TY - GEN
T1 - Hermes
T2 - 33rd USENIX Security Symposium, USENIX Security 2024
AU - Al Ishtiaq, Abdullah
AU - Das, Sarkar Snigdha Sarathi
AU - Rashid, Syed Md Mukit
AU - Ranjbar, Ali
AU - Tu, Kai
AU - Wu, Tianwei
AU - Song, Zhezheng
AU - Wang, Weixuan
AU - Akon, Mujtahid
AU - Zhang, Rui
AU - Hussain, Syed Rafiul
N1 - Publisher Copyright:
© USENIX Security Symposium 2024.All rights reserved.
PY - 2024
Y1 - 2024
N2 - In this paper, we present Hermes, an end-to-end framework to automatically generate formal representations from natural language cellular specifications. We first develop a neural constituency parser, NEUTREX, to process transition-relevant texts and extract transition components (i.e., states, conditions, and actions). We also design a domain-specific language to translate these transition components to logical formulas by leveraging dependency parse trees. Finally, we compile these logical formulas to generate transitions and create the formal model as finite state machines. To demonstrate the effectiveness of Hermes, we evaluate it on 4G NAS, 5G NAS, and 5G RRC specifications and obtain an overall accuracy of 81-87%, which is a substantial improvement over the state-of-the-art. Our security analysis of the extracted models uncovers 3 new vulnerabilities and identifies 19 previous attacks in 4G and 5G specifications, and 7 deviations in commercial 4G basebands.
AB - In this paper, we present Hermes, an end-to-end framework to automatically generate formal representations from natural language cellular specifications. We first develop a neural constituency parser, NEUTREX, to process transition-relevant texts and extract transition components (i.e., states, conditions, and actions). We also design a domain-specific language to translate these transition components to logical formulas by leveraging dependency parse trees. Finally, we compile these logical formulas to generate transitions and create the formal model as finite state machines. To demonstrate the effectiveness of Hermes, we evaluate it on 4G NAS, 5G NAS, and 5G RRC specifications and obtain an overall accuracy of 81-87%, which is a substantial improvement over the state-of-the-art. Our security analysis of the extracted models uncovers 3 new vulnerabilities and identifies 19 previous attacks in 4G and 5G specifications, and 7 deviations in commercial 4G basebands.
UR - http://www.scopus.com/inward/record.url?scp=85205027592&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85205027592&partnerID=8YFLogxK
M3 - Conference contribution
AN - SCOPUS:85205027592
T3 - Proceedings of the 33rd USENIX Security Symposium
SP - 4445
EP - 4462
BT - Proceedings of the 33rd USENIX Security Symposium
PB - USENIX Association
Y2 - 14 August 2024 through 16 August 2024
ER -