LLM Guided Automated Security Analysis for 5G UE Control Plane Protocols

As a critical hub connecting users and 5G networks, 5G UE control plane protocols undertake core functions such as network connection establishment, mobility management, and security authentication. Therefore, studying the security requirements of 5G UE control-plane protocols and constructing corresponding security testing methods are important components of improving the 5G network security protection system, and safeguarding user data security. In this paper, we first use LLM and RAG technologies to parse 3GPP specifications, extract security requirements of 5G UE control-plane protocols, and generate formal LTL assertions. We then adopt a passive-active collaborative state machine learning method to construct state machines for multiple 5G UEs. By selecting a reference state machine for model checking and performing differential testing between other state machines and the reference state machine, we obtain all violation cases of the UEs. The proposed security testing method has extracted 55 security requirements, including 10 new ones, and discovered 5 new violations.