# Quarantining Malicious IoT Devices in Intelligent Sliced Mobile Networks
## 4 Results
### Dynamic Reassignment  
In this section we evaluate the proposed mechanism for dynamic reassignment of IoT devices to slices, which, as previously said, is an extension of our solution for dynamic MEC in [36]. We analyzed the performance of the proposed solution through an experiment in a real implementation. Due to the lack of open-source 5G network implementations, we decided to conduct our experiments in a 4G network. We built a testbed based on the architecture in Figure 6 using the 4G stack provided by OpenAirInterface [40] software, both for the RAN and for the Core Network; Open vSwitch [41] for the SDN switch interconnecting the RAN and the Core Network; and the Open Network Operating System (ONOS) [42] for the SDN controller. In detail, the elements used in the testbed were:  
* UE: Huawei E3372h-153 Long Term Evolution (LTE) modem connected to a laptop (Intel($CoreTMi7 4510U CPU @ 2.0 GHz).
* Radio Access Network: eNodeB software implementation provided by OpenAirInterface running on a commodity PC (Intel($CoreTMi7-6700 CPU @ 3.40 GHz) connected through USB-3 to an Ettus USRP B210 SDR board. * Core Network: The network slices of the Core Network were deployed as Docker containers on top of an Intel($)Xeon($CPU E5-2603 v3 @ 1.60 GHz \begin{table}
\begin{tabular}{c c} \hline \hline
**Malicious Devices (\%)** & **Expected Number of Malicious Flows (\%)** \\ \hline
0.5 & 39.4 \\
1.0 & 63.4 \\
1.5 & 77.9 \\
2.0 & 86.7 \\
2.5 & 92.0 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Expected number of malicious flows vs. malicious devices. Figure 6: Architecture of the setup used for the experiments. * IoT NS: Three Docker containers implementing the main Evolved Packet Core (EPC) entities using OpenAirInterface software, Home Subscriber Server (HSS), Mobility Management Entity (MME) and Serving/Packet Data Network (PDN) Gateway (S/P-GW). * Quarantine NS: One Docker container implementing an OpenAirInterface S/P-GW. * SDN switch: Open vSwitch bridge with extended General Packet Radio Service (GPRS) Tunneling Protocol (GTP) encapsulating and decapsulating capabilities ([43; 44]) created on top of an Accelerated Processing Unit (APU) from PC engines([[https://www.pcengines.ch/apu.htm](https://www.pcengines.ch/apu.htm)]([https://www.pcengines.ch/apu.htm](https://www.pcengines.ch/apu.htm))). * SDN controller: ONOS SDN controller deployed as a Docker container in an Intel(r)Xeon(r)CPU E5-2603 v3 @ 1.60 GHz. The SDN applications for moving the devices/UEs were implemented on top of ONOS as described in [36]. These SDN applications allow for replicating the state of a S/P-GW into another one and diverting the traffic of specific users to the desired S/P-GW. The experiment we conducted on this testbed was to measure the time required for reassigning a device/UE from the IoT NS to the Quarantine NS (\(\Delta\)). This time includes:  
1. Dynamic creation of the Quarantine NS: Deployment of the S/P-GW Docker container in the Core Network (\(\Delta_{1}\)). 2. S/P-GW application initialization (\(\Delta_{2}\)). 3. State replication of the UE context in the S/P-GW of the IoT NS to the S/P-GW in the Quarantine NS (\(\Delta_{3}\)). 4. Data-plane reconfiguration of flow rules in the SDN switch for forwarding the traffic of the device/UE to the Quarantine NS (\(\Delta_{4}\)). The first step was performed by the Docker engine at the Core Network whereas the last two steps were performed by an SDN application running on top of the ONOS SDN controller. Note that these steps must proceed sequentially for a successful reassignment without service interruption. Thus, \(\Delta=\Delta_{1}+\Delta_{2}+\Delta_{3}+\Delta_{4}\). The methodology we followed for the experiment consisted in first deploying the SDN controller and the IoT NS in the Core Network and then connecting the eNodeB for a functional 4G network. Then, one static UE is connected to the 4G network generated using the OpenAirInterface software. The UE is intially attached to the IoT NS.