Cloud-centric services are becoming the norm in modern IT and Operational Technology (OT) platforms, where cybersecurity risks are also on the rise. The evolving regulatory landscape within Europe, exemplified by the Network and Information Security 2 (NIS2) directive and the Cyber Resilience Act (CRA), further amplifies the necessity for rigorous compliance measures. The presumption of conformity for platforms certified under EU-recognized certification schemes, as outlined by the CRA, is anticipated to promote the certification of IT and OT platforms. Nevertheless, the certification process for these platforms is challenging due to the complexity of cloud architectures and the constantly evolving threats, which require continuous adaptation. Furthermore, both NIS2 and CRA introduce new mandates, including the obligation to manage risks, report incidents to relevant authorities, inform customers about vulnerabilities, and provide relevant mitigation strategies. Consequently, there exists an urgent demand for tools and frameworks that support sustained certification in the cloudification of IT/OT platforms. This paper introduces the Continuous Certification Readiness Framework (CCRF), which is engineered to automate tasks related to certification preparation and support ongoing compliance assessments, thereby enabling organizations to effectively manage risks and uphold a high level of assurance within their cloud environments.

In the rapidly evolving landscape of cloud computing, demand for additional security measures is rising. One technique that provides capabilities to evade and react to cyber threats is Moving Target Defense (MTD). There is a broad spectrum of MTD actions, one of which is container live migration. This paper explores the topic of container live migration within Kubernetes environments, proposing an approach using CRIU (Checkpoint/Restore in Userspace) and Kubernetes' beta feature “ContainerCheckpoint.” A prototype algorithm has been implemented, which successfully migrates containers between multiple Kubernetes clusters while preserving their state for stateful application continuity. These migrations are conducted with a diverse set of benchmarking applications, each with varying memory, computational, and storage demands. To evaluate the migration's efficiency, the duration of the entire migration, checkpointing, and restoring phases are analyzed. Further, it is found that the checkpointing part of the migration process is much shorter than the restoration one. The proposed container live migration technique, while a proof of concept in its prototype form, could be further developed as a shuffling variant of MTD after refinements.

The rise of cloud computing has transformed application development and deployment, with Kubernetes emerging as a key platform for managing containerized applications. This paper explores the use of Graph Neural Networks (GNNs) to detect anomalies in Kubernetes clusters and proposes GNN-based Anomaly Detection in Kubernetes (GATAKU), which is instrumental in maintaining security and performance. Our work involves integrating Cilium for detailed network monitoring and data collection, setting up a Kubernetes cluster with k3s and Traefik, and simulating attack scenarios to generate realistic data. Data preprocessing and feature engineering prepare this data for the GNN training. We present the GATAKU model’s performance, highlighting metrics such as accuracy, precision, recall, and F 1 -score and compare it to baseline ML models, namely Support Vector Machine (SVM) and Random Forest (RF). Moreover, we discuss these findings and emerging challenges, including handling high-dimensional data, and explore practical implications for cybersecurity.

In this paper, we outline a fast and lightweight network security fabric and identify the research gaps for developing such a fabric that respects the needs of trustworthy NextG SATIN for the post-quantum era. To achieve these objectives, we identify in which research directions more innovations are needed, namely algorithmic (NIST-PQC, distributed computing, time-disclosed cryptography), architectural (decentralized SATIN, distributed key management), and evaluation aspects.

Microservices architecture has become an increasingly common approach for building complex software systems. With the distributed nature of microservices, multiple actors can contribute to a service, hence affecting the dynamics of the environment and making the management of liabilities and trust more challenging. Service-Level Agreements (SLAs) are critical in that regard and any SLA violation or breach can result in significant financial damages. One major challenge is the lack of indicators to handle the liability and trust in such architectures. To address this issue, in this paper we propose a liability and trust analysis framework, namely the LASM Analysis Service (LAS), for multi-actor dynamic microservices that employs Machine Learning (ML) techniques.

This paper explores the implementation of live migrations within microservices architecture, with a focus on Moving Target Defense (MTD) in the context of cybersecurity. MTD aims to improve system security by introducing changes across multiple dimensions, increasing uncertainty for attackers. Our work dives into container migration techniques within Kubernetes, utilizing two clusters for a redundant deployment. Two payload migration approaches, “kill-first” and “replicate-first,” are proposed, implemented and investigated leading to some preliminary measurement results. The paper assesses the impact of these techniques on microservice applications, specifically their downtime during migrations. Additionally, it discusses security aspects related to container migration.

In this work, we present a liability analysis frame-work for root cause analysis (RCA) in the microservices architecture with IoT-oriented containerized network services. We keep track of the performance metrics of microservices, such as service response time, memory usage and availability, to detect anomalies. By injecting faults in the services, we construct a Causal Bayesian Network (CBN) which represents the relation between service faults and metrics. Service Level Agreement (SLA) data obtained from a descriptor named TRAILS (sTakeholder Responsibility, AccountabIlity and Liability deScriptor) is also used to flag service providers which have failed their commitments. In the case of SLA violation, the constructed CBN is used to predict the fault probability of services under given metric readings and to identify the root cause.

Although Network Function Virtualization (NFV) and containerized services embedded therein are an already active research field while becoming increasingly widespread in practice (e.g., 5G networks), the trust and security challenges still deserve more attention. To tackle relevant issues for this aspect, our work deals with the question of whether and how the issue of trust assessment can be addressed in such infrastructures. Different trust models are reviewed, and the trust attributes used in the literature are analysed and evaluated. These parameters are subsequently included in a trust calculation framework for their confidence analysis. Finally, a Dynamic Trust Monitoring (DTM) solution, namely MicroDTM, that supervises the trustworthiness of containerized services in an NFV infrastructure is proposed. By collecting and processing the trust parameters, a containerized service environment is evaluated according to trustworthiness for different scenarios. In addition to performance analysis, improvements and extensions necessary to use the system in a practical environment are identified.

Transitioning edge and cloud computing in 5G networks towards service-based architecture increases their complexity as they become even more dynamic and intertwine more actors or delegation levels. In this paper, we demonstrate the Liability-aware security manager Analysis Service (LAS), a framework that uses machine learning techniques to compute liability and trust indicators for service-based architectures such as cloud microservices. Based on the commitments of Service Providers (SPs) and real-time observations collected by a Root Cause Analysis (RCA) tool GRALAF, the LAS computes three categories of liability and trust indicators, specifically, a Commitment Trust Score, Financial Exposure, and Commitment Trends.

Telecommunication networks are shifting to multi-cloud environments. This trend is expected to shape the standardization and implementation of future networks. Thus, the protection of virtualized services has become more critical. One of the promising methods to secure virtual resources in that setting is Moving Target Defense (MTD). This paper presents the Network Topology Fuzzer (TopoFuzzer) module, enabling different MTD operations that change the topology of a 5G network. An emphasis is given to live re-instantiations and live migrations of running services and, consequently, security gains against Advanced Persistent Threats (APTs). This work utilizes a 5G testbed to evaluate the TopoFuzzer module and MTD operations on Virtual Network Functions (VNFs).

This work presents a Moving Target Defense (MTD) framework for the protection of network slices and virtual resources in a telco cloud environment. The preliminary implementation provides a closed-loop security management of services with proactive MTD operations to reduce the success probability of attacks, and reactive MTD operations, empowered by a tampering detection and a traffic-based anomaly detection system. MTD strategies are adaptive and optimized with deep reinforcement learning (deep-RL) for balancing costs, security, and availability goals defined in a Multi-Objective Markov Decision Process (MOMDP).

The adoption of 5G services depends on the capacity to provide high-value services. In addition to enhanced performance, the capacity to deliver Security Service Level Agreements (SSLAs) and demonstrate their fulfillment would be a great incentive for the adoption of 5G services for critical 5G Verticals (e.g., service suppliers like Energy or Intelligent Transportation Systems) subject to specific industrial safety, security or service level rules and regulations (e.g., NIS or SEVESO Directives). Yet, responsibilities may be difficult to track and demonstrate because 5G infrastructures are interconnected and complex, which is a challenge anticipated to be exacerbated in future 6G networks. This paper describes a demonstrator and a use case that shows how 5G Service Providers can deliver SSLAs to their customers (Service Owners) by leveraging a set of network enablers developed in the INSPIRE-5Gplus project to manage their accountability, liability and trust placed in subcomponents of a service (subcontractors). The elaborated enablers are in particular a novel sTakeholder Responsibility, AccountabIity and Liability deScriptor (TRAILS), a Liability-Aware Service Management Referencing Service (LASM-RS), an anomaly detection tool (IoT-MMT), a Root Cause Analysis tool (IoT-RCA), two Remote Attestation mechanisms (Systemic and Deep Attestation), and two Security-by-Orchestration enablers (one for the 5G Core and one for the MEC).

In this work, we present Graph Based Liability Analysis Framework (GRALAF) for root cause analysis (RCA) of the microservices. In this Proof-of-Concept (PoC) tool, we keep track of the performance metrics of microservices, such as service response time and CPU level values, to detect anomalies. By injecting faults in the services, we construct a Causal Bayesian Network (CBN) which represents the relation between service faults and metrics. The constructed CBN is used to predict the fault probability of services under given metrics which are assigned discrete values according to their anomaly states.

The promise of disparate features envisioned by the 3GPP for 5G, such as offering enhanced Mobile Broadband connectivity while providing massive Machine Type Communications likely with very low data rates and maintaining Ultra Reliable Low Latency Communications requirements, create a very challenging environment for protecting the 5G networks themselves and associated assets. To overcome such complexity, future 5G networks must employ a very high degree of network and service management automation, which is a security challenge by itself as well as an opportunity for smarter and more efficient security functions. In this paper, we present the smart, trustworthy and liable 5G security platform being designed and developed in the INSPIRE-5Gplus1 project. This platform takes advantage of new techniques such as Machine Learning (ML), Artificial Intelligence (AI), Distributed Ledger Technologies (DLT), network softwarization and Trusted Execution Environment (TEE) for closed-loop and end-to-end security management following a zero-touch model in 5G and Beyond 5G networks. To this end, we specifically elaborate on two key aspects of our platform, namely security management with Security Service Level Agreements (SSLAs) and liability management, in addition to the description of the overall architecture.

Resilience in SDN control plane is a challenging goal when a single controller is employed. Thus, distributed controllers are deployed to realize a resilient and reliable software defined network. However, such a strategy can not succeed without an efficacious controller-switch assignment scheme. In addition to zero-day assignment, online re-assignment is crucial since due to network failures, the connections between controllers and switches may break off intermittently and impair the network operation. In this paper, we propose a reactive assignment model against network failures using integer linear programming based on load distribution of controllers. We augment our proposal with simulated annealing and random assignment approaches for switch, link and controller failures. The experimental results show that our model gives resilience against network failures and load-awareness is a effective strategy for controller assignment.

Future Internet is going to be shaped by networked multimedia services with exploding video traffic becoming the dominant payload. That evolution requires a remedial shift from the connection-oriented architecture to a content-centric one. Another technique to address this capacity crunch is to improve spectral utilization through new networking paradigms at the wireless network edge. To this end, Device-to-Device (D2D) communications has the potential for boosting the capacity and energy efficiency for content-centric networking. To design and implement efficient content-centric D2D networks, rigorous content modeling and in-network caching mechanisms based on such models are crucial. In this work, we develop a multidimensional content model based on popularity, chunking and layering, and devise caching schemes through this model. Our main motivation is to improve the system performance via our caching strategies. The numerical analysis shows the interplay among different system parameters and performance metrics: while our schemes perform slightly poorer in terms of system goodput, they also decrease the system energy expenditure. Overall, this improvement dominates the loss in the goodput, leading to greater energy efficiency compared to the commonly-used caching technique Least Recently Used (LRU).

In cases of catastrophic events such as natural disasters or physical calamities, current network infrastructure can become inoperative. Furthermore, there are transient events leading to excessive demand surges where it is needed to deploy additional network capacity on-demand. In such cases, rapid network deployments become vital to establish communications and enable networked services. Unmanned Aerial Vehicle(UAV) networks are good candidates for this kind of operation. Software-defined networking and content-centric operation are promising technologies to enable agile control, network visibility and efficient content delivery via centralized optimization in these challenged systems. In this work, we consider an edge network which is composed of UAVs and serves in a content-centric mode with in-network caching and device-to-device (D2D) transmissions. We develop a cache placement and selection scheme for energy efficient operation. We also investigate how such a system performs under different operating conditions.

Information-centric networking (ICN) is a Future Internet paradigm which uses named information (data objects) instead of host-based end-to-end communications. In-network caching is a key pillar of ICN. Basically, data objects are cached in ICN routers and retrieved from these network elements upon availability when they are requested. It is a particularly promising networking approach due to the expected benefits of data dissemination efficiency, reduced delay and improved robustness for challenging communication scenarios in IoT domain. From the security perspective, ICN concentrates on securing data objects instead of ensuring the security of end-to-end communication link. However, it inherently involves the security challenge of access control for content. Thus, an efficient access control mechanism is crucial to provide secure information dissemination. In this work, we investigate Attribute Based Encryption (ABE) as an access control apparatus for information centric IoT. Moreover, we elaborate on how such a system performs for different parameter settings such as different numbers of attributes and file sizes.

Software-defined networking (SDN) is a communication paradigm that brings cost efficiency and flexibility through software-defined functions resident on centralized controllers. Although SDN applications are introduced in a limited scope with related technologies still under development, operational SDN networks already face major security threats. Therefore, comprehensive and efficient solutions are crucial. Especially, large-scale security threats such as distributed-denial-of-service (DDoS) attacks are jeopardizing safety and availability of data and services in these systems. A DDoS attack is aimed at making resources unavailable to legitimate users via overloading systems with excessive superfluous traffic from distributed sources. In this paper, we describe and evaluate a joint entropy-based security scheme (JESS) to enhance the SDN security with the aim of a reinforced SDN architecture against DDoS attacks. In particular, our proposed model devises a statistical solution to detect and mitigate these hazards. To the best of our knowledge, JESS is the first model that utilizes joint entropy for DDoS detection and mitigation in the SDN environment. Since it relies on a statistical model, it mitigates not only known attacks but also unfamiliar types in an efficient manner.

Software Defined Networking (SDN) is a promising solution for addressing challenges of future networks. Despite its advantages such as flexibility, simplification and low costs, it has several drawbacks that are largely induced by the centralized control paradigm. Security is one of the most significant challenges related to centralization. In that regard, Distributed Denial of Service (DDoS) attacks pose crucial security questions in software-defined networks. In SDN architecture, switches send all packets to the controller if they do not have any applicable rules in their flow tables. Basically, controller is the key place that can take initiative in decisions. However, this characteristic results in large communication overhead and delay until a DDoS attack is detected and an appropriate action is activated against attack packets. Therefore, in this work we propose a hybrid mechanism, namely SDNScore, where switches are not simply data forwarders. Instead, they can collect statistics and decide if DDoS attack is in action. Then they coordinate with the controller and act on attack packets in cooperation. SDNScore is a statistical and packet-based defense mechanism against DDoS attacks in SDN environment. Since it has a statistical scoring method, it can detect not only known but also unknown attacks entailing packets that are alike in terms of TCP and IP layer properties. In addition, it does not drop all packets in a flow which includes both attack and legal packets, but rather filters out attack packets using packet-based analysis.

Future wireless networks face a great challenge in spectral resource management to meet an overwhelming demand for network capacity. In 5G systems, Device-to-Device (D2D) communications is a key technology to alleviate this “capacity crunch” while content consumption is the key usage mode. In this work, we devise a resource allocation problem for a cellular network that facilitates the delivery of requested contents to its users via either BS mode or D2D mode. By solving the formulated optimization problem, we investigate the interplay between D2D transmissions, cache characteristics, and mode selection preference. Our numerical results suggest that while enabling D2D operation improves delivery performance significantly, how much a network can deliver in D2D mode is determined by both the network density and cache capacity.

We present QoS experiments done in an advanced object store that supports the local execution of code on objects. We show how by giving different levels of resources to different objects, we are able to offer considerable improvement in the performance of the more-important objects, at the expense of the less-important objects. We created two tiers: Gold for premium objects, and Silver for standard objects. We present a workload on which we achieve a running time improvement of 33.5 percent for Gold objects. This is done at the expense of the performance given to Silver objects. The resource parameters we manipulate are the level of redundancy and CPU resources.

Software-defined networking (SDN) has been proposed as a new networking paradigm which separates the control and data forwarding planes. The controllers deployed as centralized network control entities are crucial for meeting the performance and efficiency requirements of these systems. The placement of these network entities, switch assignment and their load-aware operation are challenging research questions. Although various load-balancing schemes are proposed in the literature, this research topic is yet to be explored adequately. In this work, we discuss load-balancing issues in SDN and propose a load-balancing scheme, namely Cooperative Load Balancing Scheme For Hierarchical SDN Controllers (COLBAS), for hierarchical controller configurations. Moreover, we evaluate the performance of our scheme and investigate important performance factors.

The immense development in mobile devices and the proliferation of ubiquitous cloud-based services have led to a surge in the utilization of remote data centers. These dramatic advances in wireless based services induce a huge traffic flow within the network. However, consequent high load on the network devices may lead to faults and thus an adverse decrease in the user experience. On the other hand, balancing the aggregated multi-flow traffic on ports of network switches is a challenging issue. This work presents a load balancing algorithm implemented in OpenDaylight controller for managing the load on the switch ports by utilizing Software-Defined Networking (SDN) architecture. The switch acts a connector which aggregates traffic from wireless access nodes. An experiment design is constructed with hardware-based OpenFlow-enabled switch and connected wireless hosts. According to the load on the ports, the developed scheme dynamically load-balances the incoming traffic towards the backhaul connection. It uses OpenFlow for gathering statistics and flow rule installation on the switch in an adaptive manner.

The proper adjustment of sleep time in idle mode (a.k.a. DRX-Discontinuous Reception in 3GPP specifications) is critical for mobile device (MD) operation in cellular wireless systems. The dynamic radio environment due to transmission impairments and mobility renders this requirement a nontrivial challenge. Moreover, this issue is aggravated in heterogeneous wireless networks where MDs have to change their camping cell more often. Hence, sleep time in idle mode is supposed to be calibrated to perform timely cell reselection without having the received power fall below a suitable level. In this work, we elaborate on MD sleep time adjustment and determine outage bound for imminent received power under certain assumptions. Moreover, we devise a configurable sleep/wake algorithm that aims to choose the best sleep time without dropping below a predefined received power level. Finally, we evaluate our approach with respect to baseline counterparts to examine the performance and investigate the trade-off between received power quality and average power consumption.

Although spectral resources are scarce while being critical for wireless system performance, their utilization in various frequency bands are shown to be very low. Cognitive radio (CR) concept, where licensed bands are allowed to be used by a secondary network, is proposed as a general paradigm to address this limitation. Moreover, the effects of this deficiency in spectral resource management have been aggravated with the exploding content consumption through wireless networks. In emerging 5G wireless systems, Device-to-Device (D2D) communications and heterogeneous architectures composed of different network tiers are posed as two vital apparatus to alleviate the "capacity crunch". However, the interplay/integration of these different techniques and approaches are yet to be comprehensively explored by research efforts. In this work, we consider this issue and develop an analytical Markovian model for content delivery over satellite integrated cognitive radio networks which can utilize D2D operation mode. We focus on throughput and energy efficiency as key metrics for depicting the system operation. We also investigate the effects of various system parameters on the performance such as cache size, mode preference for content retrieval from different content holders and primary user activity.

Cognitive radio networks (CRNs) are envisaged to alleviate the spectrum and capacity shortage aggravated by the static spectrum allocation. They are crucial for meeting the requirements of wireless traffic explosion emerging with new wireless applications and services. However, the security of CRNs is critical for their practical usage and widespread proliferation. Therefore, the fundamental mechanism of spectrum sensing in these systems has to be investigated from the security perspective. In this work, we define and analyze coordinated attack models for Cooperative Spectrum Sensing (CSS) in CRNs. We devise a simple yet effective countermeasure scheme based on trust management for cooperative sensing. We also provide experimental results to illustrate the performance of these systems under coordinated attacks.

Mobile network traffic is expected to increase dramatically with the proliferation of smart and diverse wireless devices. Moreover, pervasive and complex services such as mobile cloud, device-to-device communications and mobile multimedia consumption will require higher bandwidth and better network coverage. Hence, more spectrum and capacity with small cells and self-organization of heterogeneous networks are posed as vital solutions to address this burgeoning demand. In this paper, we propose a novel distributed self-organization algorithm for single frequency reuse scheme of OFDMA based heterogeneous networks for improving network capacity with self-configuration and self-optimization. Our approach, namely Spectrum-Aware Dynamic Frequency Reuse (SADFR), enables deployment of single frequency network by mitigating interference while increasing capacity in OFDMA HetNets. Moreover, we provide a comparative performance evaluation of our algorithm and elaborate on interference management issues in these systems.

With the increasing need for converged and ubiquitous broadband service support, next-generation mobile radio technologies are posed to be more efficient in different aspects such as energy and spectrum. There are also emerging critical environmental and cost concerns due to the steadily increasing energy consumption and related negative consequences such as greenhouse gas emissions and energy costs. In that respect, energy-wise optimization of satellite communications is crucial considering the objectives of cost improvement and energy efficiency (e.g., due to mobile and small form-factor end-user devices) or the strict energy constraints such as satellite power capacity for resource allocation. However, there are intrinsic challenges such as hardware complexity, algorithmic problems, and design tradeoffs. In this work, various aspects of energy efficiency and satellite networking, ranging from protocols for airborne satellite systems to mobile end-user terminals are reviewed and discussed. In addition, we present emerging factors including dynamic spectrum access, cross-layer design, the integration of space/terrestrial networks, interplanetary Internet, and emergency communications. Moreover, the enabling effect of satellite communications for greener infrastructural systems from the perspective of smart grids, so-called “enabled efficiency,” is outlined beside this “self-efficiency” issue.

Due to the proliferation of the multimedia applications over unreliable medium like wireless networks, robust image and video communication have become more important. In this paper, we consider the transmission distortions on the multimedia data due to both channel impairments and instant node failures for Wireless Multimedia Sensor Networks (WMSN). Two techniques are investigated to compensate the multimedia distortions at the expense of incurring additional delays and/or wasting bandwidth resources. First technique is an error concealment technique utilizing discrete wavelet transform for embedding downsized replicas of original image into itself, thereby mitigating degradations in a backward-compatible scheme. The other is Reed­Solomon coding utilizing additional information bits to correct bit/symbol errors. Two techniques are also integrated with multipath transmission to provide fault tolerance. Performance results show that error concealment with multipath transmission technique (ECMF) is more promising to compensate for losses due to unreliable channels and instant node failures than Reed-Solomon coding with multipath transmission technique (RSMF) in WMSN. Keywords--Wireless multimedia sensor networks, error concealment, digital watermarking, channel impairments, ReedSolomon coding, multipath transmission.

In this paper, we propose a new error concealment method for covering up the high packet losses of an original image after its transmission through an error-prone channel. Error-concealment techniques provide a simple framework to compensate these distortions without incurring additional delays and wasting bandwidth resources which are crucial for real-time applications over networks with limited resources. Unfortunately, most of the existing error-concealment techniques work only if the packet losses are smaller than a threshold and/or they are uniformly distributed. Utilizing data hiding techniques is a potential approach to overcome this restriction. We investigated an error concealment technique utilizing discrete wavelet transform (DWT) for embedding macroblock-based BNM (best-neighborhood-matching) information into the original image in order to utilize spatial redundancy. We propose that this technique can be implemented for error-prone channels to combat such degradations in a backward-compatible scheme. We show that the proposed error concealment technique is a promising one, especially for the erroneous channels causing a wider range of packet losses, at the expense of some degradation in the perceptual quality of the original image