Modern multi-vendor 5G systems generate massive volumes of debug logs, yet limited source code access makes protocol behavior modeling and fault diagnosis extremely challenging. KPI-based monitoring fails to capture protocol semantics, and existing FSM inference approaches either do not scale or rely on strong prior knowledge.
We present PHOENIX, an automated framework that reconstructs component-level finite state machines (FSMs) directly from raw 5G network logs. PHOENIX first extracts structured log events using template-based parsing and session grouping, then applies causal graph construction and statistical pruning to infer protocol state transitions without supervision.
PHOENIX builds directed acyclic graphs from event sequences, computes bidirectional confidence metrics for transitions, prunes weak edges using a configurable threshold, and extracts high-coverage initial FSM paths. An iterative refinement process then incrementally incorporates additional paths until coverage and acceptance thresholds are satisfied.
We evaluate PHOENIX on large-scale srsRAN 5G debug logs spanning gigabyte to terabyte scale datasets. The inferred FSMs contain hundreds of states and capture detailed PDCP and RLC layer behaviors, enabling protocol visualization, root cause analysis, and structured reasoning for downstream LLM-based network intelligence tasks.
PHOENIX demonstrates that raw logs alone are sufficient to reconstruct interpretable protocol state machines, providing a scalable and automated foundation for intelligent 5G protocol analysis.
|
|