PaperlayerView exact revision on arXiv

Source-linked AI summary

MASAR: Multi-stage Attack Surface Analysis and Reasoning Framework for Telecom Networks

Heba Osama, Wessam DeifAllah, Ahmed Saafan, Haitham Ghalwash

arXiv:2610.29343v1cs.CRcs.NI

TL;DR

Architectural threat models and telecom threat knowledge bases do not by themselves trace architectural weaknesses to specific protocol behaviors and attack sequences. MASAR combines threat mapping, DAG-based attack-path decomposition, and TTP synthesis, and applies the framework to IMS signaling scenarios. Its analysis translates architectural weaknesses into attack conditions and protocol-level security properties, with bounded reachability analysis under defined assumptions.

  • Problem

    Architectural threat analysis and operational threat knowledge bases serve different purposes, leaving the connection from architectural weaknesses to protocol behaviors and attack sequences underdeveloped.

    Source: §1 · p. 1

  • Method

    MASAR combines strategic threat mapping, DAG-based logical attack-path decomposition, and operational TTP synthesis, then uses constraint models to examine unsafe protocol-state reachability.

    Source: §1 · p. 1

  • Results

    The analysis translates architectural weaknesses into explicit attack conditions and protocol-level security properties, while MiniZinc models support bounded reachability analysis under defined assumptions.

    Source: §7 · p. 15

  • Takeaways & Limitations

    The examined scenarios show the importance of assessing protocol conditions alongside architectural security controls.

    Source: §6 · p. 12

    STRIDE mapping, attack-DAG construction, TTP mapping, and MiniZinc model development are manual, requiring domain expertise and potentially varying across analysts.

    Source: §6.5 · p. 14

Abstract

from arXiv · show

The increasing complexity of modern telecommunications networks introduces security challenges that require systematic threat analysis. However, a gap remains between architectural threat modeling frameworks, such as Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege (STRIDE), and operational knowledge bases, such as the MITRE Five-G Hierarchy of Threats (FiGHT). This gap limits the ability to connect architectural weaknesses with specific protocol behaviors and attack sequences. This paper presents Multi-stage Attack Surface Analysis and Reasoning (MASAR), a formal framework that bridges this gap through three layers: strategic threat mapping, logical attack path decomposition using directed acyclic graphs (DAGs), and operational synthesis of tactics, techniques, and procedures (TTPs). MASAR is evaluated using a 5G-ready IP Multimedia Subsystem (IMS) architecture, examining two signaling attack scenarios: early media billing bypass through Session Initiation Protocol (SIP) signaling and subscriber information disclosure and topology discovery through the Diameter Cx interface. MiniZinc constraint models are used to analyze the reachability of unsafe protocol states. The analysis demonstrates how MASAR connects architectural threats with specific protocol behaviors and supports security controls that account for network states in telecommunications systems.

1 INTRODUCTION

MASAR addresses the gap between architectural threat identification and operational protocol analysis in complex telecommunications systems. It combines threat mapping, attack-path decomposition, and TTP synthesis, then applies the framework to two IMS signaling scenarios.

1 INTRODUCTION

  • Architectural approaches such as STRIDE and PASTA identify design threats, while FiGHT organizes adversarial behaviors; neither alone traces threats to executable protocol sequences.Analyzing individual security mechanisms may not reveal how weaknesses across interfaces combine into complete attack sequences.Source: §1 · p. 1
  • MASAR connects architectural threat identification, logical attack-path decomposition, and operational TTP synthesis in a three-layer framework.DAGs represent attack dependencies, and constraint models examine whether unsafe protocol states are reachable.Source: §1 · pp. 1–2
  • Complex sessions involving multiple network functions, signaling protocols, and state transitions can make architectural threats difficult to understand without examining exploitation conditions and action sequences.The paper identifies analyst interpretation as a challenge for traditional threat modeling in telecommunications systems.Source: §1 · pp. 1–2
  • The IMS evaluation examines early-media billing bypass through SIP and unauthorized subscriber and routing-information disclosure through Diameter Cx.The scenarios connect architectural trust assumptions and protocol interactions to potential weaknesses and security controls.Source: §1 · p. 2
  • DAG-based paths and formal models structure the analysis of attack dependencies, protocol actions, system states, and potential security-property violations.The models support examination of reachable unsafe states under explicitly defined assumptions.Source: §1 · p. 2

2 RELATED WORK

The related work spans architectural threat modeling, telecom threat knowledge bases, graph-based analysis, and protocol-security research. MASAR brings these perspectives together to connect architectural weaknesses with attack paths and protocol actions.

2 RELATED WORK

  • MASAR integrates architectural threat identification, logical attack-path decomposition, and operational TTP synthesis, with constraint modeling for protocol states and unsafe-state reachability.The reviewed fields provide complementary perspectives on weaknesses, adversarial behavior, dependencies, and protocol vulnerabilities.Source: §2 · p. 2

2.1 Architectural Threat Modeling Frameworks

  • Architectural models such as STRIDE and PASTA classify threats and risks, but translating their findings into signaling procedures and protocol-state transitions requires further analysis.Prior work also examines layered 5G threats, cross-component dependencies, and graph-based attack and defense modeling.Source: §2.1 · p. 2

2.2 Telecom Knowledge Bases and Matrices

  • Telecom resources such as MITRE FiGHT classify 5G tactics and techniques, while GSMA FS.31 provides baseline controls; MASAR connects such stages to architectural weaknesses and protocol actions.Table 1 categorizes relevant methodologies, knowledge bases, security guidance, and modeling techniques by purpose and relationship to MASAR.Source: §2.2 · pp. 2–3, §2 · p. 2, Table 1 · p. 3

2.3 Empirical Protocol Security Research

  • Empirical studies examine vulnerabilities in VoLTE, VoWiFi, IMS signaling, and 5G architectures, while MASAR focuses on transforming architectural threats into protocol scenarios and unsafe-state analysis.The reviewed work includes signaling and billing attacks, ghost calls, attack-graph generation, and security monitoring.Source: §2.3 · p. 3

3 METHODOLOGY: CROSS-LAYER SYNTHESIS

MASAR links architectural threats to protocol behaviors and operational threat information through strategic mapping, attack-path decomposition, and TTP synthesis. Its layers preserve traceability while examining attack dependencies and protocol states.

3 METHODOLOGY: CROSS-LAYER SYNTHESIS

  • MASAR classifies architectural threats, decomposes them into attack paths, and maps protocol actions to operational threat information.The layers build on one another to maintain traceability from weaknesses to potential attacks and adversarial techniques.Source: §3 · p. 3, Figure 1 · p. 4

3.1 Layer 1: Strategic Threat Mapping

  • STRIDE classifies threats for network components and their interactions, with findings associated with components and trust boundaries.A threat category alone does not establish the signaling sequence or protocol conditions needed for exploitation.Source: §3.1 · pp. 3–4

3.2 Layer 2: Logical Path Decomposition

  • DAGs represent attack prerequisites using AND and OR logic, and can capture shared dependencies across attack paths.The logical representation helps identify conditions relevant to exploitation and where controls may interrupt an attack sequence.Source: §3.2 · p. 4

3.3 Layer 3: Operational TTP Synthesis

  • Operational synthesis maps atomic protocol actions to existing techniques or documents them as candidate techniques with protocol context and required conditions.The resulting traceable mapping can support detection requirements, security analysis procedures, and architectural countermeasures.Source: §3.3 · p. 5

3.4 Algorithmic Representation of the Transformation Process

  • The algorithm evaluates DAG nodes from atomic leaves through their dependencies, but does not itself establish exploitability or technique novelty.In the current evaluation, threat mapping, DAG construction, and MiniZinc model development are manual; novelty requires further comparison with research, vulnerabilities, and threat knowledge bases.Source: §3.4 · p. 5, §3.3 · p. 5

4 METHODOLOGY EVALUATION: THE IMS CORE USE CASE

MASAR applies architectural threat mapping, logical attack decomposition, and operational TTP interpretation to two IMS signaling scenarios. The evaluation traces their protocol conditions and candidate controls, with feasibility dependent on modeled configuration and authorization assumptions.

4 METHODOLOGY EVALUATION: THE IMS CORE USE CASE

  • MASAR evaluates Early Media Free Ride and Unauthorized Diameter Cx Information Disclosure by identifying architecture, decomposing prerequisites and protocol actions, then relating behavior to operational threat information.Protocol-state constraints are examined through formal models presented in Section 5.Source: §4 · p. 6

4.1 IMS Architecture, Trust Boundaries, and End-to-End Threat Traceability

  • The IMS data-flow diagram supplies Layer 1 architectural input: the SIP scenario maps to Tampering, while the Diameter scenario maps to Information Disclosure.The evaluation traces both scenarios from architectural threats through logical attack conditions to operational TTP synthesis.Source: §4.1 · p. 6, Figure 3 · p. 6

4.2.1 Technical Scenario and Attack Preconditions

  • The SIP scenario assumes early media is authorized during provisional signaling while the modeled charging control does not adequately account for it before final session confirmation.Charging triggers depend on the applicable architecture and operator configuration; final 200 OK is not universally the first or only trigger, and early media alone does not establish vulnerability.Source: §4.2.1 · p. 7

4.2.2 Attack Path and Logical Decomposition

  • With insufficient early-media and charging enforcement, withholding final SIP confirmation or delaying rejection can enable unauthorized media consumption without the expected charging event.A later 4xx response terminates the session but does not necessarily remove accounting obligations for media already transmitted.Source: §4.2.2 · p. 7

4.2.3 Operational Interpretation and TTP Mapping

  • The SIP behavior is documented as the candidate technique Provisional-State Early-Media Exploitation, with duration limits, session-state-aware authorization, and coordinated charging controls identified as potential safeguards.The technique description is for further assessment and classification, not an assertion that the behavior is a novel or independently validated technique.Source: §4.2.3 · pp. 7–8

4.3.2 Attack Path and Logical Decomposition

  • The Diameter attack requires signaling-path access and acceptance of requests as originating from an authorized peer; these are explicit prerequisites, not inherent properties of Cx.The logical sequence proceeds through a UAR, request forwarding and HSS processing, then a UAA that may support inference of authorization status or routing information.Source: §4.3.1 · p. 8, §4.3.2 · p. 8

4.3.1 Technical Scenario and Attack Preconditions

  • Repeated unauthorized Diameter Cx queries could support subscriber-presence enumeration or expose internal IMS routing information when authorization and disclosure controls are insufficient.Responses may reveal authorization outcomes; depending on procedure, they may also include routing attributes such as a Server-Name or Server-Capabilities AVP.Source: §4.3.1 · p. 8

4.3.3 Operational Interpretation and TTP Mapping

  • The Diameter behavior is characterized as the candidate technique Unauthorized Diameter Cx Subscriber and Topology Information Disclosure, with peer authentication, access restrictions, request authorization, and response validation identified as potential controls.The candidate remains subject to assessment against telecom threat knowledge bases, including MITRE FiGHT.Source: §4.3.3 · p. 9

5 FORMAL VERIFICATION VIA CONSTRAINT SAT-

The section models two signaling scenarios as constraint satisfaction problems to examine whether potentially unsafe protocol states are reachable. It describes a shared four-stage presentation for their assumptions, constraints, properties, and outcomes.

ISFACTION

  • The verification represents signaling procedures as finite sets of variables and constraints to examine reachability of potentially unsafe states.It focuses on Early Media Free Ride and unauthorized Diameter Cx information disclosure.Source: ISFACTION · p. 9
  • The SIP model examines relationships among session states, media authorization, and charging.The Diameter model examines whether insufficient peer-authorization enforcement can permit subscriber or routing information disclosure.Source: ISFACTION · p. 9
  • Each scenario is a constraint satisfaction problem whose safe-behavior property is negated to search for a violating execution trace.A satisfiable result means a violating state is reachable under the modeled constraints; an unsatisfiable result means none exists within the specified model and search bounds.Source: ISFACTION · p. 9
  • An unsatisfiable result is bounded by the specified model and search bounds, rather than establishing that no violating state exists in all deployments.Source: ISFACTION · p. 9
  • The models are implemented in MiniZinc, using finite-domain variables and logical constraints; executable specifications are provided in Appendix A.Source: ISFACTION · p. 9
  • Both models use four stages: representation and assumptions, protocol constraints, security properties and reachability analysis, and witness trace and result interpretation.This shared structure supports description and interpretation across the two signaling protocols.Source: ISFACTION · p. 9

5.1 Model 1: Early Media Billing Bypass

The first MiniZinc model tests whether early media can remain authorized beyond a duration guard without the modeled charging event. Its witness trace reaches that condition under the specified configuration and bounds.

5.1 Model 1: Early Media Billing Bypass

  • The scenario tests whether a provisional session can persist with media transmission authorized beyond a specified duration without the expected charging event.The analysis evaluates reachability under its assumptions; it does not establish that the behavior occurs in every IMS implementation.Source: §5.1 · p. 9

5.1.1 Model Representation and Assumptions

  • The model represents each of T discrete steps with SIP session state, media authorization, charging-record status, and elapsed media duration.These variables describe signaling progression, media availability, and charging behavior in the modeled configuration.Source: §5.1.1 · p. 9

5.1.2 Protocol Constraints

  • Protocol constraints open media on entry to the provisional state, keep it open while provisional, associate charging with confirmation, and close media on termination.The modeled charging assumption is specific to this scenario and does not imply every IMS implementation charges only after confirmation.Source: §5.1.2 · p. 10

5.1.3 Security Properties and Reachability Analysis

  • The unsafe condition is media remaining authorized beyond Tguard without a charging record; the query tests whether that state is reachable within the model’s bounds.An unsatisfiable query would show only that the specified violation is unreachable under the selected bounds and constraints, not beyond them.Source: §5.1.3 · p. 10

5.1.4 Witness Trace and Result Interpretation

  • At step 7, the solver finds provisional media authorized for 75 seconds without charging, exceeding the 60-second guard.The result establishes reachability within the modeled configuration and execution bounds; applicability depends on the media-authorization, session-timeout, and charging assumptions.Source: §5.1.4 · p. 10

5.2 Model 2: Unauthorized Diameter Cx Information Disclosure

The second MiniZinc model tests whether an unauthorized Diameter peer can obtain protected information through the IMS Cx interface. The modeled disclosure condition is reachable when peer authorization enforcement is disabled, subject to the scenario’s assumptions.

5.2 Model 2: Unauthorized Diameter Cx Information Disclosure

  • The scenario asks whether insufficient peer authorization permits a UAR to be accepted and a UAA with protected subscriber or routing information to reach an unauthorized requester.It focuses on the Diameter signaling trust boundary, not the timing of SIP Digest authentication.Source: §5.2 · pp. 10–11

5.2.1 Model Representation and Assumptions

  • The model represents interactions among an unauthorized peer, the Diameter signaling infrastructure, and the HSS, using authorization, request acceptance, and disclosure conditions.It also encodes discrete event timestamps and requires distinct timestamps for represented events.Source: §5.2.1 · p. 11

5.2.2 Protocol Constraints

  • Protocol constraints order UAR sending and forwarding, HSS processing, UAA return, and response receipt, while modeling authorization at the Diameter signaling boundary.The authorization and disclosure relationships abstract the vulnerable configuration rather than fully implementing Diameter Cx processing.Source: §5.2.2 · p. 11

5.2.3 Security Properties and Reachability Analysis

  • The security property forbids an unauthorized peer from both obtaining request acceptance and receiving protected information; the reachability query tests that violation.The modeled adversary must be able to reach the Diameter infrastructure, and exploitation also requires insufficient boundary enforcement and useful information in the UAA.Source: §5.2.3 · p. 11

5.2.4 Witness Trace and Result Interpretation

  • The solver finds unauthorized disclosure reachable when peer authorization enforcement is disabled, the request is accepted, and protected response information is disclosed.The witness respects the modeled Diameter signaling order; it does not establish access in a deployed IMS network or that every UAA contains protected information.Source: §5.2.4 · p. 11

5.3 Solver Configuration and Reproducibility

The two MiniZinc models produced satisfying assignments for their respective violation queries. The paper describes the configurations and reporting requirements needed to reproduce and interpret those bounded results.

Reproducibility

  • Reproduction requires recording MiniZinc version, solver backend, model parameters, and solver status, with executable specifications provided in Appendix A.The models are intended to express relevant variables, transition rules, and security properties in executable form.Source: §5.3 · p. 12

Result interpretation and configuration

  • A satisfiable result means a violating assignment exists within the constraints and bounds; unsatisfiable means none exists there, while unknown or incomplete establishes neither.Satisfying assignments should include witness traces, and unsatisfiable results should report model bounds and assumptions; Table 4 summarizes configurations.Source: §5.3 · p. 12

Solver results

  • Both models produced satisfying assignments: Model 1 found an unsafe provisional media state at step 7, and Model 2 found unauthorized disclosure under its assumptions.The reported environment execution times were 539 ms for Model 1 and 341 ms for Model 2, including overhead rather than isolated solver time or scalability measurement.Source: §5.3 · p. 12

5.4 Extending STRIDE Through MASAR

MASAR extends STRIDE-based architectural threat identification through additional analytical stages. It connects identified threats to logical dependencies, protocol-state analysis, and operational threat information, while the supplied evaluation does not establish performance improvements.

MASAR’s relationship to STRIDE

  • MASAR builds on STRIDE’s architectural threat classification by adding stages that connect threats to logical attack dependencies, protocol conditions, and operational threat information.The methodology is presented as complementing and extending STRIDE, not replacing it.Source: §5.4 · p. 12

Evaluation boundary

  • The table describes methodological capabilities rather than experimentally established performance improvements.Quantitative conclusions about effectiveness, scalability, or analyst consistency require further evaluation.Source: §5.4 · p. 12, Table 5 · p. 12

6 DISCUSSION: GAP ANALYSIS AND ARCHITECTURAL COUNTERMEASURES

The discussion shows why telecom threat analysis must connect architectural classifications to the signaling conditions and attack sequences behind potential risks. It describes constraint-based analysis, scenario-specific controls, operational technique candidates, and limits on the current evaluation.

6 DISCUSSION: GAP ANALYSIS AND ARCHITECTURAL COUNTERMEASURES

  • The two IMS scenarios show that signaling interactions, network states, and trust boundaries can create risks not fully described by architectural threat classifications.Early Media Free Ride involves session establishment, media authorization, and charging; Diameter Cx disclosure concerns authorization of signaling requests and exposure of subscriber or routing information.Source: §6 · p. 12

6.1 The Signaling Plane Security Gap

  • Threat classifications identify concerns but do not necessarily explain the signaling sequence or system conditions required for an attack.MASAR connects threat categories with logical attack dependencies and protocol conditions.Source: §6.1 · pp. 12–13

6.2 The Role of Constraint Solving in Protocol Security Analysis

  • Constraint models examine whether selected signaling scenarios reach states violating specified security requirements, with assignments identifying relevant conditions and event sequences.The analysis depends on model completeness and accuracy, and bounded verification does not rule out vulnerabilities beyond modeled limits.Source: §6.2 · p. 13

6.3 Architectural Countermeasures

  • MASAR’s countermeasures target the signaling procedures and trust boundaries associated with modeled weaknesses rather than relying only on broad threat categories.The discussion frames the controls around conditions represented in each attack scenario.Source: §6.3 · p. 13

6.3.1 Mitigating Early Media Exploitation

  • Early-media controls should coordinate SIP session states with media authorization and charging, using duration limits or state-dependent restrictions as appropriate.The appropriate configuration depends on the service model, charging architecture, and permitted early-media behavior; the discussion does not call for a universal prohibition on bidirectional early media.Source: §6.3.1 · p. 13

6.3.2 Securing the Diameter Cx Interface

  • Diameter Cx protections should authenticate and authorize peers, restrict access to subscriber services, and limit responses to information the requesting peer may receive.Controls focus on the Diameter signaling trust boundary, not on requiring SIP subscriber authentication before every legitimate Cx authorization procedure.Source: §6.3.2 · pp. 13–14

6.4 Operational Contribution to MITRE FiGHT

  • MASAR links protocol actions to operational threat information, but its proposed technique descriptions remain candidates pending independent assessment and classification.The candidate mappings are intended to support security monitoring, incident investigation, and controls targeting specific attack conditions.Source: §6.4 · p. 14

6.5 Limitations and Future Research Directions

  • The evaluation covers two IMS signaling scenarios, uses manually performed analyst-guided transformations, and models selected protocol behaviors rather than complete implementations.Scalability and performance measurements are unavailable; operational TTP mapping and generalizability across architectures, implementations, and scenarios need further evaluation.Source: §6.5 · p. 14

7 CONCLUSION AND FUTURE WORK

MASAR connects architectural security risks with protocol-level adversarial behavior through threat mapping, attack-path decomposition, and operational TTP synthesis. Applied to two IMS signaling scenarios, it supports bounded unsafe-state analysis under defined assumptions, while the results do not establish exploitability in operational networks.

7 CONCLUSION AND FUTURE WORK

  • MASAR integrates STRIDE threat mapping, DAG-based attack-path decomposition, and operational TTP synthesis informed by telecom security knowledge bases.The framework is presented as a structured method for connecting architectural security risks with protocol-level adversarial behavior.Source: §7 · pp. 14–15
  • The evaluation applies MASAR to a 5G-ready IMS architecture using SIP early-media exploitation and unauthorized Diameter Cx information disclosure scenarios.Source: §7 · p. 15
  • The analysis translates architectural weaknesses into explicit attack conditions and protocol-level security properties, with MiniZinc models supporting bounded reachability analysis under defined assumptions.Candidate technique descriptions are potential contributions to telecom threat knowledge bases, subject to independent review and classification.Source: §7 · p. 15
  • The verification results depend on modeled architecture, protocol behavior, and configuration assumptions, and do not independently establish exploitability in operational IMS networks.Future work includes automating transformations and evaluating other architectures and representative implementations.Source: §7 · p. 15

APPENDIX

The appendix provides MiniZinc specifications for the two constraint-based analyses and describes the bounded model used for early-media billing bypass.

APPENDIX

  • The appendix supplies MiniZinc specifications for the constraint-based analyses described in Section 5.The models encode selected protocol states, authorization conditions, event ordering, and reachability queries.Source: APPENDIX · p. 15
  • The specifications use finite domains and bounded execution traces, so results are interpreted under their stated assumptions, parameters, and bounds.They were run using MiniZinc IDE 2.10.1 with Gecode 6.4.Source: APPENDIX · p. 15
  • The first model tests whether an IMS session can remain provisional with media open and no charging record beyond a specified duration.The reachability query sets a 60-second guard and uses 15-second steps over a seven-step trace.Source: APPENDIX · pp. 15–16

.2 Model 2: Unauthorized Diameter Cx Information Disclosure

The second MiniZinc model examines whether weak Diameter Cx peer-authorization enforcement can permit an unauthorized requester to obtain protected subscriber or routing information.

.2 Model 2: Unauthorized Diameter Cx Information Disclosure

Loading 2610.29343v1…