# Quarantining Malicious IoT Devices in Intelligent Sliced Mobile Networks
## 3 Proposed Solution  
We propose an architecture based on Network Slicing for quarantining malicious IoT devices in mobile networks. The solution relies on NFV for creating multiple Network Slices with independent user-plane resources and on SDN for configuring the traffic flows in the network and redirecting each device seamlessly to the proper network slice. Furthermore, the proposed architecture is interoperable with 3 GPP entities and therefore can be easily integrated in existing deployments.  
Figure 1 shows a high-level overview of the proposed architecture. Each IoT device corresponds to a User Equipment (UE) in the mobile network. The UEs are connected to the Radio Access Network (RAN) through the base stations (i.e., eNodeB in 4G, gNodeB in 5G), which provide wireless connectivity to the IoT devices. In turn, the RAN is connected to the Core Network (CN) through an SDN network, consisting of at least one SDN switch in the user-plane that is managed by a logically centralized SDN controller. In the CN, our proposed architecture contains at least two network slices: an IoT Network Slice (IoT NS) for handling the traffic of legitimate IoT devices connected to the network and a Quarantine Network Slice (Quarantine NS), which is used for performing a deep inspection of potentially malicious IoT devices. Note that this approach can be generalized to more slices for IoT or other types of traffic. Moreover, the lifecycle of these network slices can be dynamically managed by leveraging NFV technology.  
Using this architecture, the SDN network interconnecting the RAN and the CN can assign UEs dynamically to the slices. This way, IoT devices are initially attached to the IoT NS, which provides full access to the network services the IoT devices require. An SDN application running on top of the SDN controller is in charge of identifying potentially malicious nodes and reassigning them to the Quarantine NS for further inspection. After a deep inspection of the traffic in the Quarantine NS, a device can be deemed malicious in which case its traffic is blocked or, conversely, it can be considered legitimate and consequently moved back to the IoT NS.  
Overall, the proposed quarantine architecture employs a two-stage system for detecting malicious IoT devices: The first stage performs lightweight and coarse-grained early detection, which can involve some legitimate devices, while the second stage is a fine-grained in-depth traffic analysis for individually identifying malicious devices.  
This architecture presents two major challenges that must be addressed: the detection of potentially malicious devices by the SDN controller and the dynamic reassignment of these devices to the different slices. On the one hand, the detection of potentially malicious nodes can be addressed by an SDN application monitoring the SDN flow rules installed on the SDN switches. As we show in this paper, the accuracy of this approach depends on the granularity of the flow rules in the SDN network. On the other hand, the dynamic reassignment of nodes to different slices can be achieved by redirecting their user-plane traffic to the desired slice using the SDN network. Moreover, this requires maintaining a state replication of the user-plane context among the different slices, so that the traffic of any device can be properly handled by any of them.