## 4 Implementation of Security Mechanisms into SDNFV-Based Networks  
As previously discussed, while SDN and NFV offer significant benefits for modern network architectures, they also present security challenges for the network and its data. Integrating both approaches within a unified framework, known as an SDNFV-based network, offers improved mechanisms for detecting and mitigating security threats.  
Due to the combined control and flexibility advantages inherited from SDN and NFV, respectively, SDNFV has become a hot topic in both research and industry. Several technologies have emerged to implement SDNFV frameworks due to the inherent complexity of its architecture and the relationship between the two approaches.  
An SDNFV-based network defines complex network services that can operate on general-purpose hardware, replacing traditional dedicated hardware designed for specific functions [28]. This integration between NFV and SDN hardware is partially achieved through the decoupled control plane and data plane in SDN. The controller managing the network's control plane orchestrates the deployment of services, selecting the optimal location for each virtualized function.  
While the controller's primary function in a pure SDN architecture remains managing the control plane and directing network flows, an SDNFV-based network requires additional functionality for orchestrating network resources, deploying virtualized functions, and managing their life cycle.  
From a security perspective, the controller/orchestrator plays a vital role in handling key services for attack detection and mitigation, allocating network resources for black hole creation, and analyzing traffic flows, sources, and sinks.  
Figure 3 illustrates the architecture and how both paradigms interconnect through the controller/orchestrator deployed in the network. As observed in the figure, the architecture is divided into different types of interconnected nodes. There are two types of SDN switches in the proposed SDNFV network architecture.  
The first is built upon CPqD/ofsoftswitch13, which is an OpenFlow 1.3 Software Switch version executed in user space and implementing all standard functionalities. This switch has been modified by the BEAhavioural-BASed forwarding (BEBA) project workgroup to introduce an extended set of actions and primitives designed to monitor network traffic and enhance communication security[29]. The BEBA approach is an open-source implementation of an OpenState controller and switch, which is available at [30]. The second type of switch utilized within this setup is the Open vSwitch (OVS), functioning as a kernel module supporting OpenFlow, effectively replacing the Linux bridge implementation.  
Another integral component is the RYU OpenFlow controller, managing the control plane of both switch types to facilitate intelligent routing within the SDNFV network. For the sake of simplicity, this controller also assumes the role of an orchestrator, overseeing the management of resources within the network function virtualization infrastructure (NFVI). These functions can be split into two entities in the network to separate the controller and orchestrator functionalities.  
In this architecture, the infrastructure for deploying network functions virtualized utilizes a Docker infrastructure, operating within a Docker cluster. These Docker servers are integrated into the network as nodes, accessible through various routes. All virtualized functionalities are deployed within these servers, requiring the controller to adapt routes to incorporate NFV functionalities within the network and manage interactions with the network flows.