5G-R Core Network Cyber Security Assessment Method Based on Attack Graphs

doi:10.12142/ZTECOM.202602011

ZTE Communications ›› 2026, Vol. 24 ›› Issue (2): 93-102.DOI: 10.12142/ZTECOM.202602011

• Industry-Academia Co-Research • Previous Articles

5G-R Core Network Cyber Security Assessment Method Based on Attack Graphs

Dong Congtang¹, Xu Hang¹, Sun Bin²^,³(), Ding Jianwen¹, Wang Wei⁴

^1.State Key Laboratory of Advanced Rail Autonomous Operation, Beijing Jiaotong University, Beijing 100044, China
^2.Key Laboratory of Railway Industry of Broadband Mobile Information Communications, Beijing Jiaotong University, Beijing 100044, China
^3.School of Electronic and Information Engineering, Beijing Jiaotong University, Beijing 100044, China
^4.ZTE Corporation, Shenzhen 518057, China

Received:2025-02-03 Online:2026-06-25 Published:2026-06-16
About author:Dong Congtang received his BE degree in communication engineering from Shandong Normal University, China in 2022. He is currently pursuing a master’s degree at the State Key Laboratory of Advanced Rail Autonomous Operation, Beijing Jiaotong University, China. His research interests include cyber security, AIOps and 5G-R.
Xu Hang received his BE degree in communication engineering from China University of Petroleum in 2022 and his ME degree from Beijing Jiaotong University, China in 2024. His research interests include network security and 5G-R.
Sun Bin (bsun@bjtu.edu.cn) received his BS and MS degrees in electronic engineering from Beijing Jiaotong University, China in 2004 and 2007, respectively. From 2007 to 2015, he was an R&D manager with BeiJing Liujie Technology Co., Ltd. He is currently an assistant researcher with the School of Electronic and Information Engineering, Beijing Jiaotong University. His main research interest is the interconnection and interworking of core networks for dedicated railway mobile communication systems.
Ding Jianwen received his BS and MS degrees from Beijing Jiaotong University, China in 2002 and 2005, respectively. He is currently a professor at the School of Electronic and Information Engineering, Beijing Jiaotong University. He received the Second Prize of the China Railway Society Science and Technology Progress Award. His research interests include broadband mobile communications and personal communications, dedicated mobile communication systems for railway, and safety communication technology for train control systems.
Wang Wei is the Technical Director of LTE-R at ZTE Corporation and an expert in railway wireless communication systems. He has extensive experience in GSM-R system design, with in-depth insights into both GSM-R and LTE-R technologies. He has led and participated in several major railway wireless communication projects.
Supported by:
State Key Laboratory of Advanced Rail Autonomous Operation(RAO2023ZZ004);the Project of China State Railway Group(N2024B004);ZTE Industry‐University‐Institute Cooperation Funds(W23L01180)

Abstract

Abstract:

With the rapid advancement of 5G network technology, cyber security threats are intensifying. The fifth-generation mobile communication for railways (5G-R), as a product of the deep integration of the railway industry with 5G technology, plays a crucial role in ensuring the operational safety of railways. Cyber security assessment is one of the key components in safeguarding network security, and attack graphs are one of the mainstream models for cyber security assessment methods. This paper focuses on optimizing the method for assessing the security of the 5G-R core network based on attack graphs. By integrating the business security requirements of the 5G-R core network, this paper optimizes the parameters for the conventional vulnerability assessment methods and the influencing indicators of atomic attack success probability. It also constructs a formula for calculating the atomic attack success probability based on the fuzzy analytic hierarchy process (AHP). By setting up a simulated environment of the 5G-R core network within a network target field, this paper conducts the feasibility verification of the assessment method for 5G-R core cyber security. Comparative experiments with the conventional common vulnerability scoring system (CVSS) and methods used in existing literature prove the validity and superiority of the proposed model.

Key words: 5G-R, cyber security, attack graph, AHP, security assessments

Dong Congtang, Xu Hang, Sun Bin, Ding Jianwen, Wang Wei. 5G-R Core Network Cyber Security Assessment Method Based on Attack Graphs[J]. ZTE Communications, 2026, 24(2): 93-102.

Figures/Tables 13

References 15

[1]	Ding J W, Liu Y, Liao H J, et al. Statistical model of path loss for railway 5G marshalling yard scenario [J]. ZTE communications, 2023, 21(3): 117–122. DOI: 10.12142/ZTECOM.202303015
[2]	He R S, Ai B, Zhong Z D, et al. 5G for railways: next generation railway dedicated communications [J]. IEEE communications magazine, 2022, 60(12): 130–136. DOI: 10.1109/mcom.005.2200328
[3]	Sun Z T. Hierarchical and complex parallel network security threat situation quantitative assessment method [C]//The 6th International Conference on Computing Methodologies and Communication (ICCMC). IEEE, 2022: 276–279. DOI: 10.1109/ICCMC53470.2022.9753819
[4]	Information technology—security techniques—information security management systems—overview and vocabulary [S]
[5]	Ritchey R W, Ammann P. Using model checking to analyze network vulnerabilities [C]//Symposium on Security and Privacy. IEEE, 2000: 156–165. DOI: 10.1109/SECPRI.2000.848453
[6]	Lippmann R, Ingols K, Scott C, et al. Validating and restoring defense in depth using attack graphs [C]//IEEE Military Communications Conference. IEEE, 2006: 1–10. DOI: 10.1109/MILCOM.2006.302434
[7]	Sheyner O, Wing J. Tools for generating and analyzing attack graphs [M]//Formal methods for components and objects. Berlin, Heidelberg: Springer, 2004: 344–371.
[8]	Ou X, Govindavajhala S, Appel A W. MulVAL: a logic-based cyber security analyzer [C]//The 14th USENIX security symposium. USENIX, 2005: 113–128. DOI: 10.5555/1251398.1251406
[9]	Phillips C, Swiler L P. A graph-based system for network-vulnerability analysis [C]//The 1998 Workshop on New Security Paradigms. ACM, 1998: 71–79
[10]	Jajodia S, Noel S, O’berry B. 2005. Topological analysis of network attack vulnerability [M]//Managing cyber threats: issues, approaches, and challenges. Boston: Springer US, 2005: 247–266
[11]	Wang J F, Guo Y B. Cyber security risk assessment of physical information systems based on attack graphs [J]. Science technology and engineering, 2023, 23(28): 12175–12181. DOI: 10.12404/j.issn.1671-1815.2023.23.28.12175
[12]	Pu J Y, Li Y H, Zhou C J. Method for cross-domain dynamic security risk analysis of industrial control systems based on probabilistic attack graphs [J]. Information cyber security, 2023, 23(9): 85–94. DOI: 10.3969/j.issn.1671-1122.2023.09.008
[13]	Wang Z B, Zhang Y F, Chen Y L, et al. Method for discovering attack paths based on hierarchical task networks [J]. Computer science, 2023, 50(9): 35–43. DOI: 10.11896/jsjkx.230500025
[14]	Wang S E, Liu C X, Liu S X, et al. A method for assessing 5G cyber security risk based on attack graphs [J]. Computer applications and software, 2023, 40(04): 289–296+335. DOI: 10.3969/j.issn.1000-386x.2023.04.046
[15]	Zeng K L, Zhang N, Li W H, et al. Network asset security assessment model based on Bayesian attack graph [J]. Computer science, 2023, 50(12): 349–358. DOI: 10.11896/jsjkx.221000019

Level	Business Confidentiality	Business Integrity	Business Continuity
High	Serious threats to the business due to the leakage of critical information in the 5G-R core network	Illegal modification, destruction, or deletion of business data or system functions, seriously affecting business processes	Key business services unavailable for a long time, requiring an extended recovery period
Low	Minor leakage of non-critical business information, with relatively minor impacts	Minor unauthorized modification of business data or system functions	Temporary business interruption or delay
None	No information leakage	No modification of business data or system functions	No impact

Level	Business Confidentiality	Business Integrity	Business Continuity
High	Serious threats to the business due to the leakage of critical information in the 5G-R core network	Illegal modification, destruction, or deletion of business data or system functions, seriously affecting business processes	Key business services unavailable for a long time, requiring an extended recovery period
Low	Minor leakage of non-critical business information, with relatively minor impacts	Minor unauthorized modification of business data or system functions	Temporary business interruption or delay
None	No information leakage	No modification of business data or system functions	No impact

Indicator Category	Indicator Level	Quantitative Value
Attack vector	Network, wireless access, adjacent network, local, physical	(0.85, 0.85, 0.62, 0.55, 0.20)
Attack complexity	Very high, High, Medium, Low	(0.22, 0.44, 0.56, 0.77)
Business confidentiality	High, Low, None	(0.27, 0.62, 0.85)
Business integrity	High, Low, None	(0.27, 0.62, 0.85)
Business continuity	High, Low, None	(0.27, 0.62, 0.85)

Indicator Category	Indicator Level	Quantitative Value
Attack vector	Network, wireless access, adjacent network, local, physical	(0.85, 0.85, 0.62, 0.55, 0.20)
Attack complexity	Very high, High, Medium, Low	(0.22, 0.44, 0.56, 0.77)
Business confidentiality	High, Low, None	(0.27, 0.62, 0.85)
Business integrity	High, Low, None	(0.27, 0.62, 0.85)
Business continuity	High, Low, None	(0.27, 0.62, 0.85)

Indicator Category	Level	Classification Criteria
Technical maturity	High (H)	Widely used tools or methods exist; the attack process is fully automated, requiring no complex configuration.
	Automatable (A)	Automated tools requiring basic configuration; attack scripts or code may have been developed and shared, needing minor modifications.
	Verified (V)	Verified in certain environments but not widely automated; requiring technical adjustments to existing tools.
	Unverified (V_u )	Only proposed in theory; requiring highly customized development, involving complex research and testing.
Mitigation level	Non-remediable (N_R )	Currently, no known patches or tools that can mitigate the risk.
	Indirectly remediable (N_DR )	Although no direct remedy is available, the risk can be mitigated by implementing additional protective measures.
	Low remediation (L_DR )	Methods are available to address the vulnerability, but they either only partially alleviate the risk or are complex to implement.
	High remediation (H_DR )	The vulnerability can be effectively addressed with existing methods and tools; patches or remedial measures are already available.
Report confidence	Confirmed (C)	Existence and details are verified through reliable means; it has been exploited in observed attacks or detailed reports provided by relevant organizations.
	Unconfirmed (C_u )	The report is not fully verified; it may originate from unverified third-party claims or automated scanning tools, requiring further verification.
	Unknown	There have been no reports related to this vulnerability.

5G-R Core Network Cyber Security Assessment Method Based on Attack Graphs

RichHTML

PDF

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 13

References 15

Related Articles 2

Recommended Articles

Metrics

Value Range	Classification Criteria
0.8–1.0	Extensive impact scope: involves crucial data; failure causes a severe breakdown of the entire system.
0.6–0.8	Broad impact scope: involves highly sensitive data; failure may result in prolonged business interruption.
0.4–0.6	Moderate impact scope: components handle sensitive data; failure causes temporary business interruption.
0.2–0.4	Limited impact scope: data is moderately sensitive; failure has a minor impact on network stability.
0.0–0.2	Negligible impact scope: data is public or non-sensitive; failure has virtually no impact on the network.

Value Range	Classification Criteria
0.8–1.0	Integrates advanced security protection technologies; physical security meets high standards, possessing comprehensive data backup and rapid recovery capabilities.
0.6–0.8	Adopts multi-layered protective technologies; physical security has advanced preventative measures, with strong data backup and recovery capabilities.
0.4–0.6	Deploys a range of defense technologies; moderate physical security measures are implemented, with certain data recovery capabilities.
0.2–0.4	Configured with basic security controls; physical security relies on generic solutions, lacking the ability for quick recovery.
0.0–0.2	Unprotected or features only basic default settings; lacks physical security controls, data backup, and recovery mechanisms.

	Vulnerability Exploitability	Vulnerability Temporal Availability	Business Criticality	Strength of Protective Measures
Vulnerability exploitability	(0.5, 0.5, 0.5)	(0.7, 0.8, 0.9)	(0.6, 0.7, 0.8)	(0.5, 0.6, 0.7)
Vulnerability temporal availability	(0.1, 0.2, 0.3)	(0.5, 0.5, 0.5)	(0.3, 0.3, 0.4)	(0.2, 0.3, 0.4)
Business criticality	(0.2, 0.3, 0.4)	(0.6, 0.6, 0.7)	(0.5, 0.5, 0.5)	(0.3, 0.5, 0.5)
Strength of protective measures	(0.3, 0.4, 0.5)	(0.6, 0.7, 0.8)	(0.6, 0.6, 0.8)	(0.5, 0.5, 0.5)

Indicator Category	Indicator	Quantitative Value
Technical maturity	High, automatable, verified, unverified	(1.00, 0.97, 0.94, 0.91)
Level of remediation	Non-remediable, indirectly remediable, low remediation level, high remediation level	(1.00, 0.97, 0.96, 0.95)
Report confidence	Confirmed, unconfirmed, unknown	(1.00, 0.96, 0.92)

Vulnerability	CVSS	5G-R Core Network Vulnerability Assessment Method
CVE-2017-9445	7.5	8.8
CVE-2019-13272	7.8	7.1
CVE-2020-35658	5.3	5.6
CVE-2020-8554	5.5	7.5
CVE-2020-13777	7.5	7.5
CVE-2020-3556	7.5	8.1
CVE-2021-21985	9.8	9.8
CVE-2021-1732	7.8	6.8
CVE-2021-41794	7.5	8.1
CVE-2023-23846	7.5	8.1

[1]	XU Hang, SUN Bin, DING Jianwen, WANG Wei. Analysis of Feasible Solutions for Railway 5G Network Security Assessment [J]. ZTE Communications, 2025, 23(3): 59-70.
[2]	DING Jianwen, LIU Yao, LIAO Hongjian, SUN Bin, WANG Wei. Statistical Model of Path Loss for Railway 5G Marshalling Yard Scenario [J]. ZTE Communications, 2023, 21(3): 117-122.