# Identifying and Exploiting a Denial-of-Service Vulnerability in the NGAP Protocol in 5G Networks

Aya Moheddine, Valeria Loscri

► To cite this version:

Aya Moheddine, Valeria Loscri. Identifying and Exploiting a Denial-of-Service Vulnerability in the NGAP Protocol in 5G Networks. European Conference on Networks and Communications 2025 Eu-CNC & 6G Summit, Jun 2025, Poznan, Poland. hal-05018484

HAL Id: hal-05018484

https://hal.science/hal-05018484v1

Submitted on 3 Apr 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Identifying and Exploiting a Denial-of-Service Vulnerability in the NGAP Protocol in 5G Networks

Aya Moheddine* and Valeria Loscri*,

*Inria Lille-Nord Europe, Lille, France {aya.moheddine, valeria.loscri}@inria.fr

***Abstract***—With the rapid evolution of communication technologies, 5G networks promise to deliver a wide range of services and higher speeds. However, as these networks integrate into critical infrastructure, ensuring their security against malicious attacks is paramount. This paper focuses on a specific security vulnerability within the *Next Generation Application Protocol (NGAP)*, which facilitates communication between *Next-Generation Node B (gNB)* and *Access and Mobility Management Function (AMF)* in the *5G Core Network (5GCN)*. Through an experimental study that draws on an open source testbed based on the latest *Third Generation Partnership Project (3GPP)* specifications, we identify and validate a *Denial-of-Service (DoS)* attack. The attack exploits the absence of mandatory security measures, such as IPSec, allowing a fake gNB to impersonate a legitimate one and inject malicious NGAP messages, causing unintended user disconnections. Although the study is conducted on an open source implementation, we discuss its broader implications, emphasizing how similar vulnerabilities could raise in commercial deployments due to operator-specific configurations and optional security controls in 3GPP standards. Mitigation strategies are proposed to address these risks, including enforcing mandatory security controls and improving gNB authentication mechanisms. This work highlights the need for stricter enforcement of security measures to safeguard the reliability of 5G networks.

***Index Terms***—5G Security, NGAP, NGSetup Procedure.

## I. INTRODUCTION

The advent of 5G networks represents a transformative milestone in modern communication systems, offering unprecedented speed, reliability, and scalability to meet the demands of emerging technologies. As the backbone of future digital ecosystems, 5G promises to revolutionize industries such as autonomous vehicles, smart cities, and telemedicine [1]. The 3GPP standardization body has been pivotal in this evolution, delivering three significant specification releases (15, 16, and 17) that extend mobile networking capabilities to high-security and high-reliability applications [2]–[4].

Although 5G improves on the shortcomings of earlier generations, it inherits and amplifies certain security challenges. The adoption of IP-based communication, introduced in 3G and extensively utilized in 4G, expanded the attack surface, allowing threats such as message injection, replay attacks, and denial of service (DoS) [5]. With its reliance on virtualized network functions (VNFs) and distributed architectures, 5G networks further complicate the security landscape. Virtualization decouples network functions from physical infrastructure, introducing new vulnerabilities.

The critical importance of securing 5G networks has driven significant efforts in the standardization and research communities. The 3GPP security framework (TS 33.501) [6] incor-

porates robust mechanisms such as enhanced authentication and encryption, while specifications such as TR 33.811 [7] address security requirements for 5G network slicing. Furthermore, emerging considerations for postquantum cryptography highlight the importance of resilient encryption algorithms to protect 5G networks against future threats [8]. At the heart of 5G's architecture lies the Core Network (CN), responsible for orchestrating network functions and managing communication sessions. The Next Generation Application Protocol (NGAP) facilitates critical operations between the gNB (base station) and the CN, including mobility management, session establishment, and resource allocation. Despite its central role, NGAP remains underexplored from a security perspective, leaving potential vulnerabilities unaddressed. This paper addresses this gap by conducting an experimental study to evaluate the security of the NGAP protocol in 5G networks. Our main contributions are as follows. Existing research has focused mainly on broader 5G security concerns or other protocol layers such as *Radio Resource Control (RRC)*, *Non-Access-Stratum (NAS)*, leaving NGAP under explored despite its criticality. This study specifically addresses this gap by evaluating a DoS attack that exploits NGAP vulnerabilities. Using an open-source 5G testbed, this work demonstrates how a Pseudo-gNB can impersonate a legitimate one, inject crafted NGAP messages, and disrupt *User Equipment (UE)* connectivity without detection. The findings highlight the need for stricter enforcement of security measures and provide a foundation for future research on securing the N2 interface.

* Vulnerability Identification: An in-depth analysis of the NGAP protocol is conducted to uncover potential security vulnerabilities and assess their exploitability for impactful attacks.

* Experimental Validation: A vulnerability in NGAP related to access request management is identified, and its implications are demonstrated through a real-world testbed.

* Denial of Service Simulation: Using a practical testbed, a Denial-of-Service (DoS) attack targeting the NGAP protocol over the N2 interface is executed to evaluate the robustness of existing security mechanisms.

The remainder of this paper is organized as follows. Section II presents a brief background and security issues of NGAP protocol. Section III discusses the work present in the literature on *Fifth Generation (5G)* security. The threat model is given in Section IV, Section V provides details and a description of the experiments carried out along with the results obtained.
Finally, the conclusion is given in Section VI.

## II. BACKGROUND

The NGAP is a critical signaling protocol within the 5G architecture, facilitating communication between gNB and AMF over the N2 interface. This protocol is crucial in managing UE sessions, mobility and resources, making it integral to the operation and security of 5G networks.

**- 5G Architecture and NGAP Relevance:** 5G networks are designed to support a broad range of services with diverse requirements, such as high data rates, ultra-low latency and massive device connectivity. At the heart of this architecture lies the NGAP protocol, which enables communication between *Radio Access Network* (RAN) and 5GCN. The NGAP protocol provides two essential services:

1) UE-associated services: handle signaling related to user registration, session management and mobility.

2) Non-UE-associated services: manage RAN nodes, including the setup and release of connections between gNBs and the AMF.

Unlike other layers, NGAP operates solely on the N2 interface. It relies on the *Stream Control Transmission Protocol* (SCTP) for message transport, making NGAP a crucial component in ensuring seamless communication and resource allocation between the gNB and AMF.

**- Security Issues in NGAP:** Despite its critical role, NGAP is vulnerable to exploitation due to the following reasons:

1) Optional Security Features: the 3GPP TS 33.501 [6] standard recommends, but does not mandate, the use of cryptographic measures such as IPSec to protect N2 interface communications. This leaves the implementation of security controls to the discretion of network operators, who may prioritize cost or simplicity over security.

2) Plain-text Transmission of Identifier: during the initial connection setup between the gNB and AMF, critical identifiers are transmitted in plain-text. These identifiers are essential for managing UE sessions, and if intercepted, can be misused by attackers to inject malicious NGAP messages.

3) Inadequate Authentication of gNBs: NGAP currently lacks strict mechanisms to authenticate gNBs during setup, enabling an attacker to deploy a fake gNB to impersonate a legitimate node. This is problematic in scenarios where IPSec is not enforced.

4) Vulnerability to Replay and Injection Attacks: the lack of message integrity and replay protection on the N2 interface, when IPSec is absent, makes NGAP messages susceptible to manipulation or injection by attackers.

## III. RELATED WORK

The advent of 5G networks has introduced numerous advances in speed, connectivity, and reliability, but it has unveiled significant security challenges. Although extensive research has been conducted on the security of 5G networks, specific studies addressing vulnerabilities in the NGAP are limited. This section reviews related work in the domains

of 5G security, NGAP vulnerabilities, fake gNB attacks, and mitigation mechanisms.

The security of 5G networks has been extensively studied, with researchers identifying a wide range of potential vulnerabilities at various network layers. The authors in [9] provide a comprehensive overview of security threats in 5G, including attacks on the control and data planes, such as message injection, replay attacks, and DoS signaling attacks. Furthermore, the lack of robust mutual authentication mechanisms between gNBs and the 5G Core Network (5GCN) has been noted as a critical issue. Multiple studies emphasize the risks of insecure configurations and operator decisions to forego security features due to cost or performance concerns. In [10], a formal methodology to generate complex attack scenarios in 5G networks is introduced. By applying traffic mutation techniques, the researchers model and simulate potential attack vectors, focusing on exploiting vulnerabilities in protocol implementations and network configurations. This approach highlights the significance of systematically analyzing protocol behaviors under various adversarial conditions.

Although research directly addressing NGAP vulnerabilities is limited, a few studies have explored protocol-specific weaknesses. For example, in [11], the authors proposed a formal approach to identifying vulnerabilities in 5G protocols, including NGAP, by mutating network traffic to simulate potential attack scenarios. Their findings reveal several flaws in the protocol design that could be exploited for DoS attacks, aligning with the vulnerabilities exploited in this study. In addition, the authors of [12] systematically generate and mutate NGAP messages using a partition weight table to identify vulnerabilities in the NGAP protocol. Attacks involving rogue base stations have been a recurring theme in cellular network security research. Previous generations, such as 4G LTE, have demonstrated the feasibility of deploying rogue eNBs (Evolved Node B) to intercept or manipulate traffic. The authors in [13] showcased how rogue eNBs could be used to exploit vulnerabilities in LTE networks, disrupting UE connectivity. Although 5G introduces more stringent security measures, this study demonstrates that similar attack vectors remain feasible due to weak NGAP authentication mechanisms.

In the context of 5G, the authors in [14] proposed an ML-based system to detect fake gNB, using traffic patterns and anomaly detection techniques. Such approaches provide promising avenues for mitigating rogue gNB attacks in 5G networks, but require further evaluation for practical deployment.

Efforts to mitigate vulnerabilities in 5G protocols have focused on enhancing authentication mechanisms and improving message validation. [15] proposed integrating machine learning (ML) techniques into the 5G Core to detect anomalous behavior in NGAP and other control plane protocols. Their approach leverages supervised learning models trained in network traffic logs to identify patterns indicative of rogue gNB activity.

Moreover, in [16], the authors suggested extending the NGAP specifications to include mutual mandatory authentication during the gNB-AMF connection configuration phase. They emphasized the need for cryptographic techniques, such as digital certificates and IPsec, to ensure the integrity and authenticity of NGAP messages. A significant contribution to 5G security
is presented by Sebastien Dudek [17], who analyzed security
weaknesses in 5G Stand Alone (SA) networks from both
external and internal attack perspectives. Its work highlights
that adversaries such as a comprised gNB or a malicious UE
can exploit weak integrity protection mechanisms in NGAP to
inject unauthorized messages into the core network.

Although existing work provides valuable information on
5G security challenges, limited attention has been paid to
NGAP-specific vulnerabilities and their exploitation in real-
world scenarios. This study bridges this gap by demonstrating
how a replay-based NGAP injection attack can compromise
the 5G Core Network, leading to UE disconnections and
potential DoS conditions. The findings highlight the need
for improved NGAP authentication mechanisms and anomaly
detection techniques to better protect 5G networks.

IV. THREAT MODEL

A. Attacker Overview

In this study, we assume an attacker with insider access to
the operational 5GCN environment. This insider could take the
form of a network operator with privileged access to compo-
nents of the core network or its associated interfaces, such as
the N2 interface, which connects the gNB and the AMF. The
5GCN operates in a zero trust environment, which means that
trust is not intrinsically given to any internal component or
entity, making insider threats a significant security concern, as
mentioned and followed by the authors in [18]. The attacker's
access and actions are listed below:

* Attacker role: A malicious operator with control over some components of the 5G network such as the configurations of gNBs or AMF policies.

* Attacker Capabilities: the attacker has physical or logical access to the N2 interface, allowing him to observe and manipulate NGAP message exchanges between the gNB and AMF.

* Although 3GPP standards recommend the use of IPSec to secure the N2 interface, the implementation and enforcement of such security measures are often optional and operator-dependent. If these measures are applied, they are primarily used to defend against external threats, not insiders.

* Protocol Weakness: the NGAP protocol does not enforce strict validation of all incoming requests at the AMF, potentially allowing a pseudo gNB to connect and transmit crafted messages.

* No radio interface access: this work assumes that the attacker does not target the radio interface or UE directly but operates solely within the core network.

B. Attacker Capabilities

The attacker has the following capabilities:

1) Traffic Monitoring: the attacker can observe NGAP mes-
sages transmitted between the gNB and AMF. Then ex-
tract critical identifiers including the RAN-UE-NGAP-
ID which is assigned by gNB and uniquely identifies the
UE within the RAN, and AMF-UE-NGAP-ID which is

assigned by the AMF and uniquely identifies the UE
within the core network.

2) Message crafting: using captured identifiers, the attacker can craft legitimate NGAP messages, such as the UE-ContextReleaseRequest, to disrupt network operations.

3) Pseudo-gNB deployment: The attacker can deploy a pseudo gNB that mimics the behavior of a legitimate one to communicate with the AMF. sends NGSetupRequest messages to establish a connection with the AMF.

4) Message Injection: pseudo injects the crafted message into the core network, causing targeted disruptions.

C. Attacker Objectives

The attacker's primary goal is to compromise the operation
of by causing service disruptions for specific UEs. This is
achieved through the following.

* Targeted DoS attack: disconnect specific UE from the network by exploiting the AMF's inability to authenticate the source of NGAP messages.

* Network instability: By deploying a pseudo gNB or injecting large volumes of NGAP messages, the attacker can create larger disruptions.

D. Threat Scenario

1) Traffic Monitoring and Identifier Capturing: the attacker observes the initial NGAP exchange between a legitimate gNB and the AMF during UE registration. From this traffic, the attacker captures the RAN-UE-NGAP-ID and AMF-UE-NGAP-ID, which are transmitted in plaintext. These identifiers uniquely identify the UE session and are critical for crafting NGAP messages.

2) Pseudo-gNB: the attacker sets up a pseudo-like gNB and sends an NGSetupRequest message to the AMF through replaying the same NGSetupRequest message initially sent from the legitimate gNB to the AMF. The AMF, unable to distinguish between the sources of these two messages, accepts the connection and responds with an NGSetupResponse message. The role of this message is to establish the initial signaling connection with the AMF enabling them to exchange control plane signaling messages necessary for network operations [19].

3) Message Crafting and Injection: using the captured iden-
tifiers, the attacker crafts a UEContextReleaseRequest
message. The crafted message specifies the target UE's
identifiers and a cause value (e.g., user inactivity or
deregistration). The fake gNB injects this message into
the network, targeting the AMF.

4) Impact on the Network: the AMF processes the injected message as legitimate, initiating a release of the target UE's resources. The UE is disconnected from the network without being aware of the attack. The legitimate gNB is misinformed by believing that the release was initiated by the AMF.

E. Vulnerability Analysis

The success of this attack depends on the following NGAP
vulnerabilities:
<figure><img src="image_2.png" /><figcaption>Fig. 1. Threat scenario followed in Section IV-D along with the vulnerability analysis presented in Section IV-E.</figcaption></figure>

1. Plain-text Identifier Exchange: RAN-UE-NGAP-ID and AMF-UE-NGAP-ID are transmitted without encryption, exposing them to interception.

2. Lack of Authentication: the AMF does not perform robust validation of gNB connections, allowing pseudo gNBs to impersonate legitimate ones.

3. Absence of Integrity Checks: injected NGAP messages are not verified for authenticity, allowing the injection of malicious messages.

The threat scenario conducted and the vulnerability analysis are presented in detail in Figure 1.

## V. EXPERIMENTS AND VALIDATION

In this section, the experimental testbed with its different components and the architecture of the network are presented.

### A. Testbed Architecture

While our study is conducted in a controlled testbed environment, the chosen architecture closely mirrors real-world 5G deployments. The testbed is given in Figure 2, it includes a SA core network which is provided by the Open5gs [20], a functional gNB offered by srsRAN [21], a real UE, and BladeRF [22] Software Defined Radio (SDR) board that serves as the radio front-end enabling signal transmission and reception for srsRAN and open5gs. In addition to the NGAP procedures that align with 3GPP specifications. Commercial 5G networks may have additional security measures, but they still rely on similar NGAP-based exchanges, meaning that the vulnerabilities identified in this work are applicable beyond the testbed setting.

<figure><img src="image_3.png" /><figcaption>Fig. 2. Diagram showing the different components of the testbed implemented with the interactions across them.</figcaption></figure>

### B. 5G Protocol Message Generation

To be able to perform the DoS attack against the 5G network, it is necessary to generate 5G New Radio (NR) messages. The generation process must comply with the message specifications as mentioned in the 3GPP specification [23]. The 3GPP specifies the use of the ASN.1 notation which is a formal notation used to describe data structures transmitted by telecommunication protocols independent of the programming language used and to be encoded and decoded independently of the platform used to send, receive, and process them. To obtain this notation and generate 5G messages, the **Python** open source Python library is used [24]. The library provides functionalities such as creating a compiler from a specified ASN.1 specification and encoding/decoding messages.
## C. Injection of NGAP Message

In our scenario, the adversary model is based on data integrity and authentication issues on NGAP protocol of the 5G network, causing a DoS attack. The NGAP protocol is used to register and establish the connection between the gNB and the 5G core network. The messages are transmitted over SCTP protocol via the N2 interface between the gNB and AMF in 5G core. The purpose of this attack is to disconnect a specific UE without its awareness, leveraging the NGAP UEContextReleaseRequest message defined by the 3GPP specification 38.413 [25]. The message is created in JSON as shown in Listing 1 and converted to the ASN.1 notation JER format, and transmitted through pseudo-gNB. The pseudo-gNB establishes a connection with the AMF by replaying the previously captured and saved NGSetupRequest message from the legitimate gNB.

### Listing 1. UEContextReleaseRequest Message

```json
{"initiatingMessage": {"procedureCode": 42,"
criticality": "reject", "value": {"protocolIEs
": [
    {"id": 10, "criticality": "reject", "value": "ID of
    AMF"},
    {"id": 85, "criticality": "reject", "value": "ID of
    UE"},
    {"id": 15, "criticality": "ignore", "value": {"NAS
    ": "deregister"}}
]}}
```

## D. Results

The experimental scenario demonstrates the feasibility of executing a DoS attack targeting NGAP protocol using open-source implementations. The attack successfully exploited vulnerabilities within the N2 interface to disconnect a target UE from the 5GCN. Figures 3 and 4 present critical logs and observations:

1) **NGSetupRequest Replay and Injection:** the initial NGSetupRequest message captured is re-encoded by the pseudo-gNB. The core network accepted the request without implementing authentication, establishing unauthorized connectivity between the pseudo gNB and AMF.

2) **UEContextReleaseRequest Execution:** the pseudo gNB sent a malicious UEContextReleaseRequest message to AMF, resulting in the AMF initiating standard release procedures. This caused the legitimate gNB to disconnect the target UE, as shown in 4.

3) **Impact Analysis:** the attack was consistently successful in inducing unintended UE disconnections. The effectiveness of the attack was not affected by variation in network load, highlighting a systemic vulnerability in NGAP authentication mechanisms.

## E. Discussion

The experimental results obtained demonstrate that the initial NGSetupRequest message, originally transmitted by a legitimate gNB can be intercepted, replayed, and re-injected by a pseudo gNB to establish unauthorized connectivity with 5GCN. This vulnerability arises from the absence of robust authentication mechanisms for gNB bootstrapping messages in the NGAP protocol. Taking advantage of this weakness, the pseudo gNB successfully initiates communication with the AMF. This indicates a systemic flaw in the core network, where the source of the NGSetupRequest is not adequately authenticated, allowing unauthorized devices to establish connectivity.

<figure><img src="image_4.png" /><figcaption>Fig. 3. NGAP messages injection. The red boxes highlight the injected NGSetup Request to establish the communication between the pseudo gNB and core network, in addition to UEContextReleaseRequest message.</figcaption></figure>

<figure><img src="image_5.png" /><figcaption>Fig. 4. Screenshot from the AMF log file showing the reception of the message, the processing & transmitting the response to the gNB.</figcaption></figure>

The attack impact is further validated by analyzing the AMF logs. When pseudo gNB sends a UEContextReleaseRequest message, the AMF processes it as legitimate, triggering a series of standard NGAP procedures. The AMF responds with a UEContextReleaseCommand message to legitimate gNB, assuming that the release was initiated either by the AMF or a trusted gNB, as per 3GPP TS 38.413 [25]. This behavior highlights a critical flaw: the AMF does not distinguish between legitimate and malicious gNBs when processing NGAP messages, leading to unintended disconnections and service disruptions. Then the legitimate gNB, upon receiving the UEContextReleaseCommand, processes it as a valid command and responds with a UEContextReleaseComplete message to the AMF, as shown in Figure 4. This creates a deceptive scenario for legitimate gNB, as it cannot differentiate between a genuine AMF-initiated release and one orchestrated by a malicious actor. The AMF's failure to implement adequate authentication mechanisms for gNB bootstrapping messages in the NGAP protocol. Taking advantage of this weakness, the pseudo gNB successfully initiates communication with the AMF. This indicates a systemic flaw in the core network, where the source of the NGSetupRequest is not adequately authenticated, allowing unauthorized devices to establish connectivity.
message validation mechanisms allows the attack to proceed seamlessly, resulting in unauthorized UE disconnections and potential DoS conditions. The findings of this scenario reveal a critical gap in the NGAP protocol and the broader 5GCN architecture: the lack of authentication mechanisms for new gNB connections. This systemic issue enables malicious actors to exploit the bootstrapping process, compromising network security and reliability. To address these vulnerabilities, it is imperative to implement:

* Mandatory Mutual Authentication: enforce mutual authentication between gNBs and the 5GCN during the bootstrapping process. Cryptographic techniques, such as certificate-based authentication or secure key exchange, could prevent unauthorized gNB connections.

* Enhanced Message Validation: introduce strict validation procedures for NGAP messages at the AMF to ensure that the source of each request is authenticated and trusted. This includes validating the integrity of the message, sequence numbers, and source identifiers.

* Anomaly Detection Mechanisms: employ machine learning-based anomaly detection systems to identify patterns indicative of malicious gNB behavior. For example, techniques such as those proposed in [14] to detect fake gNB could be adapted for real-time monitoring and threat detection in 5G networks.

## VI. CONCLUSION

This study demonstrated a denial of service (DoS) attack on the NGAP protocol at the N2 interface of a 5G network, exploiting weak authentication mechanisms to disconnect UEs and release network resources. Using a Pseudo-gNB, the attack replayed and injected NGSetupRequest and UEContextReleaseRequest messages, bypassing security measures. Our findings highlight a critical vulnerability in the 5G architecture: the lack of mandatory encryption and authentication during gNB-AMF communication (NGSetup Procedure). This emphasizes the need for mandatory enforcement of cryptographic protections, such as IPsec or mutual authentication, and machine learning-based anomaly detection systems to block malicious traffic. Future work will explore the scalability of such attacks and evaluate mitigation strategies to enhance the resilience of 5G networks against emerging threats.

## ACKNOWLEDGMENT

This research is based on the support of the Horizon Europe research and innovation program of the European Union, under grant agreement number 101092912 (project MLSysOps).

## REFERENCES

[1] U. Trick, 5G: An Introduction to the 5th Generation Mobile Networks. Walter de Gruyter GmbH & Co KG, 2021.

[2] G. P. Project. (2019) Release 15. [Online]. Available: https://www.3gpp.org/specifications-technologies/releases/release-15

[3] ——. (2020) Release 16. [Online]. Available: https://www.3gpp.org/specifications-technologies/releases/release-16

[4] ——. (2022) Release 17. [Online]. Available: https://www.3gpp.org/specifications-technologies/releases/release-17

[5] I. Ahmad, T. Kumar, M. Liyanage, J. Okwuibe, M. Ylianttila, and A. Gurtov, "5g security: Analysis of threats and solutions," in 2017 IEEE Conference on Standards for Communications and Networking (CSCN). IEEE, 2017, pp. 193–199.

[6] G. P. Project. (2024) Ts 33.501: Security architecture and procedures for 5g system. [Online]. Available: https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId=3169

[7] ——. (2018) Tr 33.811: Study on security aspects of 5g network slicing management. [Online]. Available: https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId=3358

[8] ——. (2019) Tr 33.841: Study on the support of 256-bit algorithms for 5g. [Online]. Available: https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId=3422

[9] S. Park, D. Kim, Y. Park, H. Cho, D. Kim, and S. Kwon, "5g security threat assessment in real networks," Sensors, vol. 21, no. 16, p. 5524, 2021.

[10] Z. Salazar, F. Zaidi, W. Mallouli, A. R. Cavalli, H. N. Nguyen, and E. M. De Oca, "A formal approach for complex attacks generation based on mutation of 5g network traffic," in International Conference on Software and Data Technologies, vol. 1, 2022, pp. P-234.

[11] Z. Salazar, H. N. Nguyen, W. Mallouli, A. R. Cavalli, and E. Montes de Oca, "5greplay: A 5g network traffic fuzzer-application to attack injection," in Proceedings of the 16th International Conference on Availability, Reliability and Security, 2021, pp. 1–8.

[12] Y. Hu, W. Yang, B. Cui, X. Zhou, Z. Mao, and Y. Wang, "Fuzzing method based on selection mutation of partition weight table for 5g core network ngap protocol," in Innovative Mobile and Internet Services in Ubiquitous Computing: Proceedings of the 15th International Conference on Innovative Mobile and Internet Services in Ubiquitous Computing (IMIS-2021). Springer, 2022, pp. 144–155.

[13] A. Dabrowski, G. Petzl, and E. R. Weippl, "The messenger shoots back: Network operator based imsi catcher detection," in Research in Attacks, Intrusions, and Defenses: 19th International Symposium, RAID 2016, Paris, France, September 19-21, 2016, Proceedings 19. Springer, 2016, pp. 279–302.

[14] K. S. Mubasshir, I. Karim, and E. Bertino, "Fbsdetector: Fake base station and multi step attack detection in cellular networks using machine learning," arXiv preprint arXiv:2401.04958, 2024.

[15] Y.-C. Li, P.-T. Liu, Y.-A. Tai, C.-H. Liu, M.-H. Chen, C.-Y. Li, and G.-H. Tu, "A runtime anomaly detector via service communication proxy for 5g mobile networks," in IEEE INFOCOM 2023-IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS). IEEE, 2023, pp. 1–2.

[16] C. Lai, Y. Ma, R. Lu, Y. Zhang, and D. Zheng, "A novel authentication scheme supporting multiple user access for 5g and beyond," IEEE Transactions on Dependable and Secure Computing, vol. 20, no. 4, pp. 2970–2987, 2022.

[17] S. Dudek. (December 20, 2021) Intruding 5g sa core networks from outside and inside. [Online]. Available: https://penthertz.com/blog/Intruding-5G-core-networks-from-outside-and PROMISED INTRUSION DETECTION AND RESPONSE APPROACH FOR 5G SA CORE NETWORKS

[18] K. Thimmaraju, A. Shaik, S. Flück, P. J. F. Mora, C. Werling, and J.-P. Seifert, "Security testing the o-ran near-real time ric & a1 interface," in Proceedings of the 17th ACM Conference on Security and Privacy in Wireless and Mobile Networks, 2024, pp. 277–287.

[19] T. World. (2024) Ngap (ng application protocol) in 5g-nr. [Online]. Available: https://www.linkedin.com/pulse/ngap-ng-application-protocol-5g-nr-techte-world-wilvc/

[20] open5GS. (2024) Open5gs quickstart. [Online]. Available: https://open5gs.org/open5gs/docs/guide/01-quickstart/

[21] srsRAN. (2024) srsran project documentation. [Online]. Available: https://docs.srsran.com/projects/project/en/latest/

[22] Naund. (2024) bladerf 2.0 micro xa4. [Online]. Available: https://www.nuand.com/product/bladerf-xa4/

[23] G. P. Project. (2024) Nr: radio resource control (rrc); protocol specification. [Online]. Available: https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId=3197

[24] pycrate. (2024) pycrate. [Online]. Available: https://github.com/pycrate-org/pycrate

[25] G. P. Project. (2024) 5g; ng-ran; ng application protocol (ngap) (3gpp ts 38.413 version version 18.1.0. [Online]. Available: https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId=3223