# Security Awareness in Software-Defined Multi-Domain 5G Networks
## 2 Related Work
### Security by Software-Defined Networking  
Software-Defined Networks (SDNs) ease network configuration and evolution as well as policy enforcement. SDN is based on three principles that enable faster provisioning and configuration of network connections [25; 26; 27]:  
1. Decoupling of control and data plane--Data plane nodes (switches) query the control plane (SDN controller) to give forwarding instructions when new packet flows emerge.  
Programmability of network services--The administrator may introduce complex rules and programs for the control layer, which are then consistently executed in the data plane.
3. Logically centralized control--network administrators can program the behaviour of the traffic in a centralized manner.  
SDN is typically used with network function virtualization (NFV) technologies [28]. NFV provides a virtualization framework where it is possible to create mobile network entities and services as Virtual Network Functions (VNFs) on demand and place them at the most suitable location using the most appropriate amount of resources.  
Network slicing [29] is a concept based on SDN. It enables the deployment of multiple logical networks independently on a common physical infrastructure platform. Network slices are created on-demand and they are isolated and restricted to the assigned resources. Micro-segmentation [30] is a concept originating from data centres, but its viability has been considered [31] for mobile networks as well. In a 5G network, a micro-segment can be defined as a network portion, which has been dedicated to a particular application or user and which protects particular (critical) network functions with the same security requirements. While an end-to-end slice contains all functions needed to create 5G connectivity, micro-segments may contain only one or a few functions that are secured using micro-segment specific means and policies. Micro-segments may be utilized to deploy fine-grained isolation, specific access controls, and tuned security policies and controls that fulfil application-specific trust models.  
SDN provides inherent capabilities for monitoring as switches feed information to a controller that can analyse the data in a centralized manner and the network can easily react to data flows related to threats. However, SDN introduces new challenges. [PERSON] et al. [32] presented attack vectors that the introduction of SDN will bring for mobile networks. New interfaces, control protocols, and centralized architecture may be vulnerable for attacks and reduced diversity enables attacks to propagate quickly.  
Researchers have proposed several concepts and tools for monitoring communication flows in SDN. For instance, OpenNetMon by [PERSON] et al. [25] is an approach and open source tool for monitoring data flows. It focuses on Quality of Service (QoS)-related metrics, in particular, polling statistics from edge switches at an adaptive rate in order to verify that throughput, delay, and packet loss are acceptable. OpenTM by [PERSON] et al. [26] utilized OpenFlow statistics for traffic estimation in order to, e.g., optimize load balancing in SDN or to detect anomalies. OpenSAFE by [PERSON] et al. [27] utilized OpenFlow-based SDN to route selected traffic to monitoring appliances for deeper analysis without impacting network performance. [PERSON] et al. [33; 34] developed an SDN-based monitoring platform for 4G networks to detect issues causing complexity and high bandwidth. [PERSON] et al. described technologies [35] These tools have mainly focused on quality and performance issues in general. However, they are also helpful when monitoring security attacks affecting quality and performance.