[Paper Review] Learning-Assisted Secure End-to-End Network Slicing for Cyber-Physical Systems

Qiang Liu, Tao Han+1 more|arXiv (Cornell University)|Oct 29, 2019

Software-Defined Networks and 5G12 references4 citations

TL;DR

This paper proposes a learning-assisted end-to-end network slicing framework for cyber-physical systems that dynamically allocates radio and computing resources across multi-domain infrastructure to enhance security and performance under denial-of-service (DoS) attacks. By leveraging a reinforcement learning-based resource allocation strategy, the system identifies and avoids compromised nodes, maintaining high slice performance even during attacks, as validated in simulations and a small-scale testbed with improved resilience compared to baseline methods.

ABSTRACT

There is a pressing need to interconnect physical systems such as power grid and vehicles for efficient management and safe operations. Owing to the diverse features of physical systems, there is hardly a one-size-fits-all networking solution for developing cyber-physical systems. Network slicing is a promising technology that allows network operators to create multiple virtual networks on top of a shared network infrastructure. These virtual networks can be tailored to meet the requirements of different cyber-physical systems. However, it is challenging to design secure network slicing solutions that can efficiently create end-to-end network slices for diverse cyber-physical systems. In this article, we discuss the challenges and security issues of network slicing, study learning-assisted network slicing solutions, and analyze their performance under the denial-of-service attack. We also present a design and implementation of a small-scale testbed for evaluating the network slicing solutions.

Motivation & Objective

• To address the challenge of creating secure, end-to-end network slices for heterogeneous cyber-physical systems with diverse QoS requirements.
• To identify security vulnerabilities in multi-domain network slicing, particularly under DoS attacks that degrade performance and compromise isolation.
• To design and evaluate a learning-assisted resource allocation mechanism that improves resilience and maintains slice performance during attacks.
• To implement and validate the solution in a small-scale testbed to demonstrate real-world feasibility and performance under attack conditions.

Proposed method

• The framework uses a learning-assisted algorithm to dynamically allocate virtual radio and computing resources across network nodes based on real-time resource utilization and channel conditions.
• A radio resource hypervisor maps virtual radio bandwidth (e.g., 360kHz) to physical PRBs in LTE, using a greedy selection strategy based on channel quality to maximize throughput.
• A CUDA-based kernel scheduler manages GPU computing resources via a token system, where tokens represent virtual computing capacity and kernels are executed in FIFO order when tokens are available.
• The learning-based controller monitors resource utilization efficiency across nodes and reroutes traffic away from underperforming or compromised nodes during DoS attacks.
• The system employs a token-based scheduler to enforce virtualized computing resource isolation and prevent resource exhaustion.
• The testbed prototype integrates virtualized radio and computing resources across two network nodes, supporting three slices and six users, with real-time monitoring and attack simulation.

Experimental results

Research questions

• RQ1 How does multi-domain network slicing performance degrade under denial-of-service (DoS) attacks, and what are the key failure points in resource orchestration?
• RQ2 Can a learning-assisted resource allocation strategy detect and mitigate the impact of DoS attacks on end-to-end network slices in cyber-physical systems?
• RQ3 How does the performance of learning-assisted slicing compare to traditional baseline algorithms under sustained DoS attacks?
• RQ4 To what extent can learning-based adaptation maintain slice isolation and service quality when physical infrastructure is under attack?

Key findings

• The learning-assisted algorithm successfully identified and avoided nodes under DoS attack by prioritizing resource allocation to high-efficiency nodes, maintaining stable slice performance.
• Under DoS attack, the learning-based approach maintained resource allocation to network slices 1 and 3 on nodes 1 and 2, respectively, ensuring continued service delivery.
• In contrast, the baseline algorithm failed to adapt to the attack, resulting in complete resource loss and performance degradation for affected slices.
• The testbed results confirmed that the learning-assisted system achieved higher resilience and better resource utilization efficiency during attacks compared to non-learning baselines.
• The system demonstrated effective isolation of attack impact through dynamic rerouting and adaptive resource control, preserving functionality of unaffected slices.
• The prototype successfully validated the feasibility of end-to-end network slicing with joint radio and computing resource management in a real-world test environment.