PHOENIX: Device-Centric Cellular Network Protocol Monitoring using Runtime Verification

Abstract

End-user-devices in the current cellular ecosystem are prone to many different vulnerabilities across different generations and protocol layers. Fixing these vulnerabilities retrospectively can be expensive, challenging, or just infeasible. A pragmatic approach for dealing with such a diverse set of vulnerabilities would be to identify attack attempts at runtime on the device side, and thwart them with mitigating and corrective actions. Towards this goal, in the paper we propose a general and extendable approach called PHOENIX for identifying nday cellular network control-plane vulnerabilities as well as dangerous practices of network operators from the device vantage point. PHOENIX monitors the device-side cellular network traffic for performing signature-based unexpected behavior detection through lightweight runtime verification techniques. Signatures in PHOENIX can be manually-crafted by a cellular network security expert or can be automatically synthesized using an optional component of PHOENIX, which reduces the signature synthesis problem to the language learning from the informant problem. Based on the corrective actions that are available to PHOENIX when an undesired behavior is detected, different instantiations of PHOENIX are possible: a full-fledged defense when deployed inside a baseband processor; a user warning system when deployed as a mobile application; a probe for identifying attacks in the wild. One such instantiation of PHOENIX was able to identify all 15 representative n-day vulnerabilities and unsafe practices of 4G LTE networks considered in our evaluation with a high packet processing speed (∼68000 packets/second) while inducing only a moderate amount of energy overhead (∼4mW).

5G-Spector: An O-RAN Compliant Layer-3 Cellular Attack Detection Service

“…(2) Abnormal Message Sequence Rule Set. Many attacks can be detected based on abnormal message sequences of UEs (also viewed as protocol state-machine bugs [22]).…”

“…The above rule sets need to effectively detect malicious attacks while not producing too many false alarms. However, distinguishing attacks from benign traffic is a challenging task in cellular networks (e.g., FBS detection [24], [42], [25], [23] and intrusion detection [22]) and not unique to our system. For this reason, we set up different alert levels for each attack as shown in Table II.…”

“…As cellular attacks continue to evolve, the second goal is to make 5G-SPECTOR extensible for current and future attacks. While we can employ learning-based frameworks (e.g., automata-based [22] and machine-learningbased [2]), they fall short due to the availability of abundant adversary training samples in public [22]. Besides, existing cellular IDS frameworks are mostly static with relatively low flexibility [24], [23], [26], [42].…”

“…These attacks originate from the vulnerabilities in earlier generations of cellular protocols but most of them still apply in 5G standards [10], [18]. However, while there are existing defenses that address a subset of these attacks from either the UE side [22], [23] or the network side [24], [25], [26], they fall short in having a limited view (e.g., UE-centric defenses cannot detect RAN-targeted attacks [22], [23]) or poor extensibility (e.g., network-based solutions with static defense mechanisms [24], [25], [26]).…”

“…We first demonstrate that 5G-SPECTOR can effectively detect the 7 attacks simulated in our testbed, and can be easily extended with 90 LoC to detect additional 11 unknown attack variants. Further, we tested 5G-SPECTOR with 31 network traces collected from COTS UEs [31], [22] and show that 5G-SPECTOR scales to real-world cellular networks without reporting any false alarms. Meanwhile, we demonstrate 5G-SPECTOR's practicality in detecting two end-to-end exploits reproduced overthe-air [9].…”