TeraFlow - Cybersecurity

Nowadays, when an operator moves towards an automated environment, security becomes a key feature since network operations are done by software components operating without human intervention or oversight. Moreover, the pervasive softwarisation of network and infrastructure components is further increasing their attack surface. Indeed, security must undergo a similar technological evolution to enable the resilience of SDN controllers: automation of security policies over the network, use of Machine Learning (ML) to detect and identify attacks, utilisation of DLT to ensure configuration and forensic capacity, and deployment of NFV security functions.

This scenario demonstrates a combination of innovative solutions that are scalable in a production environment and resilient to sophisticated attacks in a common framework that integrates different security technologies to detect, identify, and mitigate both traditional and new generations of attacks across different technology domains, e.g., optical and IP layers. At the control plane, the SDN controller and the ML models that support its operations may also be the target of malicious attacks.

The scenario proposes a setup for the Layer 3 cybersecurity experiments that allow reproducing previously recorded crypto-mining attacks. We first capture packets from the crypto mining attack reproduced in the setup environment. Second, the optical physical layer attacks aim to reproduce previously-capture Optical Performance Monitoring (OPM) data from malicious attack conditions.