# Quarantining Malicious IoT Devices in Intelligent Sliced Mobile Networks
## 2 Related Work  
DDoS attacks from IoT botnets are a main concern in 5G networks security. SDN, one of the most significant paradigms in 5G core network design, has different advantages to build better defense systems for modern networks [16]. Its global vision of the network and its flexibility in routing reconfiguration simplifies the development of complex security systems aimed at efficiently detecting and mitigating attacks and failures in the network [17]. There is abundant work in the literature on the detection of DDoS attacks on networks by relying on SDN. In [18], the authors propose a framework for improving network security in which data traffic is mirrored to a central Intrusion Detection System (IDS) for attack detection, taking into account the mobility of the users. In [19; 20], two machine learning models for detecting malicious data flows are presented. In [21], a joint entropy-based statistical model classifies ongoing data flows as legitimate or malicious ones in case of congestion. The importance of detecting DDoS attacks as close as possible to the attackers themselves, both to detect them more quickly and to reduce wasted backbone network resources, is discussed in [22]. The analysis of the data flows is taken to the switches themselves in [23], by relying on the concept of programmable data plane. This way, control plane traffic is reduced at the expense of requiring more complex network devices. This work also introduces a mechanism to prevent DDoS attacks against SDN switches by reducing the size of the flow tables of the switches using wildcards. These works take advantage of the global knowledge of the SDN controller for detecting malicious devices; the centralized programmability of the network control plane, which permits creating consistent policies to drop all the data frames that match certain filters; or the sampling capabilities of SDN networks, which allow mirroring part of the traffic towards an analysis entity. Although the delay in acting on malicious traffic can increase the severity of the problem, immediate blocking of all suspicious traffic can lead to the disruption of legitimate user services since false positives may occur In [24] the concept of quarantine slice was introduced for the first time. The idea behind this term is to isolate suspicious traffic by moving the corresponding flows to a new network slice with restricted capacities. This way, suspicious traffic can be further analyzed before blocking its sessions without affecting legitimate traffic. In [25] a quarantine slice is used to isolate suspicious flows. However, this work focuses on the detection of malicious nodes (mainly by analyzing network slice requests) at a high level and it does not propose any architecture for diverting malicious flows to a quarantine slice. Suspicious traffic isolation is relevant not only at academic level but also at industrial level. Research projects [26] and patents [27] include the concept of quarantine slice for the aforementioned purposes. The ANASTACIA project ([[http://www.anastacia-h2020.eu/](http://www.anastacia-h2020.eu/)]([http://www.anastacia-h2020.eu/](http://www.anastacia-h2020.eu/))) seeks to develop a solution for a network serving IoT devices to act automatically and intelligently in the face of threats. This project introduces an architecture to move users to a quarantine slice if suspicious behavior is detected. However, anomaly detection is carried out by specific entities that perform deep packet inspection of user traffic to determine if a flow is potentially malicious. In this paper we present a novel two-step DDoS attack detection solution for current mobile networks supporting massive IoT use cases. A coarse-grained detection procedure running in an SDN application is in charge of detecting abnormal growth of throughput from aggregated sets of IoT devices.