Slicing and Filtering security orchestration for cyberattacks mitigation in 5G/6G networks

Abstract

In an increasingly complex and heterogeneous network environments, to ensure robust and adaptable security requires coordination between multiple technologies and platforms. Traditional monolithic security approaches are no longer sufficient to respond to dynamic threats and to integrate the diverse set of tools, protocols, and systems used in modern infrastructures. This paper presents a multi-technology Security Orchestrator (SO) designed to bridge this gap by automating and harmonising the implementation and enforcement of security policies across distributed and heterogeneous domains, acting as SECaaS. The SO acts as an intermediary layer, capable of translating high-level security requirements into technology-specific configurations and dynamically adapting them to the underlying infrastructure. It leverages a modular architecture and model-based approach to support extensibility and interoperability between various technologies, including firewalls, SDN controllers, Virtualised Network Functions (VNFs), and endpoint protection systems. To evaluate its performance, a total of 176 policies are submitted concurrently across two domains, combining both firewall and network slicing mitigation strategies. The orchestrator successfully enforced all policies while adapting to their distinct requirements: firewall rules are applied in parallel, with an average enforcement time of 0.93 seconds per rule, whereas slicing operations (CREATE SLICE and ATTACH FLOW TO SLICE) required sequential enforcement due to dependency constraints, reaching approximately 1.3 seconds per rule. Despite these differences, the orchestrator completed all enforcement operations, including 160 slicing-related policies and mitigated the ongoing attacks in both domains. These results confirm the orchestrator’s ability to handle heterogeneous, large-scale mitigation processes efficiently, while maintaining consistency and reducing human intervention and demonstrate its effectiveness in multi-domain scenarios.