Publications
2026
Tianwei Wu, Abdullah Al Ishtiaq, Tianchang Yang, Yilu Dong, Kai Tu, Zeyu Song, Ridwanul Hasan Tanvir, Md Toufikuzzaman, Shagufta Mehnaz, and Syed Rafiul Hussain. “Guardians of the Air: In-Device Detection of 5G Control-Plane Threats.”
We present 5GShield, the first in-device framework for detecting and mitigating control-plane threats in 5G networks. 5GShield works with two complementary modules called ConnSentinel and ExFinder. By utilizing a novel observation of temporal and spatial consistency in broadcast messages among cells under the same tracking area and frequency, ConnSentinel inspects initial cell broadcast messages from nearby base stations to identify and block suspicious base stations that expose anomalous configuration before connection establishment. On the other hand, a machinelearning-based ExFinder module continuously monitors observable control-plane traffic to detect ongoing protocol-level attacks. For ExFinder, we develop a novel graph representation construction mechanism and integrate it with a hybrid pipeline for anomaly detection and attack classification. To support training and evaluation, we curate the first comprehensive dataset combining diverse benign traces from commercial 5G deployments with malicious traces derived from known 4G and 5G control-plane attacks. Experimental results show that 5GShield achieves 99.6% precision and 97.0% recall in detecting both known and zero-day attacks, based on anomaly detection over UE-visible control-plane behavior. Furthermore 5GShield is lightweight, consuming less than 3.75% of the memory and is deployable on modern commercial devices.
Syed Md Mukit Rashid, Abdullah Al Ishtiaq, Kai Tu, Yilu Dong, Tianwei Wu, Ali Ranjbar, Tianchang Yang, Najrin Sultana, Shagufta Mehnaz, and Syed Rafiul Hussain. “LogicEval: A Systematic Framework for Evaluating Automated Repair Techniques for Logical Vulnerabilities in Real-World Software.”
Logical vulnerabilities are difficult to repair automatically because a patch must account for the intended behavior of the surrounding program. To study this problem, the paper introduces LogicDS, a dataset of 122 real-world logical vulnerabilities, and LogicEval, a framework for assessing patches generated by traditional and language-model-based techniques. The evaluation finds that compilation and testing failures often arise from prompt sensitivity, missing code context, and difficulty locating the code that needs repair.
SeyedMohammad Kashani, Erfan Khademnia, Görkem Emirhüseyinoğlu, Yilu Dong, Tianwei Wu, Sang Wu Kim, Ashfaq Khokhar, Farid Naït-Abdesselam, and Syed Rafiul Hussain. “OptiMAC: Adaptive Security Optimization for Message Authentication Code in Adversarial Environment.”
Authenticating every wireless message separately adds computation and transmission overhead, while authenticating a group of messages can fail when even one message is lost. OptiMAC extends progressive message authentication to remain effective under packet loss and jamming. It formulates updates to the authentication state as an optimization problem that maximizes usable authentication codes at different jamming probabilities, then tunes code length for throughput. Experiments over Wi-Fi and 5G report improvements in both security and efficiency.
2025
Yilu Dong, Tianchang Yang, Abdullah Al Ishtiaq, Syed Md Mukit Rashid, Ali Ranjbar, Kai Tu, Tianwei Wu, Md Sultan Mahmud, and Syed Rafiul Hussain. “CoreCrisis: Threat-Guided and Context-Aware Iterative Learning and Fuzzing of 5G Core Networks.”
CoreCrisis tests 5G core network implementations by first learning a state-machine model from benign inputs. It then explores less-tested states with context-aware mutations and updates the model as the network responds. This iterative process looks for both logical errors and crashes. Across three open-source implementations and one commercial implementation, the evaluation found seven categories of deviations from the specifications and 13 crashing vulnerabilities, with consequences that include denial of service, authentication bypass, and billing fraud.
Yilu Dong, Tao Wan, Tianwei Wu, and Syed Rafiul Hussain. “Evaluating Time-Bounded Defense Against RRC Relay in 5G Broadcast Messages.”
Unauthenticated 5G broadcast messages let fake base stations impersonate legitimate ones before a device connects. Digital signatures can authenticate those messages, but an attacker may relay a valid signed message to evade that protection. The paper implements a signature scheme together with a time limit intended to expose the extra delay introduced by a relay. Evaluation on an open-source 5G system finds that the overhead is acceptable and that the time-bounded check is effective against relay attacks.
2024
Syed Md Mukit Rashid, Tianwei Wu, Kai Tu, Abdullah Al Ishtiaq, Ridwanul Hasan Tanvir, Yilu Dong, Omar Chowdhury, and Syed Rafiul Hussain. “State Machine Mutation-based Testing Framework for Wireless Communication Protocols.”
Proteus uses protocol state machines, security properties, and a testing budget to search for logical vulnerabilities in wireless implementations. It creates message sequences that mostly follow valid protocol behavior while introducing controlled changes likely to violate a property. The authors tested 4G LTE and Bluetooth Low Energy implementations on 23 consumer devices. They found 25 distinct issues across 112 instances; vendors acknowledged 14 vulnerabilities through five CVEs.
Kai Tu, Abdullah Al Ishtiaq, Syed Md Mukit Rashid, Yilu Dong, Weixuan Wang, Tianwei Wu, and Syed Rafiul Hussain. “Logic Gone Astray: A Security Analysis Framework for the Control Plane Protocols of 5G Basebands.”
We develop 5GBaseChecker— an efficient, scalable, and dynamic security analysis framework based on differential testing for analyzing 5G basebands’ control plane protocol interactions. 5GBaseChecker first captures basebands’ protocol behaviors as a finite state machine (FSM) through black-box automata learning. To facilitate efficient learning and improve scalability, 5GBaseChecker introduces novel hybrid and collaborative learning techniques. 5GBaseChecker then identifies input sequences for which the extracted FSMs provide deviating outputs. Finally, 5GBaseChecker leverages these deviations to efficiently identify the security properties from specifications and use those to triage if the deviations found in 5G basebands violate any properties. We evaluated 5GBaseChecker with 17 commercial 5G basebands and 2 open-source UE implementations and uncovered 22 implementation-level issues, including 13 exploitable vulnerabilities and 2 interoperability issues.
Abdullah Al Ishtiaq, Sarkar Snigdha Sarathi Das, Syed Md Mukit Rashid, Ali Ranjbar, Kai Tu, Tianwei Wu, Zhezheng Song, Weixuan Wang, Mujtahid Akon, Rui Zhang, Syed Rafiul Hussain “Hermes: Unlocking Security Analysis of Cellular Network Protocols by Synthesizing Finite State Machines from Natural Language Specifications.”
In this paper, we present Hermes, an end-to-end framework to automatically generate formal representations from natural language cellular specifications. We first develop a neural constituency parser, NEUTREX, to process transition-relevant texts and extract transition components (i.e., states, conditions, and actions). We also design a domain-specific language to translate these transition components to logical formulas by leveraging dependency parse trees. Finally, we compile these logical formulas to generate transitions and create the formal model as finite state machines. To demonstrate the effectiveness of Hermes, we evaluate it on 4G NAS, 5G NAS, and 5G RRC specifications and obtain an overall accuracy of 81-87%, which is a substantial improvement over the state-of-the-art. Our security analysis of the extracted models uncovers 3 new vulnerabilities and identifies 19 previous attacks in 4G and 5G specifications, and 7 deviations in commercial 4G basebands.