A Coverage-Guided Fuzzing Method for Non-Access Stratum Protocol

The Non-Access Stratum (NAS) protocol, a critical signaling protocol in the radio access networks of LTE and 5 G systems, plays a pivotal role in ensuring the security and stability of communication sessions between user equipment (UE) and the core network. Exploitation of vulnerabilities in the NAS protocol by attackers can lead to severe consequences. However, the lowlatency requirements of the NAS protocol pose challenges for fuzzing, as prolonged message mutation and coverage statistics processing can increase the risk of communication session timeouts and interruptions. To address these challenges, this paper proposes a coverage-guided fuzzing method for the NAS protocol. By leveraging a timing selection algorithm, the method optimizes the timing of code coverage statistics collection, ensuring efficient guidance of the fuzzing process while maintaining uninterrupted communication sessions. This approach not only enhances code coverage but also improves testing efficiency. We design and implement the NASFuzzer framework and evaluate it on an open-source project. Experimental results demonstrate significant improvements, with code line coverage increasing by $\mathbf{2 4. 8 \%}$ and function coverage by 19.5 %. Furthermore, NASFuzzer successfully identifies three previously unknown vulnerabilities in the open-source project.