# Quarantining Malicious IoT Devices in Intelligent Sliced Mobile Networks
## 1 Introduction  
The 5G paradigm aims at defining \"universal networks\" connecting devices of all kinds. Billions of devices with different needs in terms of throughput, latency, reliability, security and density of users will be connected through 5G networks. The Internet of Things (IoT) is explicitly considered by the 3 rd Generation Partnership Project (3 GPP) in the design of new networks [1]. In fact, massive IoT is one of the use cases that has attracted more interest from standardizing bodies. Sensors and actuators servicing critical infrastructures such as energy, health, vehicles and telecommunications are expected to be connected through 5G networks. These devices exchange highly sensitive information, thus wrong manipulation of their communications may have significant economic, security and social impact. IoT devices have very different characteristics and requirements compared to traditional smartphones or other devices under the enhanced Mobile Broadband (eMBB) class, which form the majority of legacy mobile network terminals. They are simple devices with low computing power, so they are highly vulnerable to security issues. They usually have low encryption capabilities and only support simple authentication procedures [2]. Due to their low processing power, they may requirecomputational offloading to a cloud computing server, further favoring security breaches. Moreover, even though IoT devices are prone to issues that may not only put the device itself but also the whole network connecting it at risk, organizations are not showing too much interest in patching them [3]. Since their origins, cellular networks have been the target of numerous attacks. These increased in number with the deployment of the fourth generation of mobile technology. The IP-based architecture of 4G core networks led to the emergence of attack vectors which had never been seen before, whereas the increasing dependence on cellular networks also raised the interest of the attackers. The introduction of new use cases in 5G networks will foster this interest. In fact, IoT Distributed Denial of Service (DDoS) attacks are envisioned as one of the worst security threats 5G networks will need to face. IoT botnets have reached a high degree of maturity, up to the point that the most powerful and frequent DDoS attacks are performed by IoT botnets conformed by vulnerable commodity devices [3; 4]. Therefore, operators must implement mechanisms to detect these attacks and perform countermeasures to protect the rest of the network against them. 5G networks are being designed around new concepts and paradigms that may be exploited to improve their security. Software-Defined Networking (SDN) [5; 6; 7] allow reconfiguration based on complete network information, as well as assisting in the creation of consistent policies. Network Function Virtualization (NFV) [8; 9; 10] enables the deployment of network elements over a generic computing infrastructure. NFV enhances the availability of mobile network elements, as the operator is empowered to configure the network and the computational capabilities of each node based on its necessities, as well as deploying backup nodes in case the main ones become compromised. Network Slicing (NS) [11; 12; 13; 14; 15] supports the creation of multiple complete end-to-end networks providing different use cases independently. By isolating the traffic flows of these different use cases it may be easier to ensure the Quality of Service (QoS) requirements in the Service Level Agreements (SLAs) of end users, as well as to provide an additional security layer among the different connected devices. In this paper we propose a novel architecture for an efficient detection of DDoS attacks originating from massive IoT devices in mobile networks. Instead of applying Deep Packet Inspection (DPI) to all the data flows in the network, our solution, which relies on the SDN, NFV and Network Slicing concepts, applies a two-step detection procedure.