Network Function Virtualization Research Articles

Distributed service function chaining in NFV-enabled networks: A game-theoretic learning approach

In network function virtualization (NFV), Service Function Chaining (SFC) provides an ordered sequence of virtual network functions (VNFs) and subsequent steering of traffic flows through them to cater to end-to-end services. This paper addresses the NP-hard problem of minimum cost SFC deployment to support customer services that access the carrier network’s NFV infrastructure (NFVI) through some edge routers. To determine the mappings of VNFs to physical servers, a challenging aspect would be the inter-server latencies that may fluctuate over time because of the sharing nature of cloud data centers. To construct the SFC, we come up with three different formulations, each corresponding to a different informational assumption about the link latencies: First, a centralized integer linear programming (ILP) formulation is given under the assumption of the non-causal availability of exact and instantaneous inter-server latencies. The solution to this ILP can serve as a lower bound to benchmark more scalable and realistic schemes. Next, we give a distributed game-theoretic formulation (with service broker agents as players) which only requires the statistical knowledge of link latency fluctuations. The game provably admits a pure Nash equilibrium (NE) and can be solved iteratively through the well-known best response dynamics (BRD) algorithm. Our main novelty lies in the third formulation in which each service broker has neither instantaneous nor statistical knowledge of the latencies. Instead, it relies on a game-theoretic learning algorithm to compose its VNF chain only based on its own history of adopted decisions and experienced delays on each logical link. We prove that the proposed learning algorithm asymptotically converges to NE and evaluate its performance through simulations in terms of convergence and the impact of network parameters.

Dynamic and efficient resource allocation for 5G end‐to‐end network slicing: A multi‐agent deep reinforcement learning approach

SummaryThe rapid evolution of user equipment (UE) and 5G networks drives significant transformations, bringing technology closer to end‐users. Managing resources in densely crowded areas such as airports, train stations, and bus terminals poses challenges due to diverse user demands. Integrating mobile edge computing (MEC) and network function virtualization (NFV) becomes vital when the service provider's (SP) primary goal is maximizing profitability while maintaining service level agreement (SLA). Considering these challenges, our study addresses an online resource allocation problem in an MEC network where computing resources are limited, and the SP aims to boost profit by securely admitting more UE requests at each time slot. Each UE request arrival rate is unknown, and the requirement is specific resources with minimum cost and delay. The optimization problem objective is achieved by allocating resources to requests at the MEC network in appropriate cloudlets, utilizing abandoned instances, reutilizing idle and soft slice instances to shorten delay and reduce costs, and immediately scaling inappropriate instances, thus minimizing the instantiation of new instances. This paper proposes a deep reinforcement learning (DRL) method for request prediction and resource allocation to mitigate unnecessary resource waste. Simulation results demonstrate that the proposed approach effectively accepts network slice requests to maximize profit by leveraging resource availability, reutilizing instantiated resources, and upholding goodwill and SLA. Through extensive simulations, we show that our proposed DRL‐based approach outperforms other state‐of‐the‐art techniques, namely, MaxSR, DQN, and DDPG, by 76%, 33%, and 23%, respectively.

IKern: Advanced Intrusion Detection and Prevention at the Kernel Level Using eBPF

The development of new technologies has significantly enhanced the monitoring and analysis of network traffic. Modern solutions like the Extended Berkeley Packet Filter (eBPF) demonstrate a clear advancement over traditional techniques, allowing for more customized and efficient filtering. These technologies are crucial for influencing system performance as they operate at the lowest layer of the operating system, such as the kernel. Network-based Intrusion Detection/Prevention Systems (IDPS), including Snort, Suricata, and Bro, passively monitor network traffic from terminal access points. However, most IDPS are signature-based and face challenges on large networks, where the drop rate increases due to limitations in capturing and processing packets. High throughput leads to overheads, causing IDPS buffers to drop packets, which can pose serious threats to network security. Typically, IDPS are targeted by volumetric and multi-vector attacks that overload the network beyond the reception and processing capacity of IDPS, resulting in packet loss due to buffer overflows. To address this issue, the proposed solution, iKern, utilizes eBPF and Virtual Network Functions (VNF) to examine and filter packets at the kernel level before forwarding them to user space. Packet stream inspection is performed within the iKern Engine at the kernel level to detect and mitigate volumetric floods and multi-vector attacks. The iKern detection engine, operating within the Linux kernel, is powered by eBPF bytecode injected from user space. This system effectively handles volumetric Distributed Denial of Service (DDoS) attacks. Real-time implementation of this scheme has been tested on a 1Gbps network and shows significant detection and reduction capabilities against volumetric and multi-vector floods.

The 5G Era: A Comprehensive Review of Recent Advancements and Applications

The fifth generation is a promising and transformative leap in network capabilities, bringing out applications beyond traditional technologies. This review paper discusses the novel technologies shaping 5G, studying their impact and potential. We explore technological advancements like Network Function Virtualization (NFV) and Software- Defined Networking (SDN) for their role in creating flexible and efficient networks. Services like Enhanced Mobile Broadband (eMBB), Ultra-Reliable Low-Latency Communication (uRLLC), and Massive Machine-Type Communication (mMTC) are also examined, along with their details, and role in shaping the benefits of 5G for various fields. This paper also investigates how 5G addresses the aspects like energy efficiency enhancements and network security enhancements brought about in 5G. We discuss the details of integration of Artificial Intelligence (AI) for network optimization, security, automation and user experience, along with its impact in various domains like healthcare, manufacturing, education and transportation. Further, the paper explores the incorporation of edge computing and its role in supporting real-time applications. Finally, we examine the growing importance of Non-Public Networks (NPNs) tailored for private use cases, another aspect that adds to the benefits and novelty of the fifth generation. This review provides a comprehensive overview of the key technological advancements driving the 5G revolution, highlighting their role in transforming communication infrastructures and other key use cases, supporting a new era of communication.

Optimization Algorithms in SDN: Routing, Load Balancing, and Delay Optimization

Software-Defined Networking is today a mature technology, which is developed in many networks and also embedded in novel architectures like 5G and 6G. The SDN control centralization concept brings significant advantages for management and control in SDN together with the programmability of the data plane. SDN represents a paradigm shift towards agile, efficient, and secure network infrastructures, moving away from traditional, hardware-centric models to embrace dynamic, software-driven paradigms. SDN is compliant also with the virtualization architecture defined in the Network Function Virtualization framework. However, SDN should cooperate seamlessly for some years with the distributed TCP/IP control developed during the years all over the world. Among others, the traditional tasks of routing, forwarding, load balancing, QoS assurance, security, and privacy should be solved. The SDN native centralization brings also some new challenges and problems which are different from the traditional distributed control IP networks. The algorithms and protocols usable in SDN should meet requirements like scalability, convergence, redundancy assurance, sustainability, and good real-time response, and allow orchestrated automation in enhancing network resilience and adaptability. This work presents a theoretical review of state-of-the-art SDN optimization techniques, offering a critical and comparative discussion of various algorithms having tasks such as routing (including dynamic ones), forwarding, load balancing and traffic optimization, and forwarding delay minimization. Attention is pointed to general algorithms which can offer pragmatic solutions for large systems or multiple metric routing.

Efficient SFC Protection Method against Network Attack Risks in Air Traffic Information Networks

With the continuous development of the civil aviation industry toward digitalization and intelligence, the closed architecture of traditional air traffic information networks struggles to meet the rapidly growing demands for air traffic services. Network function virtualization (NFV) is one of the key technologies that can address the rigidity of traditional air traffic information networks. NFV technology has facilitated the flexible deployment of air traffic services, but it has also expanded the attack surface of the network. In addressing the network attack risks faced by service function chains (SFCs) in NFV environments, a SFC protection method based on honeypots and backup technology (PBHB) is proposed to reduce the resource cost of protecting air traffic information networks while enhancing network security. Initially, PBHB utilizes the TAPD algorithm to deploy the primary VNFs as closely as possible to the shortest path between the source and destination endpoints, thus aiming to reduce SFC latency and save bandwidth resource costs. Subsequently, the RAHDR algorithm is employed to install honeypot VNFs in each physical platform that is at risk of side-channel attacks, thus updating the deployment status of honeypot VNFs in real time based on the VNF lifecycle in order to offer primary protection for SFCs. Lastly, the BDMPE algorithm was used to calculate the backup scheme with the highest protection efficiency to implement secondary protection for the SFCs that still do not meet the security requirements. Through experiments, the maximum backup limit for SFCs in PBHB was determined, confirming its satisfactory performance across various SFC arrival rates. Furthermore, performance comparisons with other SFC protection methods revealed that PBHB achieves optimizations in resources cost while ensuring SFC security and latency.

Cloud Network Function Virtualization (NFV)

Cloud Network Function Virtualization (NFV) is a groundbreaking technology that revolutionizes the way network services are delivered. By virtualizing network functions, NFV enables faster deployment, scalability, and management of network services. This article explores the benefits and use cases of NFV, including virtualized load balancers, firewalls, and intrusion detection devices. We also discuss the evolution of NFV to Cloud-Native Network Functions (CNF) and the challenges and solutions associated with NFV adoption. Discover how Cloud NFV is transforming network architecture and enabling organizations to achieve greater agility, flexibility, and cost savings.

Design and Implementation of Lightweight Certificateless Secure Communication Scheme on Industrial NFV-Based IPv6 Virtual Networks

With the fast growth of the Industrial Internet of Everything (IIoE), computing and telecommunication industries all over the world are moving rapidly towards the IPv6 address architecture, which supports virtualization architectures such as Network Function Virtualization (NFV). NFV provides networking services like routing, security, storage, etc., through software-based virtual machines. As a result, NFV reduces equipment costs. Due to the increase in applications on Industrial Internet of Things (IoT)-based networks, security threats have also increased. The communication links between people and people or from one machine to another machine are insecure. Usually, critical data are exchanged over the IoE, so authentication and confidentiality are significant concerns. Asymmetric key cryptosystems increase computation and communication overheads. This paper proposes a lightweight and certificateless end-to-end secure communication scheme to provide security services against replay attacks, man-in-the-middle (MITM) attacks, and impersonation attacks with low computation and communication overheads. The system is implemented on Linux-based Lubuntu 20.04 virtual machines using Java programming connected to NFV-based large-scale hybrid IPv4-IPv6 virtual networks. Finally, we compare the performance of our proposed security scheme with existing schemes based on the computation and communication costs. In addition, we measure and analyze the performance of our proposed secure communication scheme over NFV-based virtualized networks with regard to several parameters like end-to-end delay and packet loss. The results of our comparison with existing security schemes show that our proposed security scheme reduces the computation cost by 38.87% and the communication cost by 26.08%.

Accelerator: an intent-based intelligent resource-slicing scheme for SFC-based 6G application execution over SDN- and NFV-empowered zero-touch network

Zero-touch networks (ZTNs) can provide autonomous network solutions by integrating software-based solutions for various emerging 5G and 6G applications. The current literature does not provide any suitable end-to-end network management and resource-slicing solutions for service function chaining (SFC) and user intent–based (time and cost preference) 6G/non-6G application execution over ZTNs enabled by mobile edge computing, network function virtualization, and software-defined networking. To tackle these challenges, this work initiates an end-to-end network management and user intent–aware intelligent network resource–slicing scheme for SFC-based 6G/non-6G application execution over ZTNs, taking into account various virtual and physical resources, task workloads, service requirements, and task numbers. The results depicted that at least 25.27% average task implementation delay gain, 6.15% energy gain, and 11.52% service monetary gain are realized in the proposed scheme over the compared schemes.

Research on reliability mapping of 5G low orbit constellation network slice based on deep reinforcement learning

Reliability mapping of 5G low orbit constellation network slice is an important means to ensure link network communication. The problem of state space explosion is a typical problem. The deep reinforcement learning method is introduced. Under the 5G low orbit constellation integrated network architecture based on software definition network (SDN) and network function virtualization (NFV), the resource requirements and resource constraints of the virtual network function (VNF) are comprehensively considered to build the 5G low orbit constellation network slice reliability mapping model, and the reliability mapping model parameters are trained and learned by using deep reinforcement learning, solve the problem of state space explosion in the reliability mapping process of 5G low orbit constellation network slices. In addition, node backup and link backup strategies based on importance are adopted to solve the problem that VNF/link reliability is difficult to meet in the reliability mapping process of 5G low orbit constellation network slice. The experimental results show that this method improves the network throughput, packet loss rate and intra slice traffic of 5G low orbit constellation, and can completely repair network faults within 0.3 s; For different number of 5G low orbit constellation network slicing requests, the reliability of this method remains above 98%; For SFC with different lengths, the average network delay of this method is less than 0.15 s.

Online Multi-Resource Allocation for Network Slicing in 5G with Distributed Algorithms

With the increasing scale of mobile cellular network applications, 5G mobile network infrastructure provides customizable services to users in the form of network slices. How to effectively allocate existing resources in real dynamic networks with time-varying network utility is a key issue that previous work did not consider. This paper first initializes the multi-resource allocation problem of network slicing in an online manner, where the utility function is set to change over time. Therefore, we propose Metis, an online network slicing resource allocation framework that combines the time-varying nature of the network utility function given bandwidth and processing power constraints with the requirement of virtual network function isolation. The goal is to maximize the cumulative network utility in the long term and specify multiple resource allocation problems by utilizing concave optimization methods. In addition, a distributed algorithm based on the online alternating direction method of multipliers with regret optimization has been developed to achieve optimal resource allocation. Our mathematical analysis proves that Metis can provably converge to the optimal solution and the result of experiments demonstrates a steady state behavior of Metis, which converges in dynamic network settings.

DRL approach for online user-centric QoS-Aware SFC embedding with dynamic VNF placement

In this paper, we tackle online Service Function Chaining (SFC) embedding issue in Software Defined Network (SDN)/Network Function Virtualization (NFV) enabled networks using Deep Reinforcement Learning (DRL) approach. This approach investigates the problem of Quality of Experience (QoE)/Quality of Service (QoS) driven SFC embedding with dynamic Virtual Network Functions (VNF) placement. We particularly focus on video streaming traffic requiring a given Mean Opinion Score (MOS) quantified in terms of QoE. In this regard, we propose a DRL algorithm based on Deep-Q-Network (DQN) (named DQN_QoE/QoS_SFC algorithm) implementing an optimization problem maximizing QoE while meeting QoS requirements. Our algorithm named DQN_QoE/QoS_SFC improves previous work given in Chen et al. (2018) dealing with the same issue through bringing performance evaluation of the training phase by testing the learning quality. This is achieved through using a QoE Threshold Score (QoETh−Sc) to be attained on average by the DQN_QoE/QoS_SFC agent along the last 100 runs of the training phase while maximizing the expected cumulative reward. We conduct simulation experiments through two performance metrics related to the SFC request namely QoE (QoE) and Rejection Ratio (RR). We investigate also how these metrics evolve for the proposed algorithm when compared with two standard baseline algorithms (Violent search, Random search) during learning phase to achieve satisfactory training quality. We highlight how DQN_QoE/QoS_SFC algorithm behaves along the training process and how it attempts reaching a near-optimal solution as closer as possible to the optimal solution provided by Violent search algorithm.

Caught-in-Translation (CiT): Detecting Cross-Level Inconsistency Attacks in Network Functions Virtualization (NFV)

Caught-in-Translation (CiT): Detecting Cross-Level Inconsistency Attacks in Network Functions Virtualization (NFV)

An instrumentation amplifier with series switch pseudo resistor DC-servo loop realizing 0.16-Hz high-pass corner

This paper presents an instrumentation amplifier for electrocardiogram (ECG) signal recording. A DC servo loop (DSL) based on a series-switch pseudo resistor (S2PR ) is utilized to suppress the effect of the unavoidable electrode DC offset effectively. The two-step pulse generation circuit realizes two sets of pulse signals with shallow duty cycles, and the pulse signals drive the path switches and virtual switches in the S2PR, respectively. Virtual switches reduce the channel charge injection effect, and finally, a great equivalent resistance with high linearity is realized. The continuous DSL realized based on S2PR can suppress the electrode DC offset of ±180 mV. At the same time, the active area of the DSL is significantly reduced. The proposed instrumentation amplifier is realized in a standard 0.18-μm CMOS process. Simulation results show the DSL designed with a 1.8-V supply introduces a 0.16-Hz high-pass corner. The power consumption of the S2PR-DSL is 92.7 μW. The gain of the instrumentation amplifier is 39.8 dB, and the input-referred noise at the TT corner is 1.78 μVrms over a bandwidth of 0.5 Hz to 150 Hz. The input impedance of the instrumentation amplifier is 772.2 MΩ, when the input signal frequency is 50 Hz, and the total harmonic distortion (THD) of a 10-mVpp input sinusoidal signal at 9.033 Hz is −61.6 dB.

Handling Efficient VNF Placement with Graph-Based Reinforcement Learning for SFC Fault Tolerance

Network functions virtualization (NFV) has become the platform for decomposing the sequence of virtual network functions (VNFs), which can be grouped as a forwarding graph of service function chaining (SFC) to serve multi-service slice requirements. NFV-enabled SFC consists of several challenges in reaching the reliability and efficiency of key performance indicators (KPIs) in management and orchestration (MANO) decision-making control. The problem of SFC fault tolerance is one of the most critical challenges for provisioning service requests, and it needs resource availability. In this article, we proposed graph neural network (GNN)-based deep reinforcement learning (DRL) to enhance SFC fault tolerance (GRL-SFT), which targets the chain graph representation, long-term approximation, and self-organizing service orchestration for future massive Internet of Everything applications. We formulate the problem as the Markov decision process (MDP). DRL seeks to maximize the cumulative rewards by maximizing the service request acceptance ratios and minimizing the average completion delays. The proposed model solves the VNF management problem in a short time and configures the node allocation reliably for real-time restoration. Our simulation result demonstrates the effectiveness of the proposed scheme and indicates better performance in terms of total rewards, delays, acceptances, failures, and restoration ratios in different network topologies compared to reference schemes.

Constrained routing in multi-partite graph to solve VNF placement and chaining problem

Network Functions Virtualization (NFV) and Software-Defined Networks (SDN) empower IT professionals and service providers to strategically deploy Virtual Network Functions (VNFs), resulting in enhanced services and security while minimizing costs. Network services are dynamically provided through the deployment of Service Function Chains (SFCs), which involve selecting and interconnecting physical or virtual servers hosting VNFs.In this paper, we address the online VNF placement and chaining (VNF-PC) problem, aiming to optimize the overall cost while satisfying the resource constraints. We begin by proving the NP-completeness of finding feasible solutions for both fixed-size NFV infrastructures and constant-size SFCs. Subsequently, we formulate the VNF-PC problem using Integer Linear Programming (ILP), which is adept at handling and solving small-scale instances of the problem. However, the efficiency of ILP hinges on the quality and quantity of precomputed paths, a factor that escalates rapidly with the expansion of NFV infrastructure size. To tackle scalability, we initially suggest resource homogenization using a novel multi-partite graph, followed by the introduction of the Constrained Shortest Path-based Heuristic in multi-Partite Graph (CSPH-PG) to solve the VNF-PC problem in polynomial time. Our heuristic focuses on promising solution areas by restricting the exploration to the K shortest paths that meet the constraints at each node, with K acting as a fixed parameter of our heuristic.Extensive simulations demonstrate that our heuristic rapidly converges towards optimal solutions, even with small values of the parameter K.

Blockchain-Based Security Framework for VNF Package Protection in 5G Network Slicing Services

Abstract The demand for scalable, open and granular networks has enabled mobile networks such as 5G to adopt new concepts including NFV (Network Function Virtualization). NFV separates the dependency of network functions from the hardware component, allowing them to be deployed flexibly and dynamically across network slices. In this way, operators can deliver personalized services and optimize the use of network resources, contributing to greater operational efficiency and an enhanced end-user experience. However, there are several issues to be addressed, such as the security of VNFs and the way in which service provider customers instantiate NSSIs (Network Slice Subnet Instance). In this article, we present a new approach based on blockchain 2.0, which guarantees the immutability of VNFs and templates, as well as highly secure instantiation with access management and support for replay attacks.

A comparative analysis of two‐stage approaches for embedding network function virtualization enabled multicast services

A comparative analysis of two‐stage approaches for embedding network function virtualization enabled multicast services

Post-fault restoration of service function chains in fog networks

The network function virtualization (NFV) paradigm is rapidly being adopted by enterprises and service providers as an alternative to proprietary hardware. It enables virtual network functions (VNFs) to be embedded on commercial edge servers for the delivery of highly-specialized service function chains (SFCs). Here embedding SFC requests on fog computing supports clients with stringent delay requirements and contextual service requirements. Now one of the major challenges is the survivability of embedded service chains in fog computing, which may be compromised due to node, link, and application failures. These failures can disrupt service continuity and degrade the quality-of-service. Therefore, there is a demand for SFC provisioning to be more resilient, incorporating rapid restoration techniques that oppose proactive solutions that reserve backup paths, subsequently compromising network capacity. Hence, this paper presents heuristic methods for post-fault SFC restorations due to multiple failures in fog computing. These methods establish post-provisioning restoration for failed requests, known as end-to-end (E2E) and intermediate (IM) restoration, that aim to restore paths with the least delay and cost.

Mobility-aware SFC migration in dynamic 5G-Edge networks

The fifth-generation mobile networks bring an evolution in the development of novel classes of applications, increasing the demand for performance and flexibility to support new classes of services. Edge Computing and Network Function Virtualization are two key technologies that bring data processing closer to the user and allow the replacement of traditional hardware-based network functions with virtualized counterparts, which reduces costs and permits the provision of low-latency services. In this scenario, services are often implemented as a Service Function Chain (SFC), consisting of a set of ordered Virtual Network Functions (VNFs) that provide the required service functionality. During service execution, users can move from one location to another, which impacts service performance. An approach to reduce the impact of user mobility is to migrate services as users move to different places. However, the SFC migration problem imposes several challenges that require complex decision-making. VNFs should be migrated to nodes that have the necessary resources to execute the VNF instances. Also, the migration should be fast and effective, using as few resources as possible to reduce migration costs. In this paper, we propose a proactive and iterative SFC migration strategy to address the performance impact caused by user mobility. Our proposed solution anticipates the movement of users and estimates the impact of their mobility on service delay, proactively triggering service migrations when needed. The proposed algorithm decides which VNFs of the SFC should be migrated and which compute nodes will host the migrating VNFs, fulfilling service, resource, and migration constraints while maintaining a low migration overhead. Our algorithm also considers the dynamic nature of the edge environment in which other SFC placement and migrations might be occurring when an SFC is being migrated, which also introduces new challenges related to the availability and concurrency of resources required for migration.