Skip navigation
ericsson.com
Ericsson Montreal office

Concordia university

Strategic academia partner

Research and competence provisioning with Concordia University, Canada

Ericsson and Concordia University have a long history of academic and industrial collaboration, which includes the creation of three Research Chairs and an innovative, tailor-made AI upskill program for Ericsson employees, as well as dozens of internships. Taking the collaboration to the next level, a formal strategic long-term partnership was signed in 2024.

Introduction

Security, cloud, and artificial intelligence (AI) are the key topics in the Ericsson – Concordia collaboration. The bulk of the efforts are in research, where Ericsson and Concordia teams work on joint projects aiming to drive advancements in cybersecurity, artificial intelligence, cloud computing, and the future of 5G and 6G telecom networks. More than 60 published scientific research articles and almost 40 proof-of-concept project demonstrations are among the milestones achieved over the years.  

In addition to research, educational development, staff training, innovation, and extensive internship offerings are important elements of the partnership. 

The Gina Cody School of Engineering and Computer Science is Ericsson’s main partner organization at Concordia University.  

Ericsson supports three industrial research chairs:

  • the NSERC/Ericsson Industrial Research Chair in Software-Defined Networking and Network Functions Virtualization Security
  • the NSERC/Ericsson Industrial Research Chair in Model Based Software Management
  • the Ericsson/ENCQOR-5G/MITACS Senior Industrial Research Chair in Cloud and Edge Computing for 5G and Beyond. 

Select individual Ericsson employees hold affiliate staff positions at Concordia, including an Associate Professor. 

Tailored AI upskilling is done together with the Applied AI Institute and the Faculty of Arts and Science.

Gina Cody School of Engineering and Computer Science

With over 233 faculty members, 44 research chairs, and over 10,150 students, the School offers 47 programs handled by its 7 departments. Graduate programs include information system security, computer science, applied AI, and software engineering. 

In addition to world-class skills in cyber security, AI, and cloud and edge computing, the school is part of extensive academia and government ecosystems and is characterized by high levels of funding, making it a thriving environment for interdisciplinary research.

Did you know: The Gina Cody school is the only engineering school in the world named after a woman.

Main areas of joint research

Evolving the future of 5G security

Evolving the future of 5G security

5G mobile networks are relying on the latest technologies such as cloudification and softwarization at the core as well at the access side of the network to unlock their full value by becoming more agile, flexible, and scalable. This evolution brings new security challenges, which mandates for new and evolved solutions, particularly related to security compliance, verification, and assurance.

In the collaboration, Concordia and Ericsson security research teams are leveraging previous joint work on cloud security compliance auditing to tackle new security challenges – a move which is critical to the future of critical domains such as the Internet of Things (IoT). 

Explore now
AI and automation for network security

AI and automation for network security

The rapid evolution of 5G and beyond telecommunication networks supported by Artificial Intelligence (AI), requires continuous assessment and updates of network security.

In collaboration with Concordia University, the University of Waterloo, and the University of Manitoba; Ericsson security research is leveraging its collaborative partnership with the National Cybersecurity Consortium (NCC) under the Cyber Security Innovation Network (CSIN), to drive toward innovative AI-based cybersecurity solutions as part of the Government of Canada’s Cyber Security Innovation Network.

The project Building cyber-resilient and secure 5G networks through automation and AI aims to provide mobile operators with automated, closed-loop security control mechanisms to protect their network against potential attacks that can affect their network availability and reliability, while guaranteeing seamless services for their customers with the desired Quality of Service (QoS). 

Explore now
Cloud and edge computing for 5G and beyond

Cloud and edge computing for 5G and beyond

Achieving 5G performance characteristics entailed use of several innovative technologies in the design of the 5G network. Cloud and edge computing is one of the technologies critical to reaching 5G network performance, scalability, availability and deployment requirements. In contrast to cloud computing, where processing takes place in the central cloud, edge computing is when processing tasks are distributed and processed closer to the source of the data. This allows to decrease the delays in processing and, therefore, increase the data traffic bandwidth.

The Industrial Research Chair program between Concordia University and Ericsson cloud research targets several research areas related to 5G network, including architectures and algorithms for future edge cloud, edge cloud management based on use of machine learning (ML) and AI technologies, advanced computing architectures. Investigation of Intent-based architectures, for allowing to replace the human intervention in the management and operation flow, is in scope as well.

Explore now

Evolving the future of 5G security

5G mobile networks rely on the latest technologies such as cloudification and softwarization to unlock their full value by becoming more agile, flexible, and scalable. This evolution brings new security challenges, which mandates for new and evolved solutions, particularly related to security compliance, verification, and assurance.

Ericsson security research and Concordia are leveraging earlier collaborations on cloud security compliance auditing to tackle new security challenges – key to the future of critical domains such as the Internet of Things (IoT).

Explore Evolving the future of 5G security

Blending expertise

Secure cloud and 5G

Security compliance verification in 5G

Blending expertise

Blending expertise

The collaboration brings together Ericsson's strong tradition of security research and development with Concordia's advanced capabilities within information systems engineering and cyber security in the field of cloud computing.

The two organizations have been working within the NSERC/Ericsson Industrial Research Chair since 2019 to address the need for developing new approaches of security that are more adaptable to the underlying technology of the next generation mobile network core and edge, particularly Network Functions Virtualization (NFV) and Software-Defined Networking (SDN), and its inherent characteristics.

The ultimate goal is to design and build proof concepts of a toolkit offering a scalable, automated, and efficient solutions and algorithms that meet the needs of the cloudification of 5G mobile networks.

For example, the security of NFV cannot be tackled without considering the multi-layered aspect of NFV and correlation between those layers. Additionally, the benefits from NFV/SDN comes from its enabled automation and orchestration, which result in a dynamically and frequently changing environment. Thus, the use of manual traditional solutions become dramatically costly and inefficient. Furthermore, the project has rapidly adapted to observed technology changes by steering research to the new containerized environments.  

Back to Evolving the future of 5G security

Secure cloud and 5G

Secure cloud and 5G

Targeting the different layers of the stack forming the next generation mobile network, the project proposes several solutions addressing different security and privacy aspects. The collaboration has led to several scientific publications in top tier security conferences and journals. Significantly, successful proofs-of-concept have also been built and demonstrated both inhouse and to Ericsson customers.

Those solutions encompass the full life cycle from monitoring the security compliance of SDN/NFV-based virtual infrastructures, detecting misconfigurations or attacks causing compliance breaches, and mitigating the detected threats proactively.

The project encompasses five different research themes

Tenant-level security auditing

ChainPatrol: Balancing Attack Detection and Classification with Performance Overhead Using Virtual Trailers

Outsourcing 5G network functions to third-party cloud providers can enhance deployment flexibility and cost-efficiency, but it can limit a cloud tenant's ability to directly monitor their cloud-level deployments for detecting attacks particularly against the integrity of forward paths of service chains. Current solutions either require direct cloud access or add performance overhead to network traffic. Our researchers have developed a smart and out-of-the-box lightweight tenant-based solution named ChainPatrol, that encodes "virtualized'' cryptographic trailers as side-channel watermarks within the traffic, enabling transmission without adding extra bits to packets. ChainPatrol was presented at the prestigious 33rd Usenix Security conference 2024, one of the top four security conferences.

Read the paper  

A Tenant-based Two-stage Auditing Approach Hosted on Third-Party Clouds

An increasing trend involves hosting chains of Virtual Network Functions (VNFs) on third-party clouds for cost-effective deployment. However, this setup can lead to undetectable discrepancies between tenant-level specifications of VNF chains and their deployment on cloud providers. To address this, our research team proposed a two-stage solution that uses tenant-level side-channel information to detect integrity breaches and then automatically identifies and anonymizes selected provider-level data for tenant verification. The advantages of our solution include providing tenants with more control and transparency, as well as achieving higher accuracy in breach detection. This research has been published in the 13th ACM Conference on Data and Application Security and Privacy (CODASPY 2023).

Read the paper 

Non-disruptive enforcement and mitigation of security attacks

Phoenix: Surviving Unpatched Vulnerabilities via Accurate and Efficient Filtering of Syscall Sequences

Unpatched vulnerabilities represent one of the most critical concerns for businesses that rely on software-based services. Our joint research team explored the research question “How to safeguard cloud-based applications from unknown vulnerabilities, as well as known vulnerabilities for which no patch is currently available, while ensuring uninterrupted and timely service delivery?” The result was Phoenix, a solution for preventing exploits of unpatched vulnerabilities by accurately and efficiently filtering sequences of system calls identified through provenance analysis. The solution is explained in the recently published conference paper Phoenix in the Network and Distributed System Security Symposium (NDSS) 2024, one of the top four security conferences in the world.

Read the paper

Read our blog  

ProSaS - proactive security compliance auditing system for the Cloud

ProSaS, published in the IEEE Transactions on Dependable and Secure Computing (TDSC) journal, proposes a proactive security compliance auditing system for Clouds. This revolutionizes the traditional retroactive approach by enabling the prediction of future critical events, based on ML-learned dependency model. Then, it proactively verifies the potential impacts of those future events on the compliance status and prevents them before they can actually cause violations of security policies. 

Read the paper 

Provenance analysis and security incident investigation

ProvTalk - efficient root cause analysis of security incidents in NFV environments

For a more effective root cause analysis of security incidents in multi-level NFV environments, the project developed a novel solution we call ProvTalk. This solution applies machine learning and a newly defined multi-level provenance graph. ProvTalk tackles challenges stemming from the multi-level aspect of the management stack, the complexity, and the sheer size of operations. ProvTalk provides new features and capabilities, not existing in comparable commercial tools, to increase automation and ease the investigation process through three novel techniques, namely multi-level pruning, mining-based aggregation, and rule-based natural language translation. ProvTalk was presented at the Network and Distributed System Security (NDSS) Symposium 2022, one of the top security conferences.

Read the paper

Read our Blog  

ML guided formal methods for compliance verification

MLFM: Machine Learning Meets Formal Method for Faster Identification of Security Breaches in Network Functions Virtualization (NFV)

Formal method-based security verification is a standard solution for providing rigorous mathematical proofs that the configurations satisfy the desired security properties, or the counterexamples (i.e., misconfigurations). Nonetheless, a major challenge is that the sheer scale of large NFV environments can render formal security verification so costly that the significant delays before misconfigurations can be identified may leave a wide attack window. We propose in MLFM a novel approach that combines the efficiency of Machine Learning (ML) and the rigor of Formal Methods (FM) for fast and provable identification of misconfigurations violating security properties in NFV. Our solution is published in the 27th European Symposium on Research in Computer Security (ESORICS) 2022.

Read the paper

Data anonymization and privacy preservation

R2DP - on automation for differential privacy

R2DP (randomizing the randomization mechanism of differential privacy) automatically optimizes different utility metrics to enable differentially private investigation of data by a third-party analyst using common Machine Learning tools.

R2DP was presented at the top tier ACM Computer and Communications Security Conference (CCS) 2020, one of the top four security conferences in the world.

Read the paper  

iCAT: An Interactive Customizable Anonymization Tool

Today’s data owners usually resort to data anonymization tools to ease their privacy and confidentiality concerns. However, those tools are typically ready-made and inflexible, leaving a gap both between the data owner and data users’ requirements, and between those requirements and a tool’s anonymization capabilities. Our researchers proposed a novel solution named  iCAT, an interactive customizable anonymization tool that allows the data owner and the data user to interact by automatically translating their textual requirements into appropriate anonymization primitives that ensures the mandated privacy level while allowing a desired utility level from the data. iCAT was published in the 24th European Symposium on Research in Computer Security (ESORICS) 2019.

Read the paper

Back to Evolving the future of 5G security

Security compliance verification in 5G and upcoming 6G

Security compliance verification in 5G and 6G

The next stage of the research collaboration will focus on improving even more our security solutions with the advent of the new challenges: more automation to minimize the manual effort and human intervention while providing better assistance to the security expert when his decision is irreplaceable. Furthermore, we will focus on solutions that aim at minimizing the disruption of the service by temporary patching the security breaches to minimizing the damage to the system while waiting for the official patch. This will be an important feature of future solutions if they are to keep up with the high speeds of 5G and the sophisticated upcoming cyber security challenges.

The results of this new research will be highly significant for the industry. From robotics to self-driving cars, 5G will be a critical enabler of many IoT use cases – and all will need to provide evidence that they meet security requirements.

By addressing security and compliance challenges in cloudified 5G networks, Ericsson and Concordia University are helping to make a secure, connected future a reality and preparing the floor for secure next generation services in 6G.

Explore more:

How to survive unpatched vulnerabilities in containers

Can AI speed up the root cause analysis of network security incidents?

Evolving Operational Security Assurance for 5G and Beyond

Security assurance – challenges and 5 tips for a safer connected future

NFV builds 5G trustworthiness through security compliance

Concordia receives $1.8M to improve cybersecurity with the arrival of 5G technology

Back to Evolving the future of 5G security

Back to research areas

AI and automation for network security

The rapid evolution of 5G and beyond telecommunication networks supported by Artificial Intelligence (AI), requires continuous assessment and updates of network security. Building cyber-resilient and secure 5G networks through automation and AI is a project funded by the National Cybersecurity Consortium (NCC) that aims to provide mobile operators with automated, closed-loop security control mechanisms to protect their network against potential attacks that can affect their network availability and reliability, while guaranteeing seamless services for their customers with the desired Quality of Service (QoS).

Using Machine Learning and Artificial Intelligence, the NCC project explores innovative solutions to improve cybersecurity of 5G networks and beyond. The focus of the project revolves around advanced threat hunting, accurate anomaly detection, effective attack prevention, proactive security posture management, and comprehensive attack mitigation strategies.

By tackling the complexity of cybersecurity in telecommunications systems, Ericsson, Concordia University, and their partners, the University of Manitoba and the University of Waterloo, are laying the foundations of a secure, resilient, and connected digital future. ​

Empowered by ML/AI
eyJjb29yZGluYXRlcyI6eyJsZWZ0Ijo0OS4wNiwidG9wIjo0Ljc4fSwiZGVmaW5pdGlvbnMiOnsidGl0bGUiOiJUaHJlYXQgSHVudGluZyIsIm1lc3NhZ2UiOiI8dWw+PGxpPlByb2FjdGl2ZWx5IElkZW50aWZ5IEhpZGRlbiBUaHJlYXRzPC9saT48bGk+RW5oYW5jZSBUaHJlYXQgSW50ZWxsaWdlbmNlPC9saT48bGk+UmVkdWNlIERldGVjdGlvbiBUaW1lPC9saT48L3VsPiIsImxpbmsiOiIiLCJjb2xvciI6IlllbGxvdyIsIm1lZGlhSHRtbE1hcmt1cHMiOltdLCJvcmdhbml6YXRpb24iOltdLCJhbHRUZXh0IjoiVGhyZWF0IEh1bnRpbmciLCJ2aWRlb0RhdGEiOm51bGx9LCJyZWFkYWJsZVR5cGUiOiJwb2ludCJ9
eyJjb29yZGluYXRlcyI6eyJsZWZ0IjoxOS43MiwidG9wIjo4Ni4yMn0sImRlZmluaXRpb25zIjp7InRpdGxlIjoiU2VjdXJpdHkgUG9zdHVyZSIsIm1lc3NhZ2UiOiI8dWw+PGxpPkRldmVsb3AgQXNzZXNzbWVudCBUb29scyBmb3IgNUcgU2VjdXJpdHkgUG9zdHVyZTwvbGk+PGxpPlByZWRpY3QgNUcgU2VjdXJpdHkgUG9zdHVyZTwvbGk+PGxpPkltcHJvdmUgU2VjdXJpdHkgUG9zdHVyZSBUaHJvdWdoIEFjdGlvbmFibGUgSW5mb3JtYXRpb248L2xpPjwvdWw+IiwibGluayI6IiIsImNvbG9yIjoiR3JlZW4iLCJtZWRpYUh0bWxNYXJrdXBzIjpbXSwib3JnYW5pemF0aW9uIjpbXSwiYWx0VGV4dCI6IlNlY3VyaXR5IFBvc3R1cmUiLCJ2aWRlb0RhdGEiOm51bGx9LCJyZWFkYWJsZVR5cGUiOiJwb2ludCJ9
eyJjb29yZGluYXRlcyI6eyJsZWZ0Ijo1LjIyLCJ0b3AiOjM3LjQ0fSwiZGVmaW5pdGlvbnMiOnsidGl0bGUiOiJBdHRhY2sgTWl0aWdhdGlvbiIsIm1lc3NhZ2UiOiI8dWw+PGxpPkRldmVsb3AgTy1SQU4gbWl0aWdhdGlvbiByQXBwPC9saT48bGk+TWl0aWdhdGUgSFRUUC8yIEF0dGFja3M8L2xpPjxsaT5NaXRpZ2F0ZSBOZXR3b3JrIFNsaWNpbmcgQXR0YWNrczwvbGk+PC91bD4iLCJsaW5rIjoiIiwiY29sb3IiOiJPcmFuZ2UiLCJtZWRpYUh0bWxNYXJrdXBzIjpbXSwib3JnYW5pemF0aW9uIjpbXSwiYWx0VGV4dCI6IkF0dGFjayBNaXRpZ2F0aW9uIiwidmlkZW9EYXRhIjpudWxsfSwicmVhZGFibGVUeXBlIjoicG9pbnQifQ==
eyJjb29yZGluYXRlcyI6eyJsZWZ0Ijo3OC4xMSwidG9wIjo4Ni4zM30sImRlZmluaXRpb25zIjp7InRpdGxlIjoiQXR0YWNrIFByZXZlbnRpb24iLCJtZXNzYWdlIjoiPHVsPjxsaT5QcmVkaWN0IEZ1dHVyZSBBdHRhY2tzIGluIDVHIFN5c3RlbXM8L2xpPjxsaT5BbmFseXNlIFJvb3QgQ2F1c2Ugb2YgQXR0YWNrczwvbGk+PGxpPlJlY29tbWVuZCBQcm90ZWN0aXZlIFNlY3VyaXR5IFN0cmF0ZWdpZXM8L2xpPjwvdWw+IiwibGluayI6IiIsImNvbG9yIjoiUmVkIiwibWVkaWFIdG1sTWFya3VwcyI6W10sIm9yZ2FuaXphdGlvbiI6W10sImFsdFRleHQiOiJBdHRhY2sgUHJldmVudGlvbiIsInZpZGVvRGF0YSI6bnVsbH0sInJlYWRhYmxlVHlwZSI6InBvaW50In0=
eyJjb29yZGluYXRlcyI6eyJsZWZ0Ijo5My44OSwidG9wIjozOC4xN30sImRlZmluaXRpb25zIjp7InRpdGxlIjoiQW5vbWFseSBEZXRlY3Rpb24iLCJtZXNzYWdlIjoiPHVsPjxsaT5EZXRlY3QgTy1SQU4gYXR0YWNrczwvbGk+PGxpPkRldGVjdCBIVFRQLzIgQXR0YWNrcyBpbiA1RyBTQkE8L2xpPjxsaT5EZXRlY3QgQW5vbWFsaWVzIGluIDVHIE5ldHdvcmsgU2xpY2luZzwvbGk+PC91bD4iLCJsaW5rIjoiIiwiY29sb3IiOiJQdXJwbGUiLCJtZWRpYUh0bWxNYXJrdXBzIjpbXSwib3JnYW5pemF0aW9uIjpbXSwiYWx0VGV4dCI6IkFub21hbHkgRGV0ZWN0aW9uIiwidmlkZW9EYXRhIjpudWxsfSwicmVhZGFibGVUeXBlIjoicG9pbnQifQ==
Evaluating the Security Posture of 5G Networks by Combining State Auditing and Event Monitoring

Evaluating the Security Posture of 5G Networks by Combining State Auditing and Event Monitoring

A service is usually delivered across a stack of different platforms and technologies. The goal is to understand how these platforms are interconnected and how problems in one platform can affect others and jeopardize the security of the entire service. In this paper, we propose a framework to assess the security posture of a 5G system by analyzing the results of conformance tests, normal traffic, and potential attacks. This includes examining the connections between the service layer components and the supporting infrastructure, as well as the messages exchanged. We also look at traffic at the user and control plane, including potentially malicious traffic. This comprehensive overview helps to determine the security posture of the network. A Bayesian network method is used to enable predictions about the security of the 5G service and help analysts and executives make informed decisions.

This work was presented at the European Symposium on Research in Computer Security 2023.  

  Read the paper  

Evaluating the Security Posture of 5G Networks by Combining State Auditing and Event Monitoring

Automa – Automated Threat Hypotheses and Variants Generation

Threat hypothesis generation is a tedious task that requires a lot of time, effort, and elusive knowledge. In this paper, we propose Automa, which is a novel solution that automates the generation of the most relevant threat hypotheses and their variants using knowledge discovery. Automa uses system telemetry in combination with a knowledge base of existing attacks, techniques, and their relationships to identify the most relevant hypotheses. Automa examines these hypotheses by performing evaluations like similarity, success, likelihood, and criticality assessments. These evaluations rely on the past occurrences of the techniques that are part of a hypothesis in the system telemetry and in the knowledge base.

Automa was published in IEEE Transactions on Network and Service Management 2024.

Read the paper  

Inter-Slice Defender – The Cutting-Edge Solution for Securing Your Network Slices

Inter-Slice Defender – The Cutting-Edge Solution for Securing Your Network Slices

Providing a first-class Quality of Service (QoS) for different applications is essential for an excellent user experience in this world of innovative services enabled by 5G. Network slicing allows seamless transitions between services via dedicated virtual networks called Network Slices (NSs). However, if IoT devices switch between these NSs too frequently, they can trigger Distributed Slice Mobility (DSM) attacks that can lead to Denial of Service (DoS) disruptions. How can you protect your NSs from these DSM threats? Inter-Slice Defender provides an unprecedented level of protection through intelligent detection of DSM attacks. By utilizing advanced monitoring metrics of NSs and a sophisticated Long Short-Term Memory Autoencoder model, Inter-Slice Defender even identifies variants of DSM attacks with high accuracy.

This paper was presented at the IFIP Networking 2024 conference and received the best paper award.  

Read the paper  

5GShield - Elevate Your 5G Service Based Architecture Security

5GShield - Elevate Your 5G Service Based Architecture Security

The 5G core network harnesses the power of Hypertext Transfer Protocol Version 2 (HTTP/2) to enable communication between the Network Functions (NFs) of its Service Based Architecture (SBA). But how can the core network be protected from potential HTTP/2 threats?  5GShield offers an application-layer anomaly detection solution designed specifically for 5G telecommunication networks. By using Machine Learning (ML) model, namely, an Autoencoder, 5GShield learns from NF’s performance measurement counters and key performance indicators to detect HTTP/2 anomalies.

This paper was presented at the IFIP Networking 2023 conference.

Read the paper

Accurify – Automated New Testflows Generation for Attack Variant

Accurify – Automated New Testflows Generation for Attack Variant

The manual creation and execution of testflows to test the attacks and their variants generated by threat hunting systems is still a tedious task that requires elusive knowledge and is time-consuming. Accurify is a novel solution that automates the generation of new testflows to test the existence of attack variants using machine reasoning. This solution finds similar previously encountered cases from a security playbook and then reuses them to generate and adjust new testflows tailored for the attack variant in question.

Accurify was presented at the Foundations and Practice of Security (FPS 2023).

Read the paper

Signaling Storm in Open RAN – Everything You Need to Know

Signaling Storm in Open RAN – Everything You Need to Know

Signaling Storm is one of the known attacks that can trigger a Denial of Service (DoS) in the Radio Access Network (RAN). With the transition to RAN disaggregation in the Open RAN (O-RAN), the dynamics of signal exchange between the RAN components continue to evolve. But how does such RAN disaggregation affect the security of the RAN against signaling storms? This article explores the various facets of signaling storms in O-RAN and provides insights into how the key benefits of O-RAN can be leveraged to protect the network from signaling storm attacks.

This article was published in the IEEE Communications Magazine 2023.

Read the paper

Synchronization Plane in O-RAN – Overview, Security and Research Directions

Synchronization Plane in O-RAN – Overview, Security and Research Directions

Open Radio Access Network (O-RAN) is revolutionizing the RAN with its promise of smarter automation, vendor flexibility, and cutting-edge technology. O-RAN also supports open RAN interfaces. But how do these improvements affect RAN’s security? In this article, we delve into the security of the Open Fronthaul interface, specifically the Synchronization plane (S-plane), which ensures time synchronization between the Open Radio Unit and the Open Distributed Unit. We provide a comprehensive discussion about the security of the O-RAN S-plane and potential threats related to the synchronization protocols.  We discuss important and effective countermeasures that can be implemented to protect O-RAN.

This article was published in the IEEE Communications Magazine 2024.

Read the paper

Survey on Threat Hunting in Enterprise Networks

Survey on Threat Hunting in Enterprise Networks

Threat hunting is a proactive line of security practiced uncovering stealthy attacks, malicious activities, and suspicious entities that may evade standard detection mechanisms. This survey examines the threat hunting concept and provides a comprehensive review of existing solutions for enterprise networks. In particular, the study provides a taxonomy of threat hunting based on the used techniques and a sub-classification based on the employed approach. In addition, the study discusses the existing standardization efforts, provides a qualitative discussion on current advances, and identifies various research gaps and challenges that can be considered by the research community.

This survey was published in the IEEE Communications Surveys and Tutorials 2023 and received the IEEE Communication Society Best Survey Paper Award.

Read the paper

A Security Assessment of HTTP/2 Usage in 5G Service Based Architecture

A Security Assessment of HTTP/2 Usage in 5G Service Based Architecture

5G networks have adopted a Service Based Architecture (SBA) encompassing a set of telecommunication Network Functions (NFs) to enable seamless connected services. To meet the high demands for low latency and reduced communication overhead, HTTP/2 has become a key player.  How HTTP/2 affects the security of 5G core networks? In our latest article, we explore the security landscape of 5G SBA with HTTP/2. We present and discuss key protection strategies and best practices to leverage the full potentials of this protocol to securely maximize the 5G benefits.

This article was published in the IEEE Communications Magazine 2022.

Read the paper

Explore more:

Back to research areas

Cloud and edge computing for 5G and beyond

Achieving 5G performance characteristics entailed use of several innovative technologies in the design of the 5G network. Cloud and edge computing is one of the technologies critical to reaching 5G network performance, scalability, availability and deployment requirements. In contrast to cloud computing, where processing takes place in the central cloud, edge computing is when processing tasks are distributed and processed closer to the source of the data. This allows to decrease the delays in processing and, therefore, increase the data traffic bandwidth.

The Industrial Research Chair program between Concordia University and Ericsson cloud research targets several research areas related to 5G network, including architectures and algorithms for future edge cloud, edge cloud management based on use of ML/AI technologies, advanced computing architectures. Investigation of Intent-based architectures, for allowing to replace the human intervention in the management and operation flow, is in scope as well.

Cloud and edge computing for 5G and beyond

Overcoming Challenges in Telco Network Function Deployment and Management

This research investigates the use of advanced Network Function Virtualization (NFV) techniques for overcoming challenges in the deployment and management of network functions within telco and cloud environments. NFV enables the implementation of network functions as software-based Virtual Network Functions (VNFs), organized into VNF-Forwarding Graphs (VNF-FGs) to manage data flow within a Network Service (NS). Several key challenges are explored: dynamic resource dimensioning, which involves determining the optimal resources for VNFs while considering their interdependencies and complex topologies; cost-effective embedding of VNF-FGs, requiring efficient decomposition and placement of VNFs to minimize costs while meeting service requirements; upgrading microservices, which involves managing version dependencies, user migration, and resource utilization; and overcoming causality issues in VNF embedding, which can affect deployment efficiency. Solutions e.g. cost-aware algorithm for VNF-FG decomposition and embedding, heuristic algorithm for microservices upgrading, h-horizon sequential greedy look-ahead embedding algorithm, are investigated. In addition, this research explores cost-optimized dynamic resource dimensioning strategies for VNF-FG which take into account the target performance.

Read the paper

Automating Service Graph Generation for Cloud-Native Applications

Scope of this research is the automation of cloud-native deployments, for ensuring seamless delivery of services and applications in 5G networks. Communication Service Providers (CSPs) work to meet increasing user demands and stringent performance standards. Accordingly, it becomes essential that cloud services and applications are deployed with stringent availability, latency and throughput requirements. Manually composing and deploying cloud-native applications is not only time-consuming, but also prone to errors leading to inconsistent performance, resource inefficiency, and potential downtime. A key aspect of meeting these requirements is the generation of a service graph. This involves specifying various elements within the graph, such as Virtual Network Functions (VNFs), microservices, or network components, and defining how they interact to fulfill the necessary requirements. To address these challenges, we investigate solutions for automating the service graph generation process and for selecting the configuration/s that meet the requirements specified for the deployment in the cloud environment.

Read the paper

Prevention Ecosystem for Maintaining Application Performance in Distributed Cloud Environments

Mission critical applications have to be reliable and available with a guaranteed QoS. Distributed, heterogeneous clouds are key enablers for these applications. However, applications deployed in such cloud environment may suffer from performance degradation caused by various infrastructure-related issues. Preventing performance degradations by predicting them using AI/ML techniques and, handling them proactively is critical for maintaining the application QoS. To ensure an AI/ML prediction model works, several research challenges need to be tackled. Thus, due to the heterogeneous cloud environment, automatically finding good features and appropriate prediction parameters is necessary for building the prediction model with required accuracy. Considering the dynamic traffic changes in clouds, maintaining run-time performance of the prediction becomes a challenging task. Since input data distribution varies in time, and feature relevance changes, this may lead to severe prediction accuracy drop. The purpose of this work is to propose methods to handle these challenges automatically and proactively. We investigate an automated feature selection system, which uses causal-temporal analysis to find the infrastructure metrics, which have causal relationships with the application metrics. Selected features are used to train deep learning models for predicting application performance degradation.

Read the paper

Advancing Fault Detection: Unsupervised and Supervised Approaches for Cloud and Future Networks

Fault detection is key to maintaining the Quality of Service (QoS) in increasingly complex and fault-prone cloud/telecom networks. This research explores the supervised and unsupervised paradigms for the implementation of fault detection systems. The unsupervised fault detection solution investigated is the hybrid single-/multiple-threshold anomaly detection method, tailored for high-dimensional, unlabeled time-series data. Leveraging Long Short Term Memory (LSTM)-Auto Encoder (AE) architecture, the solution uses an anomaly explanation module, which enhances its interpretability. Regarding the supervised fault detection solution, the scope of this research is to design an automated data labeling framework. An active learning framework automates the labeling process of the cloud metrics data and of the corresponding system state, ensuring adaptability to emerging fault patterns and data distributions. Implementation of these ML-based solutions help improving the reliability and robustness of fault detection in cloud environments and future telecom networks.

Read the papers: Link 1, Link 2

Workload-aware Dynamic GPU Resource Management in Component-based Applications

This research investigates a method for optimizing GPU resource allocation in cloud environments, specifically for component-based applications that require high-performance computing. A dynamic resource management system, with an online performance optimizer and a monitoring system, is introduced, for managing the shared GPU resources. The optimizer periodically collects throughput data to make allocation decisions, ensuring resources are distributed based on the workload requirements of each component. Proposed solution includes a GPU Memory manager as well, which utilizes the memory handle for reducing the need for frequent data copying between CPU and GPU. This research shows it is possible to improve overall application performance compared to the traditional GPU multitasking solutions and demonstrates significant enhancements through shared memory.

Read the paper

Efficient Dynamic Resource Management for Spatial Multitasking GPUs

Scope of this research project is to improve the performance of the online performance optimizer in dynamic resource management systems. Main focus is on maximizing the chain throughput by considering the compute resource usage and the drop rate of packets between the components. One of its key roles is to categorize components based on their compute-intensive and memory-intensive characteristics, thereby reducing the process of finding bottleneck components. Proposed solution uses handles not just for data transfer between components, but also for carrying control information, such as the component's execution time and processed packet count. The collected processing data is regularly reported to the online performance optimizer for decision-making. This research shows application throughput can be significantly improved by using proposed solution vs. the state-of-the-art spatial multitasking techniques.

Efficient Task Scheduling and Allocation of GPU Resources in Clouds

This research project investigates the design of a solution for effectively distributing GPU resources in cloud environments, with restrictions such as isolation and multiple tenancy. Main focus is an algorithm for the efficient allocation of GPU resources in clouds, which prevents underutilization when assigning resources under the isolation constraint. In addition, the project explores the task scheduling policy for assigning the GPU resources, while considering the task requirements (e.g. completion deadlines) and fairness between tenants. The algorithm relies on GPU multitasking methods supported by both hardware and software.

 

Back to research areas