Modeling NFV Deployment to Identify the CrossLevel Inconsistency Vulnerabilities By providing network functions through software running on standard hardware, Network Functions Virtualization (NFV) brings many benefits, such as increased agility and flexibility with reduced costs, as well as additional security concerns. Although existing works have examined various security issues of NFV, such as vulnerabilities in VNF software and DoS, there has been little effort on a security issue that is intrinsic to NFV, i.e., as an NFV environment typically involves multiple abstraction levels, the inconsistency that may arise between different levels can potentially be exploited for security attacks. In this paper, we propose the first NFV deployment model to capture the deployment aspects of NFV at different abstraction levels, which is essential for an indepth study of the inconsistencies between such levels. Based on the model and an implemented NFV testbed, we present concrete attack scenarios in which the inconsistencies are exploited to attack the network functions in a stealthy manner. Finally, we study the feasibility of detecting the inconsistencies through verification.

Costefficient virtual network function chaining over NFVbased telecommunications networks Network Function Visualization (NFV) enables the softwarization of network functions on standardized commodity hardware, which is promising to help the network carriers to achieve a lower investment cost, a shorter time to deployment, as well as a more flexible and dynamic way of network configuration and management. One of the key challenges is how to efficiently place and chain the softwarebased virtual network functions in the physical substrate to provision the requested network service while minimizing the physical network cost. In this paper, we mathematically formulate the virtual network function chaining problem using Integer Linear Programming (ILP), in order to facilitate an optimal solution. In addition, we propose a set of heuristic algorithms to efficiently solve this problem. The proposed Close To Destination (CTD) algorithm can achieve a nearoptimal physical network cost that is close to the optimal result obtained from the ILP solution, but with a very low computational complexity. Comprehensive simulations are conducted to evaluate the proposed approaches, and the results demonstrate the effectiveness of the proposed CTD algorithm.