Automating Mitigation of Amplification Attacks in NFV Services

Abstract

The combination of virtualization techniques with capillary computing and storage resources allows the instantiation of Virtual Network Functions throughout the network infrastructure, which brings more agility in the development and operation of network services. Beside forwarding and routing, this can be also used for additional functions, e.g., for security purposes. In this paper, we present a framework to systematically create security analytics for virtualized network services, specifically targeting the detection of cyber-attacks. Our framework largely automates the deployment of security sidecars into existing service templates and their interconnection to an external analytics platform. Notably, it leverages code augmentation techniques to dynamically inject and remove inspection probes without affecting service operation. We describe the implementation of a use case for the detection of DNS amplification attacks in virtualized 5G networks, and provide extensive evaluation of our innovative inspection and detection mechanisms. Our results demonstrate better efficiency with respect to existing network monitoring tools in terms of CPU usage, as well as good accuracy in detecting attacks even with variable traffic patterns.

A Network Function Virtualization Architecture for Automatic and Efficient Detection and Mitigation against Web Application Malware

“…The proposed solution duplicates the traffic to send them to several Snort sensors and does not automatically drop packets that raise an alert. Repetto et al (2022) designed the ASTRID framework to detect and mitigate amplification attacks into a 5G Core (5GC) architecture implemented as an NFV service aiming to block them at their origin, at the boundary of a 5G network, before they get amplified by vulnerable servers in the Internet. ASTRID is a Java Spring Framework, created inside a 5GC network by using the Open5GS project, running inside a Kubernetes cluster.…”