Towards the autonomous provision of self-protection capabilities in 5G networks

5G mobile networks are pushing new dynamic and flexible scenarios that demand the automation and optimization of network management processes. In this sense, Self-Organizing Networks (SON) arose to evolve from traditional manual management towards fully autonomic and dynamic processes. Due to the large volumes of data generated in 5G networks, functionalities and capabilities of SON require efficient processes and resource optimization techniques. In particular, self-protection is a critical capability of SON focused on protecting the network resources in a flexible and autonomic way. To achieve self-protection, SON perform different processes ranging from the monitoring of network communications to the analysis, detection, and mitigation of cyber-attacks. In this article, we propose an architecture that combines the Software Defined Networking and Network Functions Virtualization technologies to optimize the usage of network resources for monitoring services. A use case based on botnet detection in 5G networks shows how our architecture ensures the provision of monitoring services in managing self-protection scenarios. Additionally, we describe a set of experiments that confirm the best time calculated by our solution to deploy or reconfigure monitoring and detection services. These experiments consider different aspects like the number of zombies shaping the botnet, their mobility, or network traffic.