# PALANTIR: An NFV-Based Security-as-a-Service Approach for Automating Threat Mitigation
## 2 Related Work
### NFV Usage for Cybersecurity  
The European Telecommunications Standards Institute (ETSI) proposed, in NFV-001 [10], the NFV architecture, aimed at transforming the way networks are architected. NFV evolves standard IT virtualisation technology, consolidating or homogenising the management of the logic distributed across the infrastructure, i.e., a varying amount of network devices or high-volume servers; these can be located at different Points of Presence(PoPs) such as DCs, network nodes, or end-user premises. To that end, nine use cases were provided, targeting scenarios involving infrastructure, platforms, and software as a service, with others related to the virtualisation of mobile base stations or fixed access networks, among others. The final architecture was proposed in NFV-002 [11], and can be roughly divided into three main building blocks: (i) the deployed services as VNFs, (ii) the NFV Infrastructure (NFVI), and (iii) the NFV Management and Orchestration (MANO). Each Network Service (NS) contains one or more VNF, which virtualises logic in the form of VMs or containers and allows its internal management via an Element Management System (EMS). The second block (NFVI) is the physical substrate providing the logical resources, managed by the Virtualised Infrastructure Manager (VIM), to virtualise the NS instances with specific virtualisation; it also hosts other leveraged tools. Finally, the MANO is in charge of managing the life cycles of the NSs (mostly deployment- and configuration-wise) by appropriately instructing the VIM, and consequently overseeing the involved resources. The application of the NFV framework is a challenge largely explored in the literature. For instance, the z-TORCH framework [12] presents automated NFV-based orchestration and monitoring reconfiguration mechanisms, which base its placement decisions on the profiling (carried out by Machine Learning) of Key Performance Indicators for the monitored NS instances. In the same manner, T-NOVA [13] proposes a software-based MANO stack for NFV-based infrastructures. This framework is focused on the NFVI resources, and develops a mechanism to assign resources, taking into account the particular characteristics and needs of the VNF workload. To that end, their monitoring system analyses the NFVI resources and the status of the NS instances. In edge scenarios, the LightMANO architecture [14] enables the deployment of a MANO framework in a massively distributed environment, exploring conditions such as the lack of resources available in the multiple scenarios where the system can be deployed. The LightMANO components are based on lightweight virtualisation technologies, such as containers; thus, the architecture is more suitable for the Multi-Access Edge Computing (MEC) paradigm. Another example is that of LASH-5G [15], which integrates service chaining for an end-to-end, VNF-based orchestration system to dynamically steer and adapt trafficdepending on latency and reliability needs. When aiming to achieve high performance in network processing, the P4 NFV architecture [16] allows deploying HW-accelerated Network Function (NF) implementations. This work argues that NF-based implementations are purely based on SW and, as such, they cannot achieve requirements for a large enough bandwidth (e.g., meeting a line rate processing target, mostly for small packets) or the optimal computing needs, if compared with specific-purpose implementations. P4 allows developers to create HW- and SW-based networking devices that P4 NFV combines with the NFV architecture in order to use hybrid infrastructure resources. NFV is widely leveraged by 5G-based environments. For instance, [PERSON] et al. [17] explore the integration of two different and complex domains: (i) a 5G radio access network and (ii) Small Unmanned Aerial Vehicles (SUAVs). In this instance, NFV environments of different types are onboard the SUAVs, which are then deployed to serve 5G connectivity in remote or rural areas.