{"id":"https://openalex.org/W7163176076","doi":"https://doi.org/10.1145/3765613.3797451","title":"<i>ORANClaw:</i> Shredding E2 Nodes in O-RAN via Structure-aware MiTM Fuzzing","display_name":"<i>ORANClaw:</i> Shredding E2 Nodes in O-RAN via Structure-aware MiTM Fuzzing","publication_year":2026,"publication_date":"2026-06-02","ids":{"openalex":"https://openalex.org/W7163176076","doi":"https://doi.org/10.1145/3765613.3797451"},"language":null,"primary_location":{"id":"doi:10.1145/3765613.3797451","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3765613.3797451","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 19th ACM Conference on Security and Privacy in Wireless and Mobile Networks","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1145/3765613.3797451","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5116678401","display_name":"Geovani Benita","orcid":null},"institutions":[{"id":"https://openalex.org/I152815399","display_name":"Singapore University of Technology and Design","ror":"https://ror.org/05j6fvn87","country_code":"SG","type":"education","lineage":["https://openalex.org/I152815399"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Geovani Benita","raw_affiliation_strings":["Singapore University of Technology and Design, Singapore, Singapore"],"raw_orcid":"https://orcid.org/0009-0005-6567-166X","affiliations":[{"raw_affiliation_string":"Singapore University of Technology and Design, Singapore, Singapore","institution_ids":["https://openalex.org/I152815399"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5075004359","display_name":"Matheus E. Garbelini","orcid":"https://orcid.org/0000-0002-8169-9874"},"institutions":[{"id":"https://openalex.org/I172675005","display_name":"Nanyang Technological University","ror":"https://ror.org/02e7b5302","country_code":"SG","type":"education","lineage":["https://openalex.org/I172675005"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Matheus E. Garbelini","raw_affiliation_strings":["Nanyang Technological University, Singapore, Singapore"],"raw_orcid":"https://orcid.org/0000-0002-8169-9874","affiliations":[{"raw_affiliation_string":"Nanyang Technological University, Singapore, Singapore","institution_ids":["https://openalex.org/I172675005"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137711408","display_name":"Sudipta Chattopadhyay","orcid":"https://orcid.org/0000-0002-4843-5391"},"institutions":[{"id":"https://openalex.org/I75421653","display_name":"University of Missouri\u2013Kansas City","ror":"https://ror.org/01w0d5g70","country_code":"US","type":"education","lineage":["https://openalex.org/I75421653"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Sudipta Chattopadhyay","raw_affiliation_strings":["University of Missouri-Kansas City, Kansas City, Missouri, USA"],"raw_orcid":"https://orcid.org/0000-0002-4843-5391","affiliations":[{"raw_affiliation_string":"University of Missouri-Kansas City, Kansas City, Missouri, USA","institution_ids":["https://openalex.org/I75421653"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5137643897","display_name":"Jianying Zhou","orcid":"https://orcid.org/0000-0003-0594-0432"},"institutions":[{"id":"https://openalex.org/I152815399","display_name":"Singapore University of Technology and Design","ror":"https://ror.org/05j6fvn87","country_code":"SG","type":"education","lineage":["https://openalex.org/I152815399"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Jianying Zhou","raw_affiliation_strings":["Singapore University of Technology and Design, Singapore, Singapore"],"raw_orcid":"https://orcid.org/0000-0003-0594-0432","affiliations":[{"raw_affiliation_string":"Singapore University of Technology and Design, Singapore, Singapore","institution_ids":["https://openalex.org/I152815399"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"163","last_page":"175"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10714","display_name":"Software-Defined Networks and 5G","score":0.9125000238418579,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10714","display_name":"Software-Defined Networks and 5G","score":0.9125000238418579,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10273","display_name":"IoT and Edge/Fog Computing","score":0.0066999997943639755,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10651","display_name":"IPv6, Mobility, Handover, Networks, Security","score":0.005900000222027302,"subfield":{"id":"https://openalex.org/subfields/2208","display_name":"Electrical and Electronic Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/fuzz-testing","display_name":"Fuzz testing","score":0.8546000123023987},{"id":"https://openalex.org/keywords/man-in-the-middle-attack","display_name":"Man-in-the-middle attack","score":0.5597000122070312},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.558899998664856},{"id":"https://openalex.org/keywords/interface","display_name":"Interface (matter)","score":0.5543000102043152},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.49079999327659607},{"id":"https://openalex.org/keywords/implementation","display_name":"Implementation","score":0.4812999963760376},{"id":"https://openalex.org/keywords/generator","display_name":"Generator (circuit theory)","score":0.47360000014305115},{"id":"https://openalex.org/keywords/flexibility","display_name":"Flexibility (engineering)","score":0.44279998540878296},{"id":"https://openalex.org/keywords/base-station","display_name":"Base station","score":0.37059998512268066}],"concepts":[{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.8546000123023987},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6801999807357788},{"id":"https://openalex.org/C196491621","wikidata":"https://www.wikidata.org/wiki/Q554830","display_name":"Man-in-the-middle attack","level":3,"score":0.5597000122070312},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.558899998664856},{"id":"https://openalex.org/C113843644","wikidata":"https://www.wikidata.org/wiki/Q901882","display_name":"Interface (matter)","level":4,"score":0.5543000102043152},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.5152000188827515},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.49079999327659607},{"id":"https://openalex.org/C26713055","wikidata":"https://www.wikidata.org/wiki/Q245962","display_name":"Implementation","level":2,"score":0.4812999963760376},{"id":"https://openalex.org/C2780992000","wikidata":"https://www.wikidata.org/wiki/Q17016113","display_name":"Generator (circuit theory)","level":3,"score":0.47360000014305115},{"id":"https://openalex.org/C2780598303","wikidata":"https://www.wikidata.org/wiki/Q65921492","display_name":"Flexibility (engineering)","level":2,"score":0.44279998540878296},{"id":"https://openalex.org/C68649174","wikidata":"https://www.wikidata.org/wiki/Q1379116","display_name":"Base station","level":2,"score":0.37059998512268066},{"id":"https://openalex.org/C203479927","wikidata":"https://www.wikidata.org/wiki/Q5165939","display_name":"Controller (irrigation)","level":2,"score":0.3377000093460083},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.30000001192092896},{"id":"https://openalex.org/C48103436","wikidata":"https://www.wikidata.org/wiki/Q599031","display_name":"State (computer science)","level":2,"score":0.29330000281333923},{"id":"https://openalex.org/C42058472","wikidata":"https://www.wikidata.org/wiki/Q810214","display_name":"Base (topology)","level":2,"score":0.27959999442100525},{"id":"https://openalex.org/C125411270","wikidata":"https://www.wikidata.org/wiki/Q18653","display_name":"Encoding (memory)","level":2,"score":0.2768000066280365},{"id":"https://openalex.org/C153646914","wikidata":"https://www.wikidata.org/wiki/Q535695","display_name":"Cellular network","level":2,"score":0.27619999647140503},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.2754000127315521},{"id":"https://openalex.org/C2776599810","wikidata":"https://www.wikidata.org/wiki/Q4418000","display_name":"Network address","level":2,"score":0.2736999988555908},{"id":"https://openalex.org/C108037233","wikidata":"https://www.wikidata.org/wiki/Q11375","display_name":"Wireless network","level":3,"score":0.2718999981880188},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.2639999985694885},{"id":"https://openalex.org/C527821871","wikidata":"https://www.wikidata.org/wiki/Q228502","display_name":"Access control","level":2,"score":0.2639000117778778},{"id":"https://openalex.org/C89505385","wikidata":"https://www.wikidata.org/wiki/Q47146","display_name":"User interface","level":2,"score":0.2614000141620636},{"id":"https://openalex.org/C555944384","wikidata":"https://www.wikidata.org/wiki/Q249","display_name":"Wireless","level":2,"score":0.26080000400543213}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3765613.3797451","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3765613.3797451","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 19th ACM Conference on Security and Privacy in Wireless and Mobile Networks","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3765613.3797451","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3765613.3797451","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 19th ACM Conference on Security and Privacy in Wireless and Mobile Networks","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":7,"referenced_works":["https://openalex.org/W2137898377","https://openalex.org/W3215827683","https://openalex.org/W4312446752","https://openalex.org/W4387753666","https://openalex.org/W4391326527","https://openalex.org/W4391759723","https://openalex.org/W4408016758"],"related_works":[],"abstract_inverted_index":{"The":[0],"open":[1,217],"radio":[2],"access":[3],"network":[4,37],"(O-RAN)":[5],"standard":[6],"provides":[7,215],"a":[8,63],"foundational":[9],"move":[10],"towards":[11],"disaggregated":[12],"RAN":[13,149],"architecture,":[14],"allowing":[15,46],"flexibility":[16],"and":[17,35,59,80,83,108,133,144,180,201,225],"multi-vendor":[18],"integration.":[19],"For":[20],"example,":[21],"the":[22,51,74,78,81,95,98,106,114,119,124,175,223],"Radio":[23],"Intelligent":[24],"Controller":[25],"(RIC)":[26],"may":[27],"involve":[28],"third-party":[29],"applications":[30],"(xApps)":[31],"to":[32,93,219],"dynamically":[33],"control":[34,72],"monitor":[36],"behavior,":[38],"facilitating":[39],"significant":[40],"opportunities":[41],"for":[42],"multi-party":[43],"involvement,":[44],"but":[45],"potentially":[47],"untrusted":[48],"integration":[49],"with":[50,136],"RAN.":[52],"In":[53,153],"this":[54,91],"paper,":[55],"we":[56],"propose,":[57],"design":[58],"evaluate":[60],"ORANClaw":[61,102,132,155,183,205,214],"\u2014":[62],"structure":[64,200],"aware,":[65],"man-in-the-middle":[66],"fuzzing":[67],"framework":[68],"that":[69,199],"takes":[70,103],"full":[71],"over":[73],"E2":[75],"interface":[76,92],"between":[77],"xApps":[79],"RIC,":[82,140,172],"systematically":[84,112],"mutates":[85],"or":[86],"duplicates":[87],"packets":[88],"communicated":[89],"via":[90,228],"disrupt":[94],"behavior":[96],"of":[97,126,178],"base":[99],"station":[100],"(gNB).":[101],"into":[104],"account":[105],"structural":[107],"semantic":[109],"constraints":[110],"while":[111],"mutating":[113],"packets.":[115],"Furthermore,":[116],"it":[117,135],"optimizes":[118],"mutation":[120],"strategy":[121],"based":[122],"on":[123],"coverage":[125],"explored":[127],"state":[128],"transitions.We":[129],"have":[130],"implemented":[131],"evaluated":[134],"FlexRIC,":[137,167],"O-RAN":[138,170],"SC":[139,171],"OpenAirInterface,":[141],"ns-3":[142],"simulator":[143],"commercical":[145],"VIAVI":[146,190],"TeraVM":[147,191],"AI":[148,192],"Scenario":[150],"Generator":[151],"gNB/RIC.":[152,194],"total,":[154],"has":[156],"discovered":[157],"71":[158],"unique":[159],"bugs":[160],"(eight":[161],"CVEs":[162],"already":[163],"assigned):":[164],"28":[165],"in":[166,169,174,188,209],"one":[168],"37":[173],"gNB":[176,226],"implementations":[177,227],"OpenAirInterface":[179],"ns-3.":[181],"Additionally,":[182],"uncovered":[184],"five":[185],"distinct":[186],"vulnerabilities":[187],"commercial":[189],"RSG":[193],"Our":[195],"evaluation":[196],"also":[197],"reveals":[198],"semantic-aware":[202],"mutations":[203],"within":[204],"are":[206],"key":[207],"factors":[208],"revealing":[210],"these":[211],"bugs.":[212],"Overall,":[213],"an":[216],"platform":[218],"automatically":[220],"validate":[221],"both":[222],"RIC":[224],"xApp":[229],"manipulations.":[230]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2026-06-03T00:00:00"}