LENS system finds vulnerabilities in core cellular network protocols
When Core-Network Elements Become Reachable: Field-Level Exploitability Analysis in Diameter
Cryptography and Security
Summary
Cellular networks use a protocol called Diameter to help manage phone calls and data. As parts of these networks become accessible from the internet, hackers could find ways to attack them. The authors found that AI language models alone are not reliable at spotting security weaknesses in Diameter messages. They built a system called LENS that guides these models with expert rules and evidence to better find vulnerable parts of the protocol. Using LENS, they discovered many previously unknown security flaws in real cellular systems and in other network protocols.
What this means in practice
- •For cellular network security teams: Identify exploitable fields in cellular signaling protocols to prevent attacks on mobile networks before deployment and improve defenses.
- •For industrial control system engineers: Detect and patch vulnerabilities in network protocols used in industrial environments by applying the LENS approach to their specific systems.
Authors
Wei Yi, Changlong Han, Xue Zhang, Qiao Zhang, Yi Chen, Jin Cao, Di Tang, Yulong Fu, Ben Niu, Hui Li
Abstract
The increasing exposure of cellular core-network elements to public networks has turned Diameter signaling interfaces into a practical attack surface. While large language models (LLMs) show promise for protocol exploitability analysis, we find that their judgments on Diameter can be unreliable because they may deviate from the tacit analysis discipline followed by security experts and reach conclusions without considering complete protocol evidence. To address this challenge, we present LENS, an LLM-based system for reliable field-level Diameter exploitability analysis. LENS guides LLMs using both exploitability-analysis discipline and the protocol evidence needed for analysis. It infers analysis discipline from existing exploit writeups and evidence-collection guidance from exploitability-analysis failures, enabling systematic evidence collection, exploitability assessment, and proof-of-concept (PoC) attack generation when applicable. Our experiments show that LENS performs reliable analysis across four LLMs and repeated runs, achieving mean recall of 94.00% to 98.00%, precision of 78.73% to 88.94%, and accuracy of 84.00% to 92.00%. We find that more than 25% of field paths in the S6a and Cx interfaces are exploitable under the considered threat model. We further assess their impact on practical implementations and uncover 95 previously unknown vulnerabilities, including 17 in open-source EPC/IMS implementations and 78 in commercial deployments, causing service disruption, information leakage, subscriber tracking, and accelerated battery depletion. Applying LENS to 16 additional protocols spanning cellular, network, industrial, and host-internal systems uncovers 118 previously unknown vulnerabilities, demonstrating its strong generalizability.