Network Function Virtualization Environment Research Articles

Cost-Efficient Cluster Migration of VNFs for Service Function Chain Embedding

Network Function Virtualization (NFV) is a network architecture that separates network functions from dedicated hardware, implementing them as software modules known as Virtual Network Functions (VNFs), which are executed in virtual machines or containers. NFV increases the deployment flexibility and agility within operator networks and reduces the operating and capital expenditures significantly. In NFV, migration of VNFs can significantly reduce the embedding cost. However, stringent latency requirements between VNFs can make them tightly coupled, thus hindering each VNF from being migrated individually, and resulting in poor performance. One of the main challenges in an NFV environment is therefore to migrate a cluster of VNFs to minimize the embedding cost. In this paper, we aim to solve the problem of cluster VNF migration by considering the given inter-VNF latency requirements. We formulate the VNF migration problem as an Integer Linear Programming (ILP) and present two scalable and efficient algorithms for migrating a cluster of VNFs. Through extensive experiments, we show that our proposed algorithms are highly effective. They reduce the total embedding cost by 14% compared to the existing heuristics, while being much more scalable in terms of execution time compared to the brute-force approach.

MiddleNet: A Unified, High-Performance NFV and Middlebox Framework With eBPF and DPDK

Traditional network resident functions (e.g., firewalls, network address translation) and middleboxes (caches, load balancers) have moved from purpose-built appliances to softwarebased components. However, L2/L3 network functions (NFs) are being implemented on Network Function Virtualization (NFV) platforms that extensively exploit kernel-bypass technology. They often use DPDK for zero-copy delivery and high performance. On the other hand, L4/L7 middleboxes, which have a greater emphasis on functionality, take advantage of a full-fledged kernelbased system. L2/L3 NFs and L4/L7 middleboxes continue to be handled by distinct platforms on different nodes. This paper proposes MiddleNet that develops a unified network resident function framework that supports L2/L3 NFs and L4/L7 middleboxes. MiddleNet supports function chains that are essential in both NFV and middlebox environments. MiddleNet uses the Data Plane Development Kit (DPDK) library for zero-copy packet delivery without interrupt-based processing, to enable the ’bumpin-the-wire’ L2/L3 processing performance required of NFV. To support L4/L7 middlebox functionality, MiddleNet utilizes a consolidated, kernel-based protocol stack for processing, avoiding a dedicated protocol stack for each function. MiddleNet fully exploits the event-driven capabilities of the extended Berkeley Packet Filter (eBPF) and seamlessly integrates it with shared memory for high-performance communication in L4/L7 middlebox function chains. The overheads for MiddleNet in L4/L7 are strictly load-proportional, without needing the dedicated CPU cores of DPDK-based approaches. MiddleNet supports flow-dependent packet processing by leveraging Single Root I/O Virtualization (SR-IOV) to dynamically select the packet processing needed (Layers 2 -7). Our experimental results show that MiddleNet achieves high performance in such a unified environment.

Moving Target Defense for the cloud/edge Telco environments

The Internet of Things (IoT) paradigm has been one of the main contributors, in recent years, to the growth in the number of connected equipment. This fact has predominantly contributed to IoT being constrained by the 5th Generation Mobile Network (5G) progress and the promises this technology brings. However, this can be a double-edged sword. On the one hand, it will benefit from those progresses, but on the other, it will also be impacted by any security risk associated with 5G. One of the more serious security problems associated with it is the new wave of virtualization and softwarization of networks and analogous appliances, brought to light by paradigms such as Network Functions Virtualization (NFV) and Multi-access Edge Computing (MEC). Considering these predicaments, we propose a state-of-the-art Moving Target Defense (MTD) approach that defends Cloud-based Network Functions (CNFs) launched within MEC and NFV environments. Furthermore, our mechanism follows the famous Everything as a Service (XaaS) ideology, allowing any CNF provider to use this protection system, working agonistically. In the end, we created a Proof of Concept (PoC) of our proposed methodology, which we then used to conduct an extensive practical security analysis against the multiple phases of the Intrusion Kill Chain. Our final results have proven that our MTD as a Service (MTDaaS) approach can effectively delay and, in some cases, stop an attacker from achieving its objectives when trying to attack a CNF, even if the related vulnerability is a zero-day.

Online and reliable SFC protection scheme of distributed cloud network for future IoT application

The implementation of intelligent device-free sensing (IDFS) necessitates a substantial number of edge IoT devices to extend the service coverage. Prior to deploying these IoT applications on a large scale, a reliable service provision scheme is imperative. In recent years, network function virtualization (NFV) technologies enable fast and convenient service provision by instantiating service function chain (SFC) in the distributed cloud network. However, ensuring resilient service provision is a challenge in NFV environment due to the vulnerability of software-defined network functions. Furthermore, the sequential arrangement of virtual network functions (VNFs) in SFC exacerbates the situation, as the malfunction of any VNFs within the SFC could result in the collapse of the associated service. In this paper, we firstly built a mathematical model for SFC online reliability protection and resource consumption optimization. We then propose a multi-mode VNF backup scheme to guarantee the different reliability requirements for various services. Furthermore, a novel SFC Online Reliability Protection (SORP) scheme is introduced to handle the dynamic SFC requests in distributed cloud network. The simulation results evince the efficacy of the SORP scheme in mitigating service failures and achieving a superior request acceptance ratio, while concurrently reducing average bandwidth consumption, which is particularly noteworthy in high latency scenarios.

Seguridad de la arquitectura virtual de los teléfonos inteligentes basada en la virtualización de funciones de red

One of the most difficult parts of Network Function Virtualization (NFV) installations is security. The NFV environment is a large-scale, software-driven one with a variety of components. Network topologies and traffic flows are continuously and managed to change. Such complexity necessitates a comprehensive security framework that permits automatic and to manage changeable network conditions, a quick response is required with the least amount of manual involvement. This paper introduced many solutions for securing the NFV environment from attacks such as (Specter and DoS) that attack parts of this architecture based on some experiments. Applied NFV on an operating system of smartphones (Android). We tested some attacks on the device and then on some of the layers in the architecture. We obtain new and obvious results, by comparison, to traditional and updated NFV architecture. Also, update the NFV architecture using vCenter/ESX and Hyper-V being two important terms in security After adding the necessary algorithms to protect the NFV architecture, we noticed about 128 hours to hack a 1.4 megabyte (WinRAR) file, while the same file and the same size needed 126 hours to reach the root without the algorithms used to protect the architecture.

NFVLearn: A multi‐resource, long short‐term memory‐based virtual network function resource usage prediction architecture

AbstractVirtual resource load prediction in network function virtualization (NFV) is the subject of intense research due to its crucial role in enabling proactive resource adaptation in dynamic NFV environments whose resource demand constantly changes. Several long short‐term memory (LSTM)‐based approaches have been proposed to forecast the resource load of multiple resource attributes of a virtual network function (VNF) in a service function chain (SFC). In this article, we present NFVLearn, a flexible multivariate, many‐to‐many LSTM‐based model which uses different types of resource load history (CPU, memory, I/O bandwidth) from various VNFs of an SFC to predict future loads of multiple resources of a VNF. We then compare four novel automated input selection frameworks for NFVLearn. Simulations on those frameworks based on graph neural networks, Pearson correlation coefficient, Spearman rank correlation coefficient, and Kendall rank correlation coefficient demonstrate that models using lesser, highly correlated input features retain high prediction root mean squared error accuracy and coefficients of determination scores by leveraging resource attribute inter‐dependencies from the SFC. Those results show that resource attribute interdependency‐based input feature selection frameworks can reduce overhead in the control plane while keeping high accuracy and high fidelity resource load prediction of multiple resource attributes.

Tapping into NFV Environment for Opportunistic Serverless Edge Function Deployment

Even with Network Function Virtualization (NFV), many commodity network servers have spare cycles. Despite that they are small and irregularly occur, spare cycles are fit for deploying short-lived serverless computing functions at the network edge. In this work, we perform detailed analyses of the benefits and limitations of co-locating serverless functions on NFV-ready servers. We propose <i>NEMO</i> , a novel platform that enables efficient serverless edge function deployment in the NFV environment. NEMO can intelligently harvest spare cycles of network functions to warm up the serverless functions and speed up the function invocation in an agile manner. Besides, NEMO can judiciously manage the thread conflict in a resource-limited environment. We build a prototype of NEMO. Our thorough evaluations show that NEMO can harvest up to 41% spare cycles and achieve about 12.5 <inline-formula><tex-math notation="LaTeX">$\sim$</tex-math></inline-formula> 25X performance improvement compared with straightforward co-location.

Service Function Chain Deployment Method Based on Traffic Prediction and Adaptive Virtual Network Function Scaling

With the development of network function virtualization (NFV), the resource management of service function chains (SFC) in the virtualized environment has gradually become a research hotspot. Usually, users hope that they can get the network services they want anytime and anywhere. The network service requests are dynamic and real-time, which requires that the SFC in the NFV environment can also meet the dynamically changing network service requests. In this regard, this paper proposes an SFC deployment method based on traffic prediction and adaptive virtual network function (VNF) scaling. Firstly, an improved network traffic prediction method is proposed to improve its prediction accuracy for dynamically changing network traffic. Secondly, the predicted traffic data is processed for the subsequent scaling of the VNF. Finally, an adaptive VNF scaling method is designed for the purpose of dynamic management of network virtual resources. The experimental results show that the method proposed in this paper can manage the network resources in dynamic scenarios. It can effectively improve the availability of network services, reduce the operating overhead and achieve a good optimization effect.

Misuse Patterns from the Threat of Modification of Non-Control Data in Network Function Virtualization

Network Function Virtualization (NFV) is a virtual network model, the goal of which is a cost-efficient transition of the hardware infrastructure into a flexible and reliable software platform. However, this transition comes at the cost of more security threats. A key part of this virtualization environment is the hypervisor, which emulates the hardware resources to provide a runtime environment for virtual machines (VMs). The hypervisor is considered a major attack vector and must be secured to ensure network service continuity. The virtualization environment contains critical non-control data where compromise could lead to several misuses, including information leakage and privilege and resource modification. In this paper, we present a misuse pattern for an attack that exploits the security vulnerabilities of the hypervisor to compromise the integrity of non-control data in the NFV environment. Misuse patterns are used to describe how attacks are carried out from the attackers’ perspective. The threat of modification of non-control data can lead to several misuses, and in this paper, we discuss three of them. The defenses to this attack can be incorporated into the Security Reference Architecture (SRA) of the NFV system to prevent these misuses.

Distributed LSTM-based cloud resource allocation in Network Function Virtualization Architectures

The high reconfiguration time of cloud resources in Network Function Virtualization environments has led to the proposal of prediction-based resource allocation algorithms, with extensive use of artificial intelligence techniques. The prediction of processing capacities performed jointly and centrally has proved to be very complex due to the high communication overhead required. For this reason, we propose a distributed prediction technique in which Long Short-Term Memory neural networks exchange only a few weights in order to drastically reduce the communication overhead compared to the centralized case. We propose and investigate three different distributed solutions and show how they allow for low prediction errors.

Real-Time Analysis of Multiple Root Causes for Anomalies Assisted by Digital Twin in NFV Environment

Network Function Virtualization (NFV) is a promising paradigm that enables the employment of novel service types with lower deployment cost and faster time-to-value, but it introduces new fault management problems and challenges. In NFV environment, anomalies occurred in virtual machines (VMs) can be caused by faulty components of their hosting servers or anomaly propagation from other ones. If the performance of VMs degrades, we need to find out the root causes accurately, i.e., locate the exact faulty components, to recover the networks as soon as possible. In this paper, we first use digital twin to establish a virtual instance of the physical network to capture the real-time anomaly-fault dependency relationship. When the network environment changes, transfer learning is leveraged to utilize the learned knowledge of dependency relationship in historical periods to avoid huge time and computation cost of learning from scratch. Assisted by the learned dependency relationship, a dynamic set-covering (DSC) based root caused analysis problem is formulated and modeled with a set of parallel hidden Markov models to capture the dynamics of component states, which can best explain the sequence of anomalous VMs. We use alternating direction method of multipliers to decompose the DSC problem into a set of independent sub-problems and solve it in a distributed fashion. Since the state variables of each component in the DSC problem are coupled between any two successive time epochs, each sub-problem is solved by the Viterbi decoding and an incremental function is designed to construct the feasible solution that covers all anomalous VMs. Simulation results show the availability and superiority of the digital-twin assisted root cause analysis algorithm for NFV environment.

Network Services Anomalies in NFV: Survey, Taxonomy, and Verification Methods

Network Function Virtualization (NFV) has emerged as a disruptive networking architecture whose galloping evolution is prompting enterprises to outsource network functions to the cloud and ultimately harvest the fruits of cloud computing, including elasticity, pay-as-you-go billing model, and on-demand services provisioning. However, many reluctant enterprises oppose the benefits of this outsourcing to their critical and pressing concerns about security, trust, and compliance. The latter anticipate possible security and QoS policy violations stemming from dishonest behaviors by cloud providers, attacks by co-resident competitors, misconfiguration by cloud administrators, or implementations flaws by NFV developers. As a result, migrating sensitive workloads to the cloud requires enterprises to first assess risks by gaining knowledge of possible network services’ anomalies and second, to build trust in the cloud by designing effective mechanisms to detect such anomalies. This survey provides scrutiny of network services anomalies that may occur in the NFV environments. We first present a taxonomy of network service anomalies and analyze their negative impacts on critical service attributes, including security and performance. Second, we compare and classify the existing anomalies’ verification mechanisms from the literature. Finally, we point out the literature gap and identify future research directions for anomalies verification in NFV.

Analytical modeling of distributed network functions virtualization architectures and the impact of the distribution on the packet sojourn time

AbstractDistribution of network functions virtualization (NFV) environment on multiple locations and datacenters is a hot topic in research and engineering communities. In this article, we are making analytical models to calculate the network packet sojourn time in three different scenarios: classical NFV environment where all NFV elements are on the same location, distributed architecture of the data plane with centralized management and orchestration (MANO) environment, and distributed environment where every location has its own data plane and MANO elements. The analytical models are tested and discussed through Matlab based simulations. Through the simulation results, we discuss the impact of changes of different parameters on the packet sojourn time, and we compare the architectures in order to see how they can be fitted in practical services provided in an NFV environment.

NFV Anomaly Detection: Case Study through a Security Module

Network function virtualization (NFV) is a key networking concept whose benefits include scalability, flexibility, and cost-effective service provisioning. In NFV, service function chains (SFCs) adaptable to customers' needs are created by chaining virtualized network functions (VNFs). VNFs and SFCs are sensitive elements that, if compromised, would affect network security. The detection of compromised VNFs and SFCs is imperative, and although anomaly detection can be used in such a context, there is a lack of research work on the use of anomaly detection in NFV. In this article, we exploit the use of anomaly detection mechanisms to identify suspicious VNFs and SFCs. We introduce, into a widely accepted NFV architecture, an NFV security module (NSM) that, by analyzing VNFs and SFCs' operations, detects anomalies possibly resulting from security attacks. To prove the concept, three mechanisms have been implemented and deployed in NSM to observe how anomaly detection performs, given quantitative and qualitative information. We found out that anomaly detection is effective for VNF and SFC security and, in the case of using entropy as anomaly detection technique, it presents accuracy of up to 98 percent without harming NFV environment operations.

Heuristic Strategy of Service Function Chain Deployment Based on N-Base Continuous Digital Coding in Network Function Virtualization Environment

As a novel network architecture, network function virtualization (NFV) greatly improves the flexibility and scalability of service provision. Deploying the service function chain (SFC) in an NFV environment needs to coordinate the instantiation of the virtual network function descriptor, network function embedding, and traffic steering, which also improves the complexity of the problem. Although heuristic algorithms are widely used to optimize this problem, due to the lack of complete SFC deployment solution space and digital coding scheme, the time complexity of the algorithm is difficult to meet the requirements. Therefore, this paper studies the digital coding scheme of the heuristic SFC deployment to improve time efficiency without reducing performance. Firstly, we model the SFC deployment as a 0–1 integer linear programming, considering the above factors, and then design a continuous digital solution space construction scheme based on N-Base coding (NBACO-SS) to optimize the above problems. NBACO-SS uses integer size and carry to map the complex SFC deployment to simple digital coding, evaluates the continuity of solution space through the Manhattan distance, and optimizes the continuity through the ant colony algorithm. Based on NBACO-SS, we reconstruct two heuristic algorithms to solve the SFC deployment problem. Experimental results demonstrate that NBACO-SS can improve the time efficiency by 20% without reducing the total network service traffic.

A Dynamic Adjustment Method of Service Function Chain Resource Configuration

In the network function virtualization environment, dynamic changes in network traffic will lead to the dynamic changes of service function chain resource demand, which entails timely dynamic adjustment of service function chain resource configuration. At present, most researches solve this problem through virtual network function migration and link rerouting, and there exist some problems such as long service interruption time, excessive network operation cost and high penalty. This paper proposes a dynamic adjustment method of service function chain resource configuration for the dynamic changes of network traffic. First, a dynamic adjustment request of service function chain is generated according to the prediction of network traffic. Second, a dynamic adjustment strategy of service function chain resource configuration is determined according to substrate network resources. Finally, the resource configuration of a service function chain is pre-adjusted according to the dynamic adjustment strategy. Virtual network functions combination and virtual machine reusing are fully considered in this process. The experimental results show that this method can reduce the influence of service function chain resource configuration dynamic adjustment on quality of service, reduce network operation cost and improve the revenue of service providers.

Distributed denial‐of‐service attack mitigation in network functions virtualization‐based 5G networks using management and orchestration

SummaryThe fifth generation (5G) technology is expected to allow connectivity to billions of devices, known as Internet of Things (IoT). However, IoT devices will inevitably be the main target of various cyberattack types. The most common one is known as distributed denial‐of‐service (DDoS) attack. In order to mitigate such attacks, network functions virtualization (NFV) has a great potential to provide the benefit of elasticity and low‐cost solutions for protecting 5G networks. In this context, this study proposes a new mechanism developed to mitigate DDoS attacks in 5G NFV networks. The proposed mechanism utilizes intrusion prevention system's (IPS) virtual machines (VMs) to intercept the queries. Based on the volume of DDoS traffic, IPS's VMs are dynamically deployed by means of management and orchestration (MANO) in order to balance the load. To evaluate the effectiveness of the mechanism, experiments are conducted in a real 5G NFV environment built by using 5G NFV environment tools. To our best knowledge, this is the first time that NFV‐based mechanism is experimentally tested in a real 5G NFV environment for mitigating DDoS attacks in 5G networks. The experimental results verify that the proposed mechanism can mitigate DDoS attacks effectively.

Application of a Long Short Term Memory neural predictor with asymmetric loss function for the resource allocation in NFV network architectures

Traffic and cloud resource prediction methodologies have been recently used in Network Function Virtualization environment for cloud and bandwidth resource allocation purposes. Both traditional and innovative prediction methodologies have been proposed for the application of allocation procedures. For instance Long Short Term Memory-based prediction techniques have been shown to be very effectiveness to allocate the resources. All of these techniques are based on the minimization of a symmetric cost function as the Root Mean Square Error that equally weights positive and negative prediction errors. However the error sign can differently impact the cost increase due to prediction errors. For instance when the Quality of Service degradation cost due to traffic loss is prevalent with respect to the cloud resource allocation cost, an algorithm is preferable that overestimates the offered traffic; conversely the traffic underestimation is preferable in the opposite case when the cloud allocation cost is higher than the QoS degradation one. For this reason we propose an Asymmetric LSTM traffic prediction procedure in which the cost function is defined so as to take into account both the QoS degradation and cloud resource allocation costs. In a typical network and traffic scenario, we show how the proposed solution allows for cost decrease by 40% with respect to classical LSTM prediction methodology based on the Root Mean Square Error.

Classification of network traffic using supervised machine learning algorithms within NFV environment

Deep Packet Inspection (DPI) of the network traffic is used on a regular basis within the traditional and virtualized environments. But changes in the network architecture with the introduction of containers, microservices, application functions, network functions, and the penetration of 5G access technology are adding more traffic complexity, especially in the so-called east-west flow direction. Network Functions Virtualization (NFV) has become an unavoidable step for further IP network development. In this context, DPI is becoming a challenge. Furthermore, the penetration of 5G allows access of various kinds of devices to the network with cloudification logic which drives them. This paper provides a performance analysis of a selected set of supervised machine learning (ML) algorithms for classification of network traffic within an NFV environment. The goal is to find a suitable algorithm that will classify the traffic from a point of both precision and speed, especially because in the 5G networks any packet delay may compromise the quality of service requirements. The research shows that out of the 6 algorithms tested, Decision Tree algorithm has the best overall performance, from both classification precision and time consumption point of view. It has proved as a reliable classifier that is performing evenly across different classes. Due to the specifics of the virtualized environments and encryption methods, payload data, source, destination, and port information of the network traffic packets are excluded from any statistical operation used for classification by the ML algorithms.

Reliability-Aware Service Function Chain Backup Protection Method

Network Function Virtualization (NFV) decouples network functions from hardware, improves the flexibility of resource allocation, and enhances network scalability. Any failures of software and hardware in an NFV environment will result in the interruption of Service Function Chains (SFCs). As one of the key technologies of 5G, NFV has more stringent delay and reliability requirements for services. This paper takes software and hardware failures into account, and proposes a reliability-aware service function chain backup protection (RABP) method to meet SFCs' high reliability and low latency demands. First, we formulate a mixed-integer linear programming model to maximize the revenue-to-cost ratio. Then, we propose a heuristic algorithm for suboptimal solutions. SFC deployment is divided into two stages: primary virtual network function (VNF) deployment and backup VNF deployment. The reliability enhancement and delay optimization deployment method is presented to deploy primary VNFs. A breadth-first search method is used to consolidate primary VNFs as much as possible to improve reliability of SFCs and reduce transmission delay. When deploying backup VNFs, a resource-efficient backup selection method is presented to reduce backup resource consumption while meeting reliability demands. Finally, experiment results show that the proposed RABP method not only has the best acceptance ratio and long-term average revenue to cost ratio, but also reduces backup resource consumption and transmission delay.