# Quarantining Malicious IoT Devices in Intelligent Sliced Mobile Networks
## 5 Conclusions  
Massive IoT networks are challenging for 5G networks, not only in terms of scalability, but also of security. However, conventional security solutions have focused on eMBB scenarios and do not fit well into massive IoT communications, due to their huge density of devices. Hence, operators need tailored solutions for this use case. In this paper we propose an architecture based on Network Slicing, NFV and SDN for detecting malicious devices and mitigating their impact in massive IoT scenarios, which can be easily integrated into any existing deployment due to its interoperability. The solution in this architecture is a two-step process: the first step, which we analyze in depth in this paper, performs a coarse-grained lightweight detection of potentially malicious devices through SDN techniques. In the second step, suspicious devices can then be seamlessly redirected to a Quarantine Network Slice for fine-grained in-depth inspection. We have validated the flow analysis mechanism proposed through simulations and evaluated the performance of the redirection with a real testbed implementation. The results of the simulations reveal a trade-off between the probability of successful identification of malicious devices and the number of legitimate devices that are sent to the quarantine slice, which depends on the number of devices in the aggregated flows of the SDN switches and the detection threshold. These parameters can be configured in the SDN application to fine-tune the desired performance of the application. On the other hand, the implementation of the proposed architecture in a real testbed allowed us validating its feasibility and also measuring that moving a device to the quarantine slice takes about 1 s when the quarantine slice is reactively deployed on demand. The results also show that this time can be further reduced to less than 10 ms if the quarantine slice is proactively deployed. \begin{table}
\begin{tabular}{l c c c c c} \hline \hline  & **Mean** & **Median** & **Minimum** & **Maximum** & **95-th Percentile** \\ \hline \(\Delta\)(ms) & 989.69 & 992.20 & 918.32 & 1057.86 & 1027.05 \\ \(\Delta_{1}\) (ms) & 570.11 & 571.48 & 505.27 & 630.98 & 606.04 \\ \(\Delta_{2}\) (ms) & 381.68 & 381.46 & 361.89 & 397.13 & 392.32 \\ \(\Delta_{3}\) (ms) & 33.92 & 33.71 & 32.91 & 37.67 & 35.38 \\ \(\Delta_{4}\) (ms) & 3.98 & 3.84 & 0.61 & 9.98 & 6.03 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Device/UE reassignment time and its components (averaging 100 independent executions). Our proposed architecture is particularly efficient in scenarios with a large number of IoT devices because it does not need to inspect all the traffic in depth, but just the devices corresponding to aggregated SDN flows with suspicious behavior. Moreover, unlike conventional mechanisms, our solution does only trigger an in-depth inspection of the traffic in the event of a potentially malicious attack, thus reducing the computational load in the operator network. This architecture is specially useful and adequate for environments with a small number of malicious devices. Our experiments and models demonstrated how malicious devices were quarantined for further analysis even for low ratios of compromised devices or devices transmitting small amounts of information. Although our method also quarantines legitimate devices that are in the same flow of malicious devices, their communications are kept active while they are being inspected and also when legitimate devices are returned to the original slice, making our approach transparent and non intrusive. As future work we plan to implement and evaluate a mechanism for performing in-depth traffic inspections in the quarantine slice.