Hardening the Security of Multi-Access Edge Computing through Bio-Inspired VM Introspection

Round 1

Reviewer 1 Report

The paper focuses on the emerging issues of security for 5G based edge computing. The authors propose an approach to introspect virtual machines for detecting security threats. The approach targets a wide range of security threats and is demonstrated through a testbed deployment.

My comments are as follows.

- Some effort is needed on the justification of the work - particularly in the abstract vs the introduction. Is 5G the motivation? Is Edge-computing the motivation? Is increasing security threats the motivation?  This needs to be clearer. The authors also need to justify these statements early in the introduction, with citations.

- To add to this, the introduction focuses on cloud as a driver of the paper, but this is not mentioned in the abstract.  Then it jumps to 5G with no connection.

- I don’t see 5G being a motivating factor at all.  Does 5G lead to more security risks on the MEC?

- In the abstract the proposal is an ‘application’, but in the introduction its called a IDS - which is it.  The language needs to be made more consistent.

- The focus on VMs need to be justified - Edge computing in my view is focused more on containers than full-VMs.  How does the approach apply to containers?  5G and VMs are also not connected mostly as VMs tend to run on network wired machines…

Section 3 is focused on a MEC platform which seems to be by Gigabyte. It needs to be made much clearer that you are adopting a particular platform and not proposing it.  This is not clear.

The security threats to MEC are described well in section 3. I feel its lacking the discussion on how current solutions tackle this.  What do current systems do?   This is the main justification of the work.

There is a lack of justification for using the particular approach in 4. Why have you done it this way?

In section 4 - it is unclear how scalable this approach is.  It seems to rely on profiles and detectors. How long do the profiles need to be for? How much storage is required? Is there a detector for each security event/event type/specific threat?

In particular, if aiming at VMs, how much resources are needed for the approach in section 4?

For sections 5 and 6, its important that the text clearly identifies what is special about MEC, as the approach is focused on VMs. There also needs to be further discussion of scalability of the approach.

Figure 11 isn’t very useful. Can you change the Y access to allow the review of the results?

 

Author Response

Dear Reviewer, 

First, thank you very much for providing such a detailed review and helping to resolve discrepancies. Below I provide answers to your comments.

- Some effort is needed on the justification of the work - particularly in the abstract vs the introduction. Is 5G the motivation? Is Edge-computing the motivation? Is increasing security threats the motivation?  This needs to be clearer. The authors also need to justify these statements early in the introduction, with citations.

I have revised introduction by narrowing it down to justify statements about securing MEC and how proposed IDS provides unique security in this domain.

- To add to this, the introduction focuses on cloud as a driver of the paper, but this is not mentioned in the abstract.  Then it jumps to 5G with no connection.

Introduction has been revised with more focus on MEC security.

- I don’t see 5G being a motivating factor at all.  Does 5G lead to more security risks on the MEC?

I agree, 5G is not a motivating factor here. Considering that MEC cannot be efficiently implemented without 5G speeds, therefore I included this as a connected factor. 

- In the abstract the proposal is an ‘application’, but in the introduction its called a IDS - which is it.  The language needs to be made more consistent.

Thank you for pointing this out. I have fixed the terminology.

- The focus on VMs need to be justified - Edge computing in my view is focused more on containers than full-VMs.  How does the approach apply to containers?  5G and VMs are also not connected mostly as VMs tend to run on network wired machines…

Compared to VMs, Containers sit on top of physical server and its host OS (Linux, Windows). Containers are more “light” than VMs. Our work primarily focuses on securing VMs and can be applied to MECs that runs on virtual machines. Since MEC is a relatively new technology, I believe it can be also architected using containers, but this is something for us to think as a future work.

- Section 3 is focused on a MEC platform which seems to be by Gigabyte. It needs to be made much clearer that you are adopting a particular platform and not proposing it.  This is not clear.

Section 3 has been revised. The architecture of MEC presented there is just for illustration purposes, to show how MEC can consists of several VMs.

- The security threats to MEC are described well in section 3. I feel its lacking the discussion on how current solutions tackle this.  What do current systems do?   This is the main justification of the work.

Thank you. Section 3 has been revised.

- There is a lack of justification for using the particular approach in 4. Why have you done it this way?

Thank you. Section 4 has been revised. We are focusing on implementation of Negative Selection Algorithm as part of Artificial Immune System based on its flexibility and adjustability. This IDS can also be implemented using Machine Learning techniques, but the focus here is to provide a bio-inspired technique on solving Computer Science problems. 

- For sections 5 and 6, its important that the text clearly identifies what is special about MEC, as the approach is focused on VMs. There also needs to be further discussion of scalability of the approach.

Thank you for pointing this out. I will think the ways how this sections can be revised to provide more focus on MEC. We focus on idea of securing VMs as a crucial part of MEC. 

- Figure 11 isn’t very useful. Can you change the Y access to allow the review of the results?

I'm sorry, but could you please provide more detailed information here?

Thank you very much.

Reviewer 2 Report

The paper is well presented and balanced between well-known and novel material. The authors should clearly state the contribution of the paper in contrast to other works in the appropriate paragraph of the introduction since the description provided at that point does not reveal the novelty to the reader.

Author Response

Dear Reviewer,

First, thank you very much for taking your time to review and provide your valuable comments. Below I provide answers to your responses. 

- The paper is well presented and balanced between well-known and novel material. The authors should clearly state the contribution of the paper in contrast to other works in the appropriate paragraph of the introduction since the description provided at that point does not reveal the novelty to the reader.

Thank you very much for your comment. After careful analysis I have revised introduction and other sections of the paper.

 

Best Regards,
Huseyn

Reviewer 3 Report

The authors propose the hardening of security in MEC through an AI based approach inspired on Biology mechanisms.

Introduction is very broad and lacks a proper motivation for the work presented.

Section 3 does not provide novelty content, this all section could be replaced by a reference to previous works.

Section 4 and 5 presents the core of authors work, it extensively detailed and provides a good insight of the proposed solution.

Unfortunately there is nothing in the authors proposal that is MEC specific, even the experiment proposed does not use a MEC platform (it's just a client/server)...

The paper also focus too much on the previous work of one the authors (KVMonitor), it's true that its an important enabler for this approach, but more focus should be given to the IDS solution then to the tool supporting it.

Typo: line 81 MIM -> Man not Main

 

Author Response

Dear Reviewer,

First, thank you very much for taking your time to provide valuable overview. Below I provide answers to your comments. 

- Introduction is very broad and lacks a proper motivation for the work presented.

Thank you for pointing this out. The introduction and some other sections have been revised. I have narrowed down introduction to focus on security aspects of MEC and how proposed system fit in this domain. 

- Section 3 does not provide novelty content; this all section could be replaced by a reference to previous works.

Thank you. Section 3 has been also revised.

- Section 4 and 5 presents the core of authors work, it extensively detailed and provides a good insight of the proposed solution.

Thank you. 

- Unfortunately there is nothing in the authors proposal that is MEC specific, even the experiment proposed does not use a MEC platform (it's just a client/server)...

Our IDS focuses on detection virtual machine (VM) based attacks and we illustrate that MEC is primarily rely on many VMs. I will think of any other way how we can define experiments that resembles attacks in MEC systems. Thank you.

- The paper also focus too much on the previous work of one the authors (KVMonitor), it's true that its an important enabler for this approach, but more focus should be given to the IDS solution then to the tool supporting it.

Thank you, noted.

- Typo: line 81 MIM -> Man not Main

Thank you very much. Corrected.

 

Best Regards,
Huseyn H.

Round 2

Reviewer 3 Report

No further comments