## 3 The ML Strategy within Network Slicing
### Practical Applications
It consists of two key components: the Radio Resource Hypervisor and the Computing Resource Hypervisor. The former optimises the allocation of virtual radio resources to physical resources based on user channel conditions. At the same time, the latter efficiently allocates computing resources to different network slices using a token-based kernel scheduler. Central to the framework's functionality is its alternating direction method of multipliers and a learning-assisted algorithm, which continuously learns the performance characteristics of network slices. When a DoS attack occurs, causing degradation in slice performance despite consistent resource allocation, the algorithm detects this anomaly by observing changes in resource utilisation efficiency. Subsequently, it dynamically adjusts resource allocation to mitigate the attack's impact, restoring network slice performance. The framework demonstrates its effectiveness in maintaining network performance through experimental setups involving multiple network slices and simulated DoS attacks. The learning-assisted algorithm successfully mitigates the impact of DoS attacks, restoring nearly 98% of slice performance. The FrameRTP4 framework proposed in [96] is designed to provide real-time detection and mitigation of attacks in 5G network scenarios. It follows the SDN architecture, separating the solutions into data and control planes. The data plane uses a customizable P4 program to implement a P4 table-based Access Control List for detecting and mitigating known attacks. It also deploys a monitoring system called SFCMon, which uses probabilistic data structures to track network flows and aid in attack detection. In the control plane, FrameRTP4 uses a Python-based controller to manage the lifecycle of SFCs and wildcardrules within the P4 table-based Access Control List. It also includes a decision-making module that periodically collects statistical data from SFCMon and uses it as input to ML algorithms to detect new threats automatically. When a new attack is detected, the module triggers the creation of access control rules within the switches. The ML algorithms used in the framework are based on the Random Forest model, which is trained using a custom labelled dataset generated from real/controlled traffic measurements. The dataset includes both legitimate user behaviours and real network threats, such as denial of service attacks and port scans, but it was tested using the CTU-13 dataset [97]. The performance metric of the algorithms that oversee threat detection was the True Positive Rate, and after several tests, it could achieve a 99.99% True Positive Rate. However, the execution time is still a limiting factor and future work aims to improve the algorithm's performance using metaheuristics. The study by [98] showcased a 5G prototype tailored for detecting and mitigating DDoS attacks within sliced networks, focusing on the context of the European project 5G-INSIGHT. This project aims to enhance security features in 5G and beyond, particularly in Vehicle-to-Everything slicing, covering the spectrum from attack detection to mitigation. Their prototype leverages a CNN-based Deep Learning model, implemented using a lightweight, usable CNN in DDoS detection (LUCID) [99] model. LUCID is described as a practical and lightweight solution for deep learning-based DDoS detection, employing CNN features to classify traffic flows as either benign or malicious. The authors constructed a labelled custom dataset to train, validate, and test our DL models. This dataset encompasses synthetic DDoS attack samples alongside benign traffic samples. The prototype employs a sinkhole-type slice strategy to mitigate attacks, isolating malicious users within slices with limited physical resources. The authors claim that the prototype achieves an impressive accuracy rate of nearly 97%.