## 2 Related Work  
To gain a comprehensive understanding of the security threats in 5G networks, it is essential to consider recent survey papers that provide an overview of various aspects of 5G security. For example, [PERSON] et al. [7] offer an analysis of 5G-MEC architecture and its security implications, which is crucial in understanding the security challenges in 5G networks. [PERSON] et al. [8] highlight the introduction of new security challenges in 5G due to the utilization of enabling technologies and the high degree of network heterogeneity. This is important in understanding the evolving nature of security threats in 5G networks. Additionally, [PERSON] et al. [9] discuss the new cybersecurity threats introduced by 5G SBA, emphasizing the ineffectiveness of previously adopted security and privacy mechanisms in the context of 5G. [PERSON] et al. [10] present a detailed 5G security analysis from the perspective of network architecture. They closely examine the critical 5G interfaces and provide a set of possible vulnerabilities and threats that would occur if no proper security mechanisms were set in place. Considering commercial networks, there are works such as [PERSON] et al. (2021) [11] that analyze if the mobile operators provide 5G services applying techniques of reaction related to security threats. Their analysis lists the security challenges that are valid in the real 5G NSA (non-stand-alone) network and how they could be mitigated. However, the considered NSA networks are based on the Evolved Packet Core (EPC) architecture, and the identified vulnerabilities are related to the elements of the EPC architecture. In their study on 5G architecture, [PERSON] et al. (2022) [12] propose a 5G security system to ensure security within the 5G core network. They evaluate the performance and security features in real time, focusing on interfaces used in NAS, HTTP, PFCP, and GTP protocols. The authors introduce an effective detection algorithm for PFCP-in-GTP and IPsec disable attacks, representative of 5G vulnerability attacks. Tests were conducted using a commercial 5G core network system simulator. The formal verification of 5G network protocols has been approached through various models. [PERSON] et al. [13] model the Authentication and Key Agreement Protocols (5G-AKA) of 5 GS, while [PERSON] et al. [14] analyze several NAS and RRC protocols. [PERSON] et al. [15] present a formal model of the Authentication and Key Management for Application (AKMA) service used for establishing authenticated communication between users and application functions. [PERSON] et al. [16] recently introduced the first scalable formal model of the 5G core network's access control mechanism. The proposed 5 GCVerif is an adversary-controlled framework designed for the systematic formal analysis of the access control mechanism of the 5G core network, revealing five new classes of exploitable privilege escalation vulnerabilities in the technical specifications. Conversely, numerous fuzzers have been developed in the past to identify new vulnerabilities. The National Computing Centre (NCC) group introduces three representative tools: Fuzzowski 5 GC, Frizzer2, and AFLNet. Among them, Frizzer2 and AFLNet are open-source network protocol fuzzers accessible to anyone [17]. The group examines two open-source solutions, Free5 GC and Open5 GS, with the latter chosen for its stability and ease of installation. While neither of these solutions is of commercial grade, they provide a reasonable test target for free. [PERSON] et al. [18] propose several scenarios to simulate attack injection using the open-source simulator 5 Greplay [19]. These scenarios include modifying and injecting network traffic offline, sending malformed packets against open-source 5G cores in real time, and conducting a NAS-5G Security Mode Command (SMC) replay attack. The last use case involves generating high-bandwidth traffic to validate the scalability of 5 Greplay. 5 Greplay can be considered a classical traffic replay tool when inputting a PCAP file.