# PALANTIR: An NFV-Based Security-as-a-Service Approach for Automating Threat Mitigation
## 7 Conclusions and Future Work  
In this paper, we present a security incident remediation strategy which targets cloud, edge, and on-premises environments to protect MEs and SMEs against an extendable set of cyber threats. A security ontology was presented and complemented by service-matching functionality delivered as a constraint-satisfaction problem. The functionality was used to determine the most pertinent security mechanisms by leveraging relevant cyber threats against the financial impact the deployment will impose on the business. We detail a policy format based on finite state machines to define and personalise an automated remediation procedure acting on the life cycle and local configuration of security mechanisms. We also propose three deployment models to ensure the adaptability and the pervasiveness of the deployment and operation of security mechanisms to different environments, as featured by two motivating cases in different verticals. We cover the blueprint of the security orchestrations supervising the life cycle of security enabler, highlighting the similarities with reference framework such as ETSI NFV MANO and SBI. We justify an extensive architecture enacting remediation procedures and implemented a proof-of-concept prototype utilised for quantitative evaluation of the performance of the remediation procedures in different deployment models. Our work opens the door to several research opportunities. First, our ontology could be further refined to integrate specific properties of the resources to protect. We envision we could extend the service matching process to take this dimension into account, leveraging some new opportunities for remediation automation. In particular, accounting for the available monitoring information and configuration interfaces exposed by the resources needing protection could improve the selection of the technical security mechanisms to leverage. The implementation of security capabilities could be optimised to align with \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Experiment** & **Environment** & **SC** & **Mean (s)** & **Median (s)** \\ \hline \multirow{4}{*}{Instantiation} & \multirow{4}{*}{Full} & ipnetflow\_ns & 47.798 & 47.403 \\  & & snort\_ns & 65.609 & 65.419 \\  & & suricata\_ns & 63.811 & 63.361 \\  & & (Aggregated) & 59.073 & 63.361 \\ \cline{2-5}  & \multirow{4}{*}{Constrained} & ipnetflow\_ns & 50.125 & 49.517 \\  & & snort\_ns & 66.748 & 66.342 \\  & & suricata\_ns & 66.587 & 65.695 \\  & & (Aggregated) & 61.153 & 65.695 \\ \hline \multirow{4}{*}{Reinstantiation} & \multirow{4}{*}{Full} & ipnetflow\_ns & 101.576 & 100.747 \\  & & snort\_ns & 120.043 & 119.478 \\ \cline{1-1}  & & suricata\_ns & 118.564 & 117.843 \\ \cline{1-1}  & & (Aggregated) & 113.394 & 117.843 \\ \cline{1-1} \cline{2-5}  & \multirow{4}{*}{Constrained} & ipnetflow\_ns & 104.049 & 103.054 \\ \cline{1-1}  & & snort\_ns & 123.275 & 121.932 \\ \cline{1-1}  & & suricata\_ns & 121.451 & 119.651 \\ \cline{1-1}  & & (Aggregated) & 116.258 & 119.651 \\ \hline \multirow{4}{*}{Configuration} & \multirow{4}{*}{Full} & ipnetflow\_ns & 1.816 & 1.788 \\ \cline{1-1}  & & snort\_ns & 1.815 & 1.8 \\ \cline{1-1}  & & snort\_ns & 1.802 & 1.781 \\ \cline{1-1}  & & (Aggregated) & 1.811 & 1.788 \\ \cline{1-1} \cline{2-5}  & \multirow{4}{*}{Constrained} & ipnetflow\_ns & 1.793 & 1.739 \\ \cline{1-1}  & & snort\_ns & 1.804 & 1.764 \\ \cline{1-1}  & & snucata\_ns & 1.787 & 1.783 \\ \cline{1-1}  & & (Aggregated) & 1.795 & 1.764 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Summary of detailed statistic values per experiment, environment, and SC. specific features of the resources, limiting their impact on the performance of the customer's environment. Consequently, the composition of SC capabilities could also be regarded to cover a set of heterogeneous resources. Our ontology could be extended in that direction to introduce a dependency declaration, and the SM could evaluate their fulfillment.