The reliance on Network Function Virtualization (NFV) and Software-Defined Network (SDN) introduces a wide variety of security risks in Service Function Chain (SFC), necessitating the implementation of automated security measures to safeguard ongoing service delivery. To address the security risks faced by online SFCs and the shortcomings of traditional manual configuration, we introduce Intent-Based Networking (IBN) for the first time to propose an automatic security enhancement method through embedding Network Security Functions (NSFs). However, the diverse security requirements and performance requirements of SFCs pose significant challenges to the translation from intents to NSF embedding schemes, which manifest in two main aspects. In the logical orchestration stage, NSF composition consisting of NSF sets and their logical embedding locations will significantly impact the security effect. So security intent language model, a formalized method, is proposed to express the security intents. Additionally, NSF Embedding Model Generation Algorithm (EMGA) is designed to determine NSF composition by utilizing NSF capability label model and NSF collaboration model, where NSF composition can be further formulated as NSF embedding model. In the physical embedding stage, the differentiated service requirements among SFCs result in NSF embedded model obtained by EMGA being a multi-objective optimization problem with variable objectives. Therefore, Adaptive Security-aware Embedding Algorithm (ASEA) featuring adaptive link weight mapping mechanism is proposed to solve the optimal NSF embedding schemes. This enables the automatic translation of security intents into NSF embedding schemes, ensuring that both security requirements are met and service performance is guaranteed. We develop the system instance to verify the feasibility of intent translation solution, and massive evaluations demonstrate that ASEA algorithm has better performance compared with the existing works in the diverse requirement scenarios.

With the rapid proliferation of 5G technology and the exponential growth of IoT devices, federated learning is emerging as a typical paradigm in 5G IoT scenarios. However, traditional federated learning still faces numerous challenges in 5G IoT scenarios, including resource constraints on edge devices, strong data distribution heterogeneity, and stringent privacy protection requirements. To address these challenges, this paper proposes a lightweight federated learning privacy protection framework (FedDHKD) based on dynamic hierarchical knowledge distillation. The FedDHKD framework divides the model into a client-side feature extractor and a server-side classifier, and achieves efficient knowledge transfer and model compression through a dynamic knowledge distillation mechanism, thereby reducing communication overhead. Additionally, an optimization strategy based on model-agnostic meta-learning is introduced to enhance adaptability to heterogeneous data distributions and accelerate convergence. Furthermore, by adding Gaussian noise that satisfies differential privacy constraints to the low-dimensional features to be uploaded, lightweight and effective privacy protection is achieved. Finally, we evaluated the performance of the FedDHKD framework against baseline approaches across various datasets. Experimental results demonstrate that FedDHKD reduces communication overhead to approximately one-seventh of FedAvg while maintaining competitive model accuracy. This approach provides an effective solution for 5G IoT edge scenarios, achieving a balanced trade-off between performance, efficiency, and privacy.

As a key intelligent component of core networks, NWDAF (Network Data Analytics Function) provides network intelligence capabilities while facing increasingly data security challenges. Current research on NWDAF data security primarily adopts federated learning framework, which trains models locally to avoid privacy leakage risks. However, existing NWDAF federated learning studies mostly rely on idealized assumptions, failing to adequately address two critical issues in real-world network deployments: 1) uneven data distribution across different regions, and 2) differentiated optimization requirements for high priority security regions. To solve these problems, we propose a region dual-factor aware federated learning framework for NWDAF (NWDAF-FedRDA), specifically designed to handle regional data imbalance and security priority differences in core networks. The framework comprises three core components: 1) Model parameter distribution: enabling allocation of global model parameters to regional nodes; 2) Local training: performing regional data preprocessing and model training; 3) Region dual-factor aware aggregation: computing regional weights through awareness factors and executing global model aggregation. Experimental evaluations across four network scenarios demonstrate the framework’s performance in anomaly detection tasks. Results show that compared to baseline methods, our framework exhibits significant advantages in uneven data distribution environments while effectively enhancing model performance for high-priority security regions.

Enhancement of service function chain (SFC) security ability by composing virtual network functions (VNFs) and allocating resources considering their security attributes can address the vulnerability threats in cloud environments, which is an important means of attempting to secure SFCs at the deployment stage. However, existing works do not consider the vulnerability correlation of the multi-step attack chains when completing SFC deployment based on trustworthiness. This results in existing security orchestration methods ignoring the differences in trustworthiness among network entities and focusing only on local trust optimization; these steps effectively disrupt the attack chains to secure SFCs. In this article, an innovative hierarchical trust model is proposed to assess the differentiated trustworthiness among network entities caused by vulnerability correlation. On the basis of trustworthiness assessment, both virtual trust of VNF combinations at the SFC composition stage and physical trust of physical node (PN) selections at the SFC placement stage are globally considered to disrupt the attack chains in SFCs as much as possible. To this end, the security-aware and cost-efficient SFC composition and placement (SCSCP) problem is formulated as an integer linear programming (ILP) problem, which is NP-hard. To tackle the SCSCP problem, the joint trust and cost global optimization (JTCGO) algorithm is proposed to dynamically update the trustworthiness and globally find the SFC deployment solutions including the VNF combination schemes and PN selection schemes. Simulation results demonstrate that our proposed algorithm can provide the optimal SFC deployment solutions for requests and can guarantee the SFC trustworthiness at a controllable cost, thereby protecting SFCs from network attacks in complex security environments.

Abstract In network function virtualization, resource allocation is one of the key techniques to ensure the QoS of service requests in face of the uncertain traffic demand and traffic fluctuation of user services. The previous related works usually assume that the traffic demand is a deterministic value and then reallocate substrate resources to deal with the demand uncertainty and traffic fluctuation during operation. In response to performance degradation caused by demand uncertainty and traffic fluctuation, the paper models the service function chain orchestration under demand uncertainty as a robust optimization problem, where the parameter Γ is introduced to control the conservativeness of the solution. On this basis, the strong duality theory is used to transform the original problem into a mixed‐integer linear programming, and then devise an exact Robust Service Provisioning (RSP) algorithm. The simulation evaluation demonstrates that the proposed algorithm could achieve different levels of robustness and make a trade‐off between robustness and cost. The impact of Γ value on the realized robustness and price of robustness is also analysed. Thus, the algorithm proposed could get an effective service function chain orchestration scheme under uncertain traffic demands and provide a reference of the total cost.