ARMOR: An Architecture for Diagnosis and Remediation of Network Misconfigurations SDN and NFV propose the use of softwarebased solutions to perform functions that historically have been implemented by physical devices. The use of softwarebased solutions can introduce misconfiguration in critical network services, such as routing inconsistencies. This paper proposes and evaluates ARMOR, an architecture for handling network misconfigurations when different types of softwarebased components are inserted or removed from the network. ARMOR is capable of monitoring softwarebased solutions using network information gathering mechanisms, such as SNMP, SFlow and REST API. Additionally, it is capable of identifying and addressing configuration issues using historical remediation schemes and machine learning techniques. As a result, the ARMOR architecture is a flexible mechanism to monitor and remediate network misconfigurations.

Modeling NFV Deployment to Identify the CrossLevel Inconsistency Vulnerabilities By providing network functions through software running on standard hardware, Network Functions Virtualization (NFV) brings many benefits, such as increased agility and flexibility with reduced costs, as well as additional security concerns. Although existing works have examined various security issues of NFV, such as vulnerabilities in VNF software and DoS, there has been little effort on a security issue that is intrinsic to NFV, i.e., as an NFV environment typically involves multiple abstraction levels, the inconsistency that may arise between different levels can potentially be exploited for security attacks. In this paper, we propose the first NFV deployment model to capture the deployment aspects of NFV at different abstraction levels, which is essential for an indepth study of the inconsistencies between such levels. Based on the model and an implemented NFV testbed, we present concrete attack scenarios in which the inconsistencies are exploited to attack the network functions in a stealthy manner. Finally, we study the feasibility of detecting the inconsistencies through verification.