NFV and NFV-based Security Services 369
● Policy
“Certain software images are not allowed to run in the DMZ. ”
● Enforcement
“If such an image is found running in the DMZ, pause the VM to stop such violation. ”
● Congress policy specification in Datalog
dmz_server(x) :nova:servers(id = x,status = ’ACTIVE’),
neutronv2:ports(id, device_id, status = ’ACTIVE’),
neutronv2:security_group_port_bindings(id, sg),
neutronv2:security_groups(sg,name = ’dmz’)
dmz_placement_error(id) :nova:servers(id,name,hostId,status,tenant_id,user_id,
image,flavor,az,hh),
not glancev2:tags(image,'dmz'),
dmz_server(id)
execute[nova:servers.pause(id)] :dmz_placement_error(id),
nova:servers(id,status = ’ACTIVE’)
15.7.3 Machine Learning for NFV‐based Security Services
Policy‐based approaches tend to favor deductive reasoning by building models of reality
and analyzing the models based on logical rules. As we know, this approach has its
limits and does not work well in complex, dynamic and large systems by itself. An alternative way is to find truth from observation data and inductive reasoning.
Machine learning (ML) and Big Data have made rapid advancements and have had a
huge impact on many problems that IT and CT industries face. It is not new that ML
has played a large part in security – both on the positive side in protecting business
systems and user privacy, and on the negative side as in hacking or unwanted surveillance. It is out of the scope of this short discussion to go into the general picture of
ML applications in security and many of the envisioned 5G use cases. We will briefly
touch upon several promising areas where ML can help NFV‐based systems to better
perform and protect [38,39].
● Autonomous Operations
Within an abstracted and service API‐oriented system, ML can use collected real‐time
data to fine‐tune optimization parameters of the overall resource management scheme.
It is also promising that the ML system will be able to adapt to load spikes (e.g. during a
DDoS attack) with autonomous responses by learning from long‐term operational data
collected from human expert operators. As we have reviewed throughout this chapter,
NFV has made the system highly automatable and also made consistent real‐time data
readily available. In [38], we call such a highly autonomous system a Sentient Network.
● Policy
“Certain software images are not allowed to run in the DMZ. ”
● Enforcement
“If such an image is found running in the DMZ, pause the VM to stop such violation. ”
● Congress policy specification in Datalog
dmz_server(x) :nova:servers(id = x,status = ’ACTIVE’),
neutronv2:ports(id, device_id, status = ’ACTIVE’),
neutronv2:security_group_port_bindings(id, sg),
neutronv2:security_groups(sg,name = ’dmz’)
dmz_placement_error(id) :nova:servers(id,name,hostId,status,tenant_id,user_id,
image,flavor,az,hh),
not glancev2:tags(image,'dmz'),
dmz_server(id)
execute[nova:servers.pause(id)] :dmz_placement_error(id),
nova:servers(id,status = ’ACTIVE’)
15.7.3 Machine Learning for NFV‐based Security Services
Policy‐based approaches tend to favor deductive reasoning by building models of reality
and analyzing the models based on logical rules. As we know, this approach has its
limits and does not work well in complex, dynamic and large systems by itself. An alternative way is to find truth from observation data and inductive reasoning.
Machine learning (ML) and Big Data have made rapid advancements and have had a
huge impact on many problems that IT and CT industries face. It is not new that ML
has played a large part in security – both on the positive side in protecting business
systems and user privacy, and on the negative side as in hacking or unwanted surveillance. It is out of the scope of this short discussion to go into the general picture of
ML applications in security and many of the envisioned 5G use cases. We will briefly
touch upon several promising areas where ML can help NFV‐based systems to better
perform and protect [38,39].
● Autonomous Operations
Within an abstracted and service API‐oriented system, ML can use collected real‐time
data to fine‐tune optimization parameters of the overall resource management scheme.
It is also promising that the ML system will be able to adapt to load spikes (e.g. during a
DDoS attack) with autonomous responses by learning from long‐term operational data
collected from human expert operators. As we have reviewed throughout this chapter,
NFV has made the system highly automatable and also made consistent real‐time data
readily available. In [38], we call such a highly autonomous system a Sentient Network.