2R, A*Star, Singapore","I R, A*Star, Singapore"],"raw_orcid":"https://orcid.org/0000-0002-1701-8122","affiliations":[{"raw_affiliation_string":"I2R, A*Star, Singapore","institution_ids":["https://openalex.org/I115228651"]},{"raw_affiliation_string":"I R, A*Star, Singapore","institution_ids":["https://openalex.org/I4210161496"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5061300609","display_name":"Ernest Kurniawan","orcid":"https://orcid.org/0000-0001-5347-4769"},"institutions":[{"id":"https://openalex.org/I115228651","display_name":"Agency for Science, Technology and Research","ror":"https://ror.org/036wvzt09","country_code":"SG","type":"government","lineage":["https://openalex.org/I115228651"]},{"id":"https://openalex.org/I4210161496","display_name":"A*STAR Graduate Academy","ror":"https://ror.org/059yjzn93","country_code":"SG","type":"education","lineage":["https://openalex.org/I115228651","https://openalex.org/I4210161496"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Ernest Kurniawan","raw_affiliation_strings":["I2R, A*Star, Singapore","I R, A*Star, Singapore"],"raw_orcid":"https://orcid.org/0000-0001-5347-4769","affiliations":[{"raw_affiliation_string":"I2R, A*Star, Singapore","institution_ids":["https://openalex.org/I115228651"]},{"raw_affiliation_string":"I R, A*Star, Singapore","institution_ids":["https://openalex.org/I4210161496"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.15024453,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"22","issue":"6","first_page":"6230","last_page":"6247"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12162","display_name":"Cellular Automata and Applications","score":0.9861000180244446,"subfield":{"id":"https://openalex.org/subfields/1703","display_name":"Computational Theory and Mathematics"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12162","display_name":"Cellular Automata and Applications","score":0.9861000180244446,"subfield":{"id":"https://openalex.org/subfields/1703","display_name":"Computational Theory and Mathematics"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12611","display_name":"Neural Networks and Reservoir Computing","score":0.9830999970436096,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10022","display_name":"Semiconductor Quantum Structures and Devices","score":0.9690999984741211,"subfield":{"id":"https://openalex.org/subfields/3107","display_name":"Atomic and Molecular Physics, and Optics"},"field":{"id":"https://openalex.org/fields/31","display_name":"Physics and Astronomy"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/fuzz-testing","display_name":"Fuzz testing","score":0.9223234057426453},{"id":"https://openalex.org/keywords/stateful-firewall","display_name":"Stateful firewall","score":0.8727577924728394},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6929678916931152},{"id":"https://openalex.org/keywords/layer","display_name":"Layer (electronics)","score":0.5112128257751465},{"id":"https://openalex.org/keywords/enhanced-data-rates-for-gsm-evolution","display_name":"Enhanced Data Rates for GSM Evolution","score":0.5101562142372131},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.38982415199279785},{"id":"https://openalex.org/keywords/telecommunications","display_name":"Telecommunications","score":0.1350698471069336},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.12933820486068726},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.10743644833564758},{"id":"https://openalex.org/keywords/materials-science","display_name":"Materials science","score":0.0839286744594574},{"id":"https://openalex.org/keywords/nanotechnology","display_name":"Nanotechnology","score":0.07237911224365234}],"concepts":[{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.9223234057426453},{"id":"https://openalex.org/C22927095","wikidata":"https://www.wikidata.org/wiki/Q1784206","display_name":"Stateful firewall","level":3,"score":0.8727577924728394},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6929678916931152},{"id":"https://openalex.org/C2779227376","wikidata":"https://www.wikidata.org/wiki/Q6505497","display_name":"Layer (electronics)","level":2,"score":0.5112128257751465},{"id":"https://openalex.org/C162307627","wikidata":"https://www.wikidata.org/wiki/Q204833","display_name":"Enhanced Data Rates for GSM Evolution","level":2,"score":0.5101562142372131},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.38982415199279785},{"id":"https://openalex.org/C76155785","wikidata":"https://www.wikidata.org/wiki/Q418","display_name":"Telecommunications","level":1,"score":0.1350698471069336},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.12933820486068726},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.10743644833564758},{"id":"https://openalex.org/C192562407","wikidata":"https://www.wikidata.org/wiki/Q228736","display_name":"Materials science","level":0,"score":0.0839286744594574},{"id":"https://openalex.org/C171250308","wikidata":"https://www.wikidata.org/wiki/Q11468","display_name":"Nanotechnology","level":1,"score":0.07237911224365234},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tdsc.2025.3582093","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tdsc.2025.3582093","pdf_url":null,"source":{"id":"https://openalex.org/S133795288","display_name":"IEEE Transactions on Dependable and Secure Computing","issn_l":"1545-5971","issn":["1545-5971","1941-0018","2160-9209"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Dependable and Secure Computing","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":16,"referenced_works":["https://openalex.org/W2626006124","https://openalex.org/W2929535634","https://openalex.org/W2987215725","https://openalex.org/W2990286122","https://openalex.org/W3024280588","https://openalex.org/W3048340936","https://openalex.org/W3136586396","https://openalex.org/W3177044699","https://openalex.org/W3194394634","https://openalex.org/W3216250204","https://openalex.org/W4200405708","https://openalex.org/W4226344376","https://openalex.org/W4297099995","https://openalex.org/W4315629744","https://openalex.org/W4382396178","https://openalex.org/W4382396221"],"related_works":["https://openalex.org/W2511770387","https://openalex.org/W3120811337","https://openalex.org/W2129975948","https://openalex.org/W2591875911","https://openalex.org/W2736754676","https://openalex.org/W4287833485","https://openalex.org/W4401906987","https://openalex.org/W4401907763","https://openalex.org/W4404407863","https://openalex.org/W4387191767"],"abstract_inverted_index":{"In":[0],"this":[1],"paper,":[2],"we":[3,110],"present":[4],"<sc":[5,28,52,83,113,132,196],"xmlns:mml=\"http://www.w3.org/1998/Math/MathML\"":[6,29,53,84,114,133,197],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">5Ghoul</small>,":[7],"a":[8,32,178],"framework":[9,130],"to":[10,40,46,61,70,89,100,103,171,199],"systematically":[11],"discover":[12],"and":[13,66,123,126,160,188],"replicate":[14],"security":[15,139,205],"vulnerabilities":[16,73,140,167],"on":[17,74],"arbitrary":[18],"5":[19,119],"G":[20,120],"edge":[21],"devices":[22],"(UE).":[23],"At":[24],"the":[25,47,57,63,201],"core":[26],"of":[27,108,145,163,181],"xmlns:xlink=\"http://www.w3.org/1999/xlink\">5Ghoul</small>":[30,54,85,115,134,198],"is":[31],"stateful":[33],"fuzzing":[34,64],"strategy":[35],"that":[36],"provides":[37],"full":[38],"control":[39],"arbitrarily":[41],"manipulate":[42],"any":[43],"packet":[44,91],"down":[45,102],"data":[48,104],"link":[49,105],"layer.":[50,106],"Moreover,":[51,162],"automatically":[55],"constructs":[56],"protocol":[58],"state":[59],"machines":[60],"guide":[62],"process":[65],"employs":[67],"novel":[68],"strategies":[69],"reliably":[71],"exploit":[72],"commercial-off-the-shelf":[75],"(COTS)":[76],"UEs":[77,121,151],"over-the-air.":[78],"The":[79],"design":[80],"choices":[81],"in":[82,93,96,142,149],"were":[86],"carefully":[87],"taken":[88],"allow":[90],"manipulation":[92],"real-time,":[94],"which,":[95],"turn":[97],"allowed":[98],"us":[99],"fuzz":[101],"As":[107],"today,":[109],"have":[111,168,172],"evaluated":[112],"with":[116],"seven":[117],"COTS":[118,150,165],"(smartphones":[122],"USB":[124],"modems)":[125],"one":[127],"open":[128,200],"source":[129],"(OpenAirInterface).":[131],"has":[135],"uncovered":[136],"12":[137],"unknown":[138],"(14":[141],"total)":[143],"out":[144],"which":[146],"ten":[147],"exist":[148],"(ten":[152],"CVEs":[153],"assigned)":[154],"from":[155,186],"major":[156],"vendors":[157],"(e.g.,":[158],"Qualcomm":[159,187],"MediaTek).":[161],"these":[164,192],"UE":[166],"been":[169],"confirmed":[170],"high":[173],"severity.":[174],"We":[175,194],"also":[176],"won":[177],"bug":[179],"bounty":[180],"over":[182],"20":[183],"K":[184],"USD":[185],"MediaTek":[189],"for":[190,203],"discovering":[191],"vulnerabilities.":[193],"envision":[195],"door":[202],"5G":[204],"testing":[206],"at":[207],"scale.":[208]},"counts_by_year":[],"updated_date":"2026-03-27T05:58:40.876381","created_date":"2025-10-10T00:00:00"}