CrossCrisis 5G Multi-Layer Testing Architecture

CrossCrisis 5G Multi-Layer Testing Architecture An architecture diagram generated by Archify. Mutation Engine · 5 Coordinated Strategies · CrossCrisis Fuzzing & Coordination Plane · fuzzing core Mutation Engine 5 Coordinated Strategies fuzzing core FSM Coordinator · S_RRC x S_NAS x S_NGAP · CrossCrisis Fuzzing & Coordination Plane · state engine FSM Coordinator S_RRC x S_NAS x S_NGAP state engine UE Radio Stack · RRC & AS Security · RAN & Radio Interface (Uu / N2) · access stratum UE Radio Stack RRC & AS Security access stratum gNodeB Stack · NGAP & N2 Interface · RAN & Radio Interface (Uu / N2) · ran transport gNodeB Stack NGAP & N2 Interface ran transport 5G AMF Core · 5GMM & UE Context · 5G Core Network Under Test (Open5GS / Simulated 5GC) · control plane 5G AMF Core 5GMM & UE Context control plane 5G SMF / UPF · 5GSM & PDU Sessions · 5G Core Network Under Test (Open5GS / Simulated 5GC) · user plane 5G SMF / UPF 5GSM & PDU Sessions user plane Cross-Layer Oracles · 4 Formal Invariants · Formal Oracle Verification & Telemetry Pipeline · verification Cross-Layer Oracles 4 Formal Invariants verification Violation Sink · V1-V4 Classifier · Formal Oracle Verification & Telemetry Pipeline · vulnerability telemetry Violation Sink V1-V4 Classifier vulnerability telemetry Telemetry Store · Checkpoints & Time-Series · Formal Oracle Verification & Telemetry Pipeline · storage Telemetry Store Checkpoints & Time-Series storage mutated seq RRC dispatch NGAP dispatch NAS over SRB N2 signaling N11 / PDU state vector PDU state violations snapshots CrossCrisis Fuzzing & Coordination Plane RAN & Radio Interface (Uu / N2) 5G Core Network Under Test (Open5GS / Simulated 5GC) Formal Oracle Verification & Telemetry Pipeline Legend Backend Database Cloud Security

Multi-Layer FSM Tracking

  • • Hierarchical composition of RRC, 5GMM, 5GSM, and NGAP state spaces
  • • Dynamic reachability pruning prevents state space explosion
  • • Tracks real-time dual-stratum security levels (AS vs NAS)

4 Formal Invariant Oracles

  • • I_RRC-NAS: Enforces synchronized radio and mobility lifecycles
  • • I_SEC: Prohibits unencrypted PDU sessions or stratum confusion
  • • I_NGAP: Detects ghost context leaks and table exhaustion
  • • I_PDU: Validates prerequisite bindings before tunnel establishment

Continuous Telemetry

  • • Periodic JSON checkpointing ensures zero data loss across 48h runs
  • • Time-series CSV telemetry captures state exploration dynamics
  • • Resource-bounded execution keeps RAM below 150MB