Search

Network Functions Virtualization (NFV) has been a key part of evolving communication systems in the last few years. However, the life-cycle management of Virtual Network Functions (VNF) is still a not trivial task. Blockchains (BC), due to their decentralization and immutability characteristics, together with the automation provided by Smart Contracts (SC), can be employed to enable such automated and trustworthy VNF management.Thus, this paper proposes VeNiCE to automate the deployment and life-cycle management of VNFs using events emitted on SCs. VeNiCE provides automation and auditability by relying on a BC to provide a decentralized approach for VNF management, which performs management actions, such as VNF deployment and deletion, and based on events and communicates with an SC to provide immutable logging of the VNF life-cycle. VeNiCE provides (i) a frontend for user interaction, (ii) a backend implementing the communication with the NFV framework, and (iii) an SC that emits events, stores VNF allocations, and authenticates users. A prototype of VeNiCE was developed and deployed in the Ethereum BC using OpenStack Tacker as an NFV platform. Experiments were conducted in a real-world deployment of such a prototype to analyze the economic costs of using SCs and the time required to process requests by each component of VeNiCE and the BC. Those results obtained show VeNiCE’s feasibility, highlight its benefits achieved with the automation and provide insights on reducing costs by exploring additional BC platforms and different deployment types, which introduce centralization and management concerns.

Distributed Denial-of-Service (DDoS) attacks remain one of the top reasons for business disruption and financial losses. Although mitigation solutions are available on the market, there is still a need for approaches that help network operators understand attack characteristics and behaviors, resulting in better planning of companies' cybersecurity strategies. This paper introduces DDoSGrid, a platform for the analysis and visualization of DDoS attacks. DDoSGrid implements an extensible set of miners to extract, process, and analyze information from network traces (i.e., PCAP files) to provide insightful visualizations for a better understanding and in-depth analysis of DDoS attacks in different scenarios. A case study was performed using an HTTP flood attack scenario to evaluate the feasibility of the approach. DDoSGrid enables real-world DDoS scenarios' analysis, providing an intuitive interface integrated with extensible insightful visualizations and data miners.

The integration of Blockchains (BC) and Internet-of-Things (IoT) brings several benefits, such as data immutability and traceability, to a myriad of use-cases. The use of intermediary nodes, e.g., an edge node, provides benefits, but opens the possibility for attacks, especially when considering nodes handling the signing of transactions for devices. If the private key of a device is leaked, the data coming from that device cannot be trusted anymore, thus, rendering transactions signed with that private key unreliable. To tackle this concern, this paper presents Edge2BC, a practical approach to sign automatically BC transactions in an IoT device without revealing its private key to intermediary nodes, thus, increasing trust in the edge-to-BC data transit. The device relies on an edge node to communicate with a BC interoperability API to retrieve dynamic information (e.g., transaction nonce and gas price) and to send the signed raw transaction to the correct BC node. Power measurements (i.e., required current for different method steps) were performed in the prototype implemented to verify Edge2BC’s feasibility. Such evaluations indicate that it is possible to have such a method in place, but the high power consumption required during the signing phase should be taken into consideration when deploying Edge2BC in a dedicated scenario.

While the existence of Public Bulletin Boards (PBB) is often formulated as an assumption in related work on Remote Electronic Voting (REV) systems, this work here on Provotum focuses on the practical design and architecture of such a PBB, including its distributed execution. Further, Provotum leverages a public permissioned Blockchain (BC) as a PBB, where only authorized entities can sign blocks, while the general public can verify all BC data.Therefore, Provotum defines a new and fully decentralized BC-based REV system, which deploys a permissioned BC as a PBB and allows for the explicit distribution of trust across different permissioned BC nodes. Provotum is operated in a fully distributed fashion by using Smart Contracts (SC), Distributed Key Generation (DKG), Homomorphic Encryption (HE), and Cooperative Decryption (CD), as well as employing client-side encryption, which enables ballot secrecy, while the BC forms an audit trail, enabling public and End-to-end Verifiability (E2E-V).

One of the major concerns with cryptocurrencies is their price instability, driven by market speculation, underlying technology, and applications. Stablecoins were introduced to address volatility and to provide means for an electronic payment and a value store remaining stable, often being supported by physical assets or fiat currency (e.g., gold or US dollars, respectively). However, different collateralization mechanisms exist and different assets are pegged with the coin that can affect their stability in different ways. This work overviews stablecoin stability mechanisms, the current stablecoin market landscape, and the performance of major stablecoins during the 2020 financial market crisis due to the COVID-19 pandemic. Results from this analysis indicate that stablecoins’ performance during the financial crisis and, in particular, the market crash present a direct relation with their specific behavior attributed to different design aspects, including their popularity.

Businesses were moving during the past decades to-ward full digital models, which made companies face new threats and cyberattacks affecting their services and, consequently, their profits. To avoid negative impacts, companies' investments in cybersecurity are increasing considerably. However, Small and Medium-sized Enterprises (SMEs) operate on small budgets, minimal technical expertise, and few personnel to address cybersecurity threats. In order to address such challenges, it is essential to promote novel approaches that can intuitively present cybersecurity-related technical information.This paper introduces SecBot, a cybersecurity-driven conversational agent (i.e., chatbot) for the support of cybersecurity planning and management. SecBot applies concepts of neural networks and Natural Language Processing (NLP), to interact and extract information from a conversation. SecBot can (a) identify cyberattacks based on related symptoms, (b) indicate solutions and configurations according to business demands, and (c) provide insightful information for the decision on cybersecurity investments and risks. A formal description had been developed to describe states, transitions, a language, and a Proof-of-Concept (PoC) implementation. A case study and a performance evaluation were conducted to provide evidence of the proposed solution's feasibility and accuracy.

Distributed Denial-of-Service (DDoS) attacks re- mains as one of the major causes of concerns for service providers around the world. This paper introducesSC-FLARE, a Smart Contract (SC) based cooperative signaling protocol built on top of a Ethereum Proof-of-Authority Blockchain (BC) for the sharing of attack information, the exchange of incentives, and the tracking of reputation in a fully distributed and automated fashion. By making use of BC and SC,SC-FLAREprovide the required collaborative platform without the burden to maintain, design, and develop special registries and gossip protocols for a cooperative defense.

The blockchain (BC) world is rapidly becoming a universe of several ledgers designed for a specific purpose, holding data previously stored (i.e., siloed) in centralized databases. The use of different BCs for the same purpose could hamper the frictionless exchange of data or value. On one hand, it is natural that there are competing implementations exploring the benefits of BC. On the other hand, the problem of siloed data re-emerges, with respect to isolated chains. In this regard, BC interoperability is necessary to connect different BCs, exchanging information and assets. Moreover, to foster BC employment, developers must be able to interact with such different BCs without knowing the details of each implementation. This paper presents a novel solution, called Bifrost, to store and retrieve data on different BCs. Bifrost employs a notary scheme, which allows for connectivity to different BCs. The presented prototype is highly modular and currently implements seven adapters to popular BC implementations, including Bitcoin, Ethereum, and Stellar. The developed prototype was evaluated concerning performance, security, and data size to verify the feasibility of such an implementation and assess design decisions taken during its development.

Democracy in the digital age has attracted a lot of public attention in recent years. However, bringing the human right of secrecy in voting to electronic systems is difficult. Properties, such as the possibility of verifying universally that any vote counted was indeed carrying the decision made by a voter, are often conflicting and a trade-off must be found. This paper proposes a blockchain-based electronic voting system providing explicitly cast-as-intended verifiability. By using a non-interactive zero-knowledge proof of knowledge any voter can verify that his or her encrypted vote represents the decision voted for while maintaining at the same time the secrecy of the ballot. In addition, any required cryptographic material can be generated in linear time with respect to the number of voters, making the system suitable for large scale elections, thus scalable.

Distributed Denial-of-Service (DDoS) attacks are by design highly decentralized and therefore hard to defend against. By utilizing a decentralized, multi-domain, cooperative defense mechanism, it is possible to combine software and hardware capabilities to effortlessly mitigate large scale attacks. Cooperative defense systems face many challenges, such as deployment complexity due to high coordination overhead, reliance on trusted and stable channels for communication and the need for effective incentives to bolster cooperation among all involved parties. In particular, incentives are the key to ensure successful deployment of a "Mitigation-as-a-Service (MaaS)" for cooperative defense systems. This paper discusses the critical issue of providing a proof of the effectiveness of a cooperative defense mitigation, considering four state-of-the-art solutions toward an independently verifiable proof of mitigation. A qualitative analysis of these approaches across 9 dimensions shows that none satisfy all requirements due to the inherent trade-offs between practicability and security. As a result, it is identified that the issue of authenticating the underlying network flows remains unsolved.

Virtual Network Functions (VNFs) can be chained and provisioned on demand, providing elasticity and dynamicity to the network. Due to the interdependencies between VNFs, resulting service chains may not work as expected, and because of that, it is crucial to determine which VNFs are having a negative impact on the service quality. In this paper, we introduce a model to quantify the guiltiness of a VNF on being a bottleneck in a service chain, which provides a metric that estimates the impact on processing delay. In addition, we propose an adaptive algorithm, based on linear regression and neural networks, to adjust the model parameters according to the environment particularities, such as the type and number of VNFs. We show through an experimental evaluation that the guiltiness metric faithfully characterizes end-service performance, by identifying up to 94% of the bottleneck VNFs in the analyzed scenarios. Also, we provide artifacts for researchers to reproduce our results in other scenarios.

Network Functions Virtualization (NFV) was proposed to migrate middleboxes that compose network services, such as firewalls and Network Address Translation (NAT) servers, from hardware to software running on Virtual Machines (VMs), commonly known as Virtualized Network Functions (VNFs). In NFV-enabled networks, VNFs can be chained in Forwarding Graphs (FGs) to provide services. These FGs establish the logical order in which network packets must traverse until reaching the end-service. In this scenario, network operators establish affinity and anti-affinity rules, which determine restrictions on the placement and chaining of VNFs according to how well or poorly VNFs operate together. To address the subject of identifying affinity relations in NFV-enabled networks, we previously proposed a mathematical model to measure the affinity between pairs of VNFs. However, that affinity model falls short for identifying affinity of VNFs not yet deployed, as they have no resource usage data to take into account. In this paper, we use artificial neural networks to predict affinity estimation for newly introduced VNFs, which still do not have usage data to be analyzed. This affinity neural network is trained using past affinity measurements, containing the data from VNFs, Physical Machines (PMs), and FGs of each measurement as features. We evaluate our solution by analyzing it over real usage data from a Cloud dataset, and conclude that neural networks can be used to provide affinity values for network operators, or NFV orchestrators, to plan the deployment of new VNFs.

Network Functions Virtualization (NFV) offers several benefits for Service Providers (SPs), such as mitigating equipment cost and increasing business agility. In NFV-enabled networks, inadequate placement of Virtualized Network Functions (VNFs) creates bottlenecks, impacting negatively on performance. Therefore, network operators must establish affinity and anti-affinity rules to avoid network and processing bottlenecks, and thus comply with Service Level Agreement (SLA) requirements of tenants. Affinity and anti-affinity rules in NFV must be broad and carefully elaborated to maintain service performance. Network operators must consider further than simply resource allocation when identifying affinity among VNFs. The criteria for VNFs affinity varies for different forwarding graphs. Geolocation, latency, packet loss, and bandwidth usage are some examples of criteria that can be considered as indicators of bottlenecks in high traffic networks. In this paper, we propose a solution to measure affinity between pairs of VNFs, based on a weighted set of affinity criteria considered relevant by a network operator. To evaluate the feasibility of our affinity model, we analyze three case studies over an experimental NFV scenario. We conclude that our affinity model can help network operators identify the cause of issues in NFV-enabled networks, as well as it may be used by NFV orchestrators to aid on VNFs migration and embedding.

Many aspects of the management of computer networks, such as quality of service and security, must be taken into consideration to ensure that the network meets the users and clients demands. Fortunately, management solutions were developed to address these aspects, such as Intent-Based Networking (IBN). IBN is a novel networking paradigm that abstracts network configurations by allowing administrators to specify how the network should behave and not what it should do. In this paper, we introduce an IBN solution called INSpIRE (Integrated NFV-based Intent Refinement Environment). INSpIRE implements a refinement technique to translate intents into a set of configurations to perform a desired service chain in both homogeneous environments (VNFs only) and heterogeneous environments (VNFs and physical middleboxes). Our solution is capable of (i) determining the specific VNFs required to fulfill an intent, (ii) chaining these VNFs according to their dependencies, and (iii) presenting enough low-level information to network devices for posterior traffic steering. Finally, to assess the feasibility of our solution we detail a case study that reflects real-world management situations and evaluate the scalability of the refinement process.

AMNESiA is an affinity measurement platform for NFV-enabled networks, designed to consolidate and interpret existing monitoring data into an affinity metric, aiding operators to identify affinity and anti-affinity relations in the network. AMNESiA uses the latest snapshot of usage data, collected through a generic monitoring solution, from the database to measure affinity between VNFs.

Programmable Virtual Networks (PVNs) make the network more flexible and allow the fast introduction of new services. However, several shortcomings hamper their wider adoption, including: (i) the extensive knowledge required to configure and manage the NetApps, (ii) the lack of descriptors to detail all nuances of the NetApps, and (iii) there is no solution that enables to distribute and configure NetApps over distinct technologies. Therefore, we propose iMPROVE to simplify the introduction of services in PVNs, enhancing the distribution of NetApps. We also extend the ETSI network service descriptor to support distinct technologies as well as to represent conflict issues. We demonstrate evidence of iMPROVE's feasibility in a case study and compare it with the main solutions for distributing and deploying applications over multiple platforms.

Network Functions Virtualization (NFV) is driving a paradigm shift in telecommunications networks, fostering new business models and creating innovation opportunities. In NFV-enabled networks, Service Providers (SPs) have the opportunity to build a business model where tenants can purchase Virtual Network Functions (VNFs) that provide distinct network services and functions. However, the chance to negotiate VNFs requires a change in traditional network planning strategies to accommodate tenants demands. In this context, the planning tasks perform a critical role in the introducing of business strategies that encompass both profit and health of services, which requires operators to have a broad understanding of the environment. In this paper, we propose the usage of two interactive visualization techniques to help NFV network operators in planning and strategic decisions. We advocate that our visualizations can aid in NFV planning tasks, such as infrastructure investment, resources allocation, and service pricing. We present three case studies to provide evidence of the feasibility and effectiveness of our visualizations.

Network Functions Virtualization (NFV) enables the rapid development, flexible management, and the dynamic placement of new, innovative Virtualized Network Functions (VNFs), such as load balancers, firewalls, and Intrusion Detection Systems (IDSes). Furthermore, NFV along with Software-Defined Networking (SDN) allows VNFs and physical middleboxes to be dynamically composed into service chaining graphs. Despite these benefits, service chaining graphs can be further improved through the use of techniques that have not been satisfactorily explored yet, such as Policy-Based Network Management (PBNM). In PBNM, policies can be written and triggered during runtime, thus supporting the dynamic (re)configuration of service graphs with minimal disruption. In this paper, we propose an approach to automatically design NFV service chaining graphs based on policies. These policies rule the forwarding of traffic and the construction of service chaining graphs. In our approach, service chaining graphs are enforced dynamically in the network during runtime. Finally, to assess its feasibility and generality, we create two different scenarios to demonstrate and discuss how our solution can be employed and its expected results.

Network Functions Virtualization (NFV) is a key technology to reduce management costs as well as to improve scalability and elasticity of computer networks. Still, recent research efforts have been exposing additional management challenges. Concerning monitoring in particular, new types of entities and requirements are underexploited. To address these issues, we propose DReAM, a resource management architecture based on management by delegation and distributed monitoring, where each agent runs a diagnostic model to compute the network service state. In this paper, we describe DReAM's proposed architecture and its major components. We also discuss the feasibility of DReAM through experimental and analytical evaluations, where we observed application throughput, CPU utilization, communication overhead, scalability, and diagnosis complexity. We provide a trade-off analysis on the monitoring strategies in NFV scenarios. Our results indicate that a result-aware strategy is a better option when the monitored environment has more than 256 agents or when the diagnosis module induces at least 10% of CPU utilization.

Hera is a model-driven methodology for designing Web information systems. In the past a CASE tool for the Hera methodology was implemented. This software had different components that together form one centralized application. In this paper, we present a distributed Web service-oriented architecture for the Hera software in which components are mapped to Web services. The present CASE tool is based on two Web services: a data service which maps to the data component and a presentation service which maps to the presentation component. For these two Web services a detailed description of their interfaces in WSDL is given as well as examples of SOAP messages exchanged between these services and a client. The paper also proposes how to extend the present architecture in order to include other services like an adaptation service for performing presentation adaptation based on a user profile and a profile service as a shared memory service for user profiles.