A Comprehensive Guide to 5G Security, First Edition. Edited by Madhusanka Liyanage, Ijaz Ahmad,
Ahmed Bux Abro, Andrei Gurtov, and Mika Ylianttila.
© 2018 John Wiley & Sons Ltd. Published 2018 by John Wiley & Sons Ltd.
231
10
10.1 Introduction
Network monitoring is a crucial network management enabler for mobile networks. Its
importance is growing with the continuous growth of network traffic and the adoption
of virtualization. A monitoring system gathers network statistics, traffic, application
and user profiles, and flow samples at various intervals and granularities to evaluate the
status of the network for different management tasks such as application identification,
anomaly detection, network forensics, load balancing, traffic engineering, enforcing
Service Level Agreements (SLA), QoS/QoE and network maintenance. Therefore, a
network monitoring system should be capable of monitoring the network and traffic
flows at different granularities and for obtaining measureable metrics such as level of
aggregation, time intervals, bandwidth utilization and accuracy.
Traditionally, network monitoring systems are deployed at specific locations of the
mobile network to monitor data at network boundaries or ingress or egress ports.
Similarly, many of the currently used security monitoring systems rely on physical systems and interfaces. However, mobile networks are evolving and so also is the complexity in network management and security, hence, the monitoring systems used today
wont be able to support the dynamically changing topologies and increasing varieties of
new technologies such as cloud networks and virtual environments. These challenges
are exacerbated for wireless networks since the radio channels are open to jamming
attacks, and the access networks are prone to disruption on critical links, MAC abuse
and flooding attacks [1].
One of the key transformations in 5G network is the use of two new concepts:
Network Functions Virtualization (NFV) and the Software Defined Networks (SDN)
[2–4]. SDN decouples the network control from the data‐forwarding devices and enable
programmability by introducing programmable interface into their networking equipment. The control plane is centralized in high‐end servers with the capability of
Software Defined Security Monitoring in 5G Networks
Madhusanka Liyanage
1
, Ijaz Ahmad
1
, Jude Okwuibe
1
, Edgardo Montes de
Oca
2
, Hoang Long MAI
2
, Oscar López Perez
3
, and Mikel Uriarte Itzazelaia
3
1 Centre for Wireless Communication, University of Oulu, Oulu, Finland
2 Montimage, Paris, France
3 Nextel S.A., Bilbao, Spain
Ahmed Bux Abro, Andrei Gurtov, and Mika Ylianttila.
© 2018 John Wiley & Sons Ltd. Published 2018 by John Wiley & Sons Ltd.
231
10
10.1 Introduction
Network monitoring is a crucial network management enabler for mobile networks. Its
importance is growing with the continuous growth of network traffic and the adoption
of virtualization. A monitoring system gathers network statistics, traffic, application
and user profiles, and flow samples at various intervals and granularities to evaluate the
status of the network for different management tasks such as application identification,
anomaly detection, network forensics, load balancing, traffic engineering, enforcing
Service Level Agreements (SLA), QoS/QoE and network maintenance. Therefore, a
network monitoring system should be capable of monitoring the network and traffic
flows at different granularities and for obtaining measureable metrics such as level of
aggregation, time intervals, bandwidth utilization and accuracy.
Traditionally, network monitoring systems are deployed at specific locations of the
mobile network to monitor data at network boundaries or ingress or egress ports.
Similarly, many of the currently used security monitoring systems rely on physical systems and interfaces. However, mobile networks are evolving and so also is the complexity in network management and security, hence, the monitoring systems used today
wont be able to support the dynamically changing topologies and increasing varieties of
new technologies such as cloud networks and virtual environments. These challenges
are exacerbated for wireless networks since the radio channels are open to jamming
attacks, and the access networks are prone to disruption on critical links, MAC abuse
and flooding attacks [1].
One of the key transformations in 5G network is the use of two new concepts:
Network Functions Virtualization (NFV) and the Software Defined Networks (SDN)
[2–4]. SDN decouples the network control from the data‐forwarding devices and enable
programmability by introducing programmable interface into their networking equipment. The control plane is centralized in high‐end servers with the capability of
Software Defined Security Monitoring in 5G Networks
Madhusanka Liyanage
1
, Ijaz Ahmad
1
, Jude Okwuibe
1
, Edgardo Montes de
Oca
2
, Hoang Long MAI
2
, Oscar López Perez
3
, and Mikel Uriarte Itzazelaia
3
1 Centre for Wireless Communication, University of Oulu, Oulu, Finland
2 Montimage, Paris, France
3 Nextel S.A., Bilbao, Spain