# PALANTIR: An NFV-Based Security-as-a-Service Approach for Automating Threat Mitigation
## 4 PALANTIR General Architecture for Threat Remediation
### Deployment Models  
To further tailor to different customers' needs, PALANTIR foresees three Security-as-a-Service-based deployment models related to lightweight (on-premise), edge, and cloud scenarios. These are depicted in Figure 2, showing two main layers:  
* _Central layer:_ First, and common to all deployment models, the upper, central layer introduces the PALANTIR components that have some degree of observation of the overall procedures, e.g., those requiring support for multi-tenancy (both regarding customers, as organisations, and their infrastructures). These are the Portal, the SCC, the SM, and the SO. * _Processing layer:_ In contrast, the lower, processing layer shows the components running at a site local to or near the deployment infrastructure, used to instantiate the SCs and to operate closer to the infrastructure and captured data. These include the IR, the SCHI, the deployed SCs, and other components of the PALANTIR framework that are not described in this work. Firstly, the Lightweight deployment model defines the minimum PALANTIR architecture to deploy as a Customer Premises Equipment (CPE) in the client infrastructure itself. This CPE includes the infrastructure (SCHI) and running SCs, as well as other PALANTIR components that ensure the correct operation in a PALANTIR-in-a-box approach, such as the IR component. Within this deployment model, a minimum SC service chaining is defined to deliver a functional block with filtering, IDS, and SIEM capabilities. It is worth noting that the filtering SCs shall be allocated and will act as the client router to ensure proper operation. The Edge deployment model delivers the PALANTIR capabilities following a Mobile Edge Computing (MEC) paradigm in the network edge. This approach allows PALANTIR to provide protection to multiple tenants, and is mainly designed for 5G scenarios. In this case, PALANTIR favours deployment at the network edge, leveraging the increment of resources available, in contrast with the Lightweight deployment model. Finally, the Cloud deployment model covers scenarios that can combine different clouds used by the client. Here, the SCs can be deployed in one of the available cloud infrastructures. A preliminary, qualitative comparison across each deployment model is given in Figure 3, which represents the perceived degree of fulfillment of a set of dimensions of interest (i.e., desired features) in every deployment model, and from the perspective of the end-user, whose organisation is being protected. Some of these may be expected to be minimised (bandwidth usage, all forms of cost, the required expertise needed to operate), whilst others should be maximised (customisation potential and the ease to scale). In this sense, [PERSON] et al. (2019) provided a comparison between public and private clouds, introducing characteristics that partially overlap with the dimensions here considered, as well as extending with others and providing the modelling and formulation for their analysis. The Lightweight scenario fares best regarding its degree of customisation and the reduced bandwidth usage, products of most operations occurring onsite; however, this is at the expense of a high down payment to setup the required equipment and the need of a medium-to-high degree of expertise to setup the networking and possibly to understand some of the concepts of the configuration of the platform to be deployed. On the other hand, both the Edge and Cloud scenarios may fare best in terms of economic cost, regarding both the initial setup (which may be understood to be somewhat higher for the Edge scenario if assuming the higher scale at which the public cloud operators work compared to some network providers) and the maintenance cost. In both cases, operational expertise required by the user is relatively low. There is a perceived higher degree of customisation in the  
Figure 3: Comparison across deployment models.