SDNFV Based Threat Monitoring and Security Framework for Multi-Access Edge Computing Infrastructure

摘要: DDoS botnet attacks such as Advanced Persistent & Ransom DoS assaults, Botnets and Application flood are examples of multi-vector, sophisticated application-layer attacks. Conventional IT security approaches centralized have limitations in terms scale, network-wide monitoring resources for distributed detection. This paper proposes a newer approach that integrates multi-layer cooperative intelligence on to converged Software-Defined-Networking/Network-Function-Virtualization architecture typical Multi-access Edge Computing (MEC) scenario. The key features framework include: a) lightweight real-time Threat Analytics Response Framework (DTARS), identify DDoS/botnets closer the source b) behavioral profiling functions data plane validation control operations, c) advanced correlation, signature, anomaly detection techniques, d) threat analytics system e) scalable agile mitigation mechanisms based stateful-data security-aware SDN stack. We evaluate performance DTARS within three practical MEC case studies: enabled Mobile LTE network, IoT network Software-Defined Datacenter network. In comparison legacy incurs about 60% less overhead than Legacy 40% lesser prior OVS MEC-LTE solution, speed was 10x faster, accuracy 96% at different attack intensities improves overall end-to-end connection management under rapid scaling end users.