CellularAudit: An Automated Framework for Consistency and Security Auditing of 5G Core Networks

The correctness of 5G core-network implementations is critical for reliable and secure mobile communication services. However, manually translating complex 3GPP specifications into executable code often introduces implementation defects due to the semantic gap between protocol requirements and their concrete realizations. Existing dynamic testing approaches are limited by code coverage, while static auditing remains challenging because it requires aligning large-scale specifications with heterogeneous implementation logic and lacks specification-derived oracles. We present CellularAudit, an automated framework for specification-guided auditing of 5G core-network implementations. The key idea of CellularAudit is to leverage 3GPP domain knowledge to construct focused specification and implementation contexts for large language model-based reasoning. Specifically, CellularAudit first identifies implementation-relevant audit entries from 3GPP specifications by filtering irrelevant content and enriching requirements with security semantics. It then constructs a Protocol Entity Index (PEI) to bridge specification requirements and source code based on standardized protocol entities preserved in implementations. Finally, CellularAudit employs evidence-constrained multi-agent reasoning to perform requirement formalization, conformance inspection, security-impact assessment, and evidence validation, thereby reducing false positives. We evaluate CellularAudit on NAS implementations across three widely used open-source 5G core-network platforms, including Open5GS, Free5GC, and OAI. The results show that CellularAudit identifies 622 implementation defects with a precision of 97.95\%, including 228, 219, and 175 defects in the three platforms, respectively. Among them, 480 defects have potential security implications. These results demonstrate that CellularAudit can effectively bridge 3GPP specifications and core-network implementations, enabling reliable and scalable specification-driven defect detection.