mlsanityData to 14 Oct 2026

Hermes: Unlocking Security Analysis of Cellular Network Protocols by Synthesizing Finite State Machines from Natural Language Specifications

arXiv 2310.04381 ↗First posted 6 Oct 2023cs.CR cs.AI cs.CLcited by 4

Not on the map. Why?

Abstract (arXiv)

In this paper, we present Hermes, an end-to-end framework to automatically generate formal representations from natural language cellular specifications. We first develop a neural constituency parser, NEUTREX, to process transition-relevant texts and extract transition components (i.e., states, conditions, and actions). We also design a domain-specific language to translate these transition components to logical formulas by leveraging dependency parse trees. Finally, we compile these logical formulas to generate transitions and create the formal model as finite state machines. To demonstrate the effectiveness of Hermes, we evaluate it on 4G NAS, 5G NAS, and 5G RRC specifications and obtain an overall accuracy of 81-87%, which is a substantial improvement over the state-of-the-art. Our security analysis of the extracted models uncovers 3 new vulnerabilities and identifies 19 previous attacks in 4G and 5G specifications, and 7 deviations in commercial 4G basebands.

Key facts. Cited by 4 papers in the map (data through 14 Oct 2026). Builds on 22 of its 114 references that are in the map. First posted on arXiv 6 Oct 2023.

Builds on

22 of 114 references.

References · 22

  1. 2017Attention Is All You Needcited by 60,361
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  3. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,372
  4. 2018Spider: A Large-Scale Human-Labeled Dataset for Complex and Cross-Domain Semantic Parsing and Text-to-SQL Taskcited by 1,139
  5. 2020Stanza: A Python Natural Language Processing Toolkit for Many Human Languagescited by 723
  6. 2017Seq2SQL: Generating Structured Queries from Natural Language using Reinforcement Learningcited by 687
  7. 2022FOLIO: Natural Language Reasoning with First-Order Logiccited by 235
  8. 2018Constituency Parsing with a Self-Attentive Encodercited by 199
  9. 2016Language to Logical Form with Neural Attentioncited by 158
  10. 2018Multilingual Constituency Parsing with Self-Attention and Pre-Trainingcited by 117
  11. 2018Coarse-to-Fine Decoding for Neural Semantic Parsingcited by 110
  12. 2017Learning a Neural Semantic Parser from User Feedbackcited by 99
10 more
  1. 2020Fast and Accurate Neural CRF Constituency Parsingcited by 50
  2. 2017In-Order Transition-based Constituent Parsingcited by 23
  3. 2018StructVAE: Tree-structured Latent Variable Models for Semi-supervised Semantic Parsingcited by 22
  4. 2020Exploring Neural Models for Parsing Natural Language into First-Order Logiccited by 16
  5. 2020Semi-Automated Protocol Disambiguation and Code Generationcited by 9
  6. 2022Automated Attack Synthesis by Extracting Finite State Machines from Protocol Specification Documentscited by 8
  7. 2018A Formal Analysis of 5G Authenticationcited by 7
  8. 2015Practical Attacks Against Privacy and Availability in 4G/LTE Mobile Communication Systemscited by 4
  9. 2018Leveraging Textual Specifications for Grammar-based Fuzzing of Network Protocolscited by 3
  10. 2020BaseSAFE: Baseband SAnitized Fuzzing through Emulationcited by 3

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2024: 1; 2025: 1; 2026: 2.

4 papers.

  1. 2024CellularLint: A Systematic Approach to Identify Inconsistent Behavior in Cellular Network Specificationscited by 3
  2. 2025An Agentic Flow for Finite State Machine Extraction using Prompt Chainingcited by 0
  3. 2026Understanding Implicit Trust Errors in Core Carrier Networks through Multi-Agent Flaw Discovery and Analysiscited by 0
  4. 2026Automated Synthesis of Cloud Emulatorscited by 0