On Attack-Resilient Service Placement and Availability in Edge-enabled IoV Networks

Whether it’s freeing humans from tedious driving tasks or minimizing the risk of catastrophes by eliminating the possibilities of human errors, the Internet of Vehicles (IoV) integrates a series of network services to help vehicles conduct necessary tasks related to driving and vehicle automation. IoV being a mission-critical application is categorized under 5G ultra-reliable and low latency communications (URLLC) technology [1]. This makes low latency and high reliability a key requirement for IoV services. The vehicles need to be connected in real-time with each other and the infrastructure to get assistance in different computation tasks. The use of cloud computing poses a significant challenge as it may not be suitable to process real-time traffic conditions of strict latency and reliability requirements. Edge network (EN) is a potential technology that can assure faster service availability by bringing computing resources closer to the end-users. Therefore, the ENs are anticipated to promise great benefits in building an intelligent Internet of Vehicles (IoV) network [2, 3].

EN is a network architecture that brings computing resources to the edge of the cellular network with one or more edge nodes or servers [2, 4]. The high versatility of locations and closer positions of edge nodes eliminates long-distance communications. The data that need to be sent between the user and infrastructure can be transmitted faster with low latency. EN also offers the benefit of distributed local processing, caching, and improved security. Despite these advantages, EN is in its early stage of development where several problems need to be addressed. One of the common and important problems is security against different attack types. In this work, we focus on optimal and attack-resilient service placement at EN for disruption-free or minimal-disruption service availability to the vehicles for sensitive applications like driving.

Resilience is the capability to maintain a good quality of service in the system in the event of attacks or failures. The problem of providing resilience in ENs is new and not explored much for the application of service placement in an IoV network. Using backup resource (BR) reservation methods are common and widely used in the recent literature to handle service failures [5, 6, 7, 8, 9, 10]. However, the BR reservation based solutions are resource expensive and result in wastage where resources remain idle until failure occurs. In the application of service placement, the over-provisioning of resources due the backup service instances limits the choice of optimal placement for primary instances and results in longer delays observed by vehicles. Thus, an important research question is how to provide services resilient to attacks on an edge node (server) with minimal number of active edge servers and resources while satisfying service requirements and low or no disruption in the event of a failure.

In this paper, we consider an IoV network where different types of services are offered to the vehicles to help them coordinate in remote driving, road safety, and many other applications. We start with the service placement to find the optimal placement of services at the edge servers while considering the vehicle’s mobility and dynamics in the requests. More than one service instances are placed at different edge servers for the purpose of meeting service requirements and also resilience. During the normal operation, a vehicle receives its service from a server based on primary vehicle-to-edge (V2E) mapping and upon the service failure, it needs to get service from an attack-free server chosen a-priori as secondary V2E mapping. While this pro-active secondary mapping ensures low or no service disruption, it might overload the attack-free working servers. Therefore, as the last stage, our design framework chooses a recovery (reactive) solution to find new server(s) for the failed service instances.

Such an attack-resilient service placement framework of multiple objectives needs to satisfy multiple design criteria such as low delay, low service disruption, and high resource efficiency considering the dynamic nature of service demands. Our proposed approach aims to achieve high level of system performance from the perspective of users as well as service providers for service placement with resilience against service failure at an edge server. We develop three different ILP-based formulations to solve the attack-resilient service placement problem and make the following contributions in this paper.

• •

  First, we perform optimal placement of multiple instances of each service type on edge nodes while guaranteeing minimal service delay and minimal edge resource usage. The effects of dynamic traffic volumes on service placement (SP) are addressed using the deep reinforcement learning (DRL) framework with an ILP model of our earlier work in [11]. This presents the primary V2E mapping for vehicles to avail different services.

• •

  Second, we develop an ILP model, to determine proactive secondary V2E mapping (PSVM) to provide low service delay. We note that we do not reserve any resources but only select a secondary server to be used in the event of an attack. Thus, we do not need additional backup resources during the normal operation. Upon an attack, an affected vehicle will switch to the secondary server with no or little service disruption.

• •

  Third, we develop an ILP model to address the recovery problem to perform service recovery placement (SRP) for the affected service instances hosted at the edge node under attack. The failed instances are re-instantiated at the unaffected edge servers. The affected vehicles will then switch to these new service instances. This is because, while the PSVM enables an affected vehicle to receive services with minimal disruption, the servers may be congested as no additional resources were reserved during the normal operation.

• •

  Finally, our performance evaluation results present useful insights on service delay, edge resource usage, number of active servers, and run time by our proposed framework against the baseline method based on backup resource (BR) reservation.

The rest of the paper is organized as follows. Section II presents the related works. Section III provides the details on the system model, service model, and problem description. In Section IV, we develop formulations for three ILP models to solve the problem of resilient service placement. In Section V, we present the architecture and algorithms for the proposed attack-resilient service placement framework. Section VI performs the performance study, and finally, Section VII makes concluding remarks.

The diversified service requirements of vehicular applications ranging from time-sensitive remote driving to resource-intensive autonomous driving video processing, foster the inclusion of EN with IoV architecture. The EN which processes data closer and the first step between the user and core of the network is also a target for attacks. In the literature, there are several survey works presented recently on the security and privacy issues of network edge computing [4, 12, 13]. The ENs are comprised of various distributed entities like wireless networks, storage networks, visualization system programs, and so on. The above survey works discuss the possible attacks on different components of the EN. Different kinds of attacks and their impacts are discussed where the attacks like denial-of-service (DoS) attacks, jamming attacks, and forgery attacks may fail edge nodes or perform system damage. There also exist several works which use edge capabilities to provide defense against attacks over IoT devices or cloud networks [14, 15]. However, the failure of edge node due to an attack has not much been studied in the literature.

He et al. in a recent work in [16] use a game-theoretic approach to formulate a decentralized algorithm and find the Nash equilibrium as a solution to the edge node attack problem. The idea is to find allocation decisions in a way that mitigation cost is minimum and the edge server does not exceed its processing capacity. The mitigation cost here is in terms of the number of hops. This work does not deal with the mobile traffic of an IoV network and does not optimize the performance parameters which are crucial for IoVs. The data used in this work is generated following Poisson distribution which is not realistic. Singh et al. in [17] detects DoS attacks on EN using a Bayesian classifier to decide whether the new packet is from a legitimate user or not. This work focuses on detection only and doesn’t provide a solution for prevention or attack recovery. Another work in [18] deals with the problem of edge server failure as an integer programming problem. This work proposes an optimal strategy for migration of end-users to nearby edge servers and to maintain service delivery. This work is only delay focused and doesn’t consider to recover the failed system resources. The dynamics in traffic volumes are also not considered in this work.

Different from the above works, we study the problem of attack-resilient service placement in edge-enabled IoV networks. The problem of resilient service placement in IoV is new and not widely explored. Some recent works study the problem of resilient service placement for different applications. Using redundancy and advance reservation of backup resources is the most common and well-known resiliency method used to handle node failures [5, 6, 7, 8, 9]. The redundant backups have their drawbacks including resource wastage, higher cost, and higher delays. The authors in different recent works [7, 10] propose the techniques to cut down or reduce the backup edge resources. Despite this, the drawbacks of redundancy or backup are inevitable.

Kang et al. [19] propose a mixed integer programming model to perform resilient resource allocation in service function chains by selecting suitable replicas from the pools of replicas and deciding the deployment locations of these replicas. This work considers the problem of node failures where virtual network functions (VNFs) running on the node also fail but the node has a copy of data and status information through which replicas would be generated and replaced. Their objective is to minimize the recovery time. This work is VNF-focused and doesn’t study the edge network scenarios. Another work on resilient VNF placement is presented in [20]. This work considers the use of cloud resources along with edge while proposing their solution. However, the use of cloud may not be an optimal choice for delay-sensitive IoV applications.

Cheng et al. [21] consider edge nodes only and present a resilient service placement under uncertainty. This work proposes an ILP model with the objective of cost-optimal placement. The cost is in dollars which the user pays based on per-hour resource usage. The authors of this work study one service per edge node scenario and do not consider the mobile traffic which makes it unsuitable for IoV applications. The performance evaluation is performed on simulated data where link delays are also generated randomly. Yuben et al. propose a resilient service provisioning for edge computing in [22] to maximize the expected overall utility. This work studies the problem of uncertain failures but doesn’t consider the mobile traffic. The traffic is static with a fixed number of users considered from a fixed wireless router as an input for performance evaluation.

There are few works on resilient controller placement presented in the literature [23, 24, 25]. But the resilience techniques proposed in these works are not suitable for ENs where resources are limited and also not applicable over mobile traffic of IoV networks. The objective of our work is to propose a resilient edge service placement solution for dynamic and time-varying IoV networks. Note that the dynamicity of the IoV network includes not only the traffic demand, but also the vehicles’ geographic locations. Such a dynamicity has an impact on the real-time performance of edge service placement decisions and service availability.

In this section, we describe the system model, service model, and research problem as the problem description studied in our work.

In this section, we formulate the resilient service placement problem using binary ILP. This problem has three parts and accordingly three problems which are explained below.

The first part deals with the optimal service placement problem. The objective is to decide on optimal edge locations to instantiate service instances of different requested service types, subject to resilience, delay and resource constraints. The service requests are generated from vehicles in the specific format described in the previous section, requesting different service types to get assistance in driving tasks. Upon processing a service request, the the details of the chosen edge server hosting that service instance is communicated to the vehicles. The optimal service placement is stated as follows,

Problem 1 (Service Placement (SP)): Given a set of service types $s$ and $I_{s}$ number of service instances for each service type with their resource and delay requirements, the problem is to find the optimal placement $x_{e}^{s}$ of services at the edge servers while considering the vehicle’s mobility and dynamics in the requests for different types of services.

In the second ILP model, we consider the problem of finding two optimal secondary candidate servers (i.e $\kappa_{1}$ and $\kappa_{2}$) for V2E mapping following the SP locations decided in problem 1. The discovery of optimal secondary mappings is subject to the lowest delay experienced by vehicles while accessing that service. The idea is to use the secondary mappings when an attack takes place on the node where vehicles are primarily mapped and ensure the continuous service availability for the vehicles. This part of our design aims to minimize the impact of the attack until the system recovers. The decision on secondary candidates in a proactive manner is indeed important consideration to avoid the service disruption that may impact the service availability specially when the service type requested is related to driving and sensitive to delay. We note that while we select the secondary candidates a-priori, we do not reserve any resource. A vehicle will be switched to the first candidate if its service instance (during normal operation) was not placed at the first candidate; otherwise it will be switched to the second candidate. The proactive selection ensures immediate switching of a vehicle to a new server upon service failure. Since the resources are not reserved, the service load on the secondary candidate servers could increase and hence our objective is to minimize the delay. Note that the priority of candidate $\kappa_{1}$ is greater than $\kappa_{2}$ considering the delay from $\kappa_{1}$ is less than $\kappa_{2}$. Our second problem of optimal proactive secondary V2E mapping is stated as follows,

Problem 2 (Proactive Secondary V2E Mapping (PSVM)): Given a set of optimal service placement $x_{e}^{s}$ to deploy $I_{s}$ instances of each service type $s$ with their resource and delay requirements, the problem is to find the two best secondary mappings, i.e. $y_{e,\kappa_{1}}^{s}$ and $y_{e,\kappa_{2}}^{s}$, minimizing the delay, and ensure continuous service availability for the set of vehicles $\mathcal{V^{\prime}}$ impacted by the attack.

In the third and last optimization problem, we perform the recovery/re-instantiation of attacked SIs. We carry out the re-instantiation of attacked SIs to the working edge nodes. Let $k$ be the number of instances that failed due to an attack on the edge node. In this part, we will perform the k-resilient SIs re-instantiation subject to minimal edge resource usage. The idea of minimizing the edge resource usage instead of delay/latency is important here. The resource and computation capabilities of edge servers are limited and expensive. It is important to utilize them efficiently considering one edge is down due to an attack. Note that this approach is reactive and does not consume resources until the attack takes place. Our third problem of optimal re-instantiation of attacked services is stated as follows,

Problem 3 (Service Recovery Placement (SRP)): Given a service placement $x_{e}^{s}$ and a failed server, the problem is to find optimal recovery placement locations $z_{e}^{s}$ of SIs of each service type $s$ with their resource and delay requirements such that the $z_{e}^{s}$ $\neq$ $x_{e}^{s}$ and the objective is to minimize the edge resource usage.

We will develop the binary ILP-based formulation for solving SP, PSVM, and SRP problems in the following sections.

In the previous section, we develop three optimal ILP models for SP, PSVM and SRP. We elaborate our idea to solve these formulated problems in this section and describe our proposed resilient service placement framework. We depict the architecture of our proposed resilient service placement framework in Fig. 2.

The key concept of our service placement framework is based on the DRL framework. A static deployment that fixes servers for hosting services is not effective for IoV considering the mobile nature of vehicles and dynamics in the requests for different types of services. It is therefore imperative that the real-time environment be taken into consideration while mapping a service to an edge server. Therefore, we exploit the actor-critic DRL model with ILP formulations to solve the resilient service placement framework.

An actor is a primary function which generates action by using the policy function. Whereas the critic estimates a value function, we call as quality-value (i.e. $Q_{value}$), needed to maintain good performance in the network by dynamically re-optimizing the actor policy formulations. The $Q_{value}$ changes between 0 to 1, a small value implies poor performance necessitating re-optimization. An actor needs to select actions with the maximum quality value, i.e $\mathfrak{a}$ = arg max $Q_{value}$. Here, $\mathfrak{a}$ denotes the action. The design of the critic model is similar to that in our work [11]. In our proposed design, the critic network is a neural network which collects feedback and the request for which feedback was generated from the environment, as shown in Fig. 2. From the user perspective, our objective is to minimize the service delay observed from vehicles in accessing service $s$ from the associated edge server $e$. Therefore, the feedback function is modeled as:

The feedback is a response, an agent receives by the environment for the corresponding action. The critic network updates its parameters $\theta$ to minimize the mean square loss function $\mathcal{L}_{Q}$ based on the feedback and it’s corresponding request parameters. The loss function is computed as:

Here, $y_{t}$ is a target value which is calculated as:

Where $\sigma(D_{s},\mathcal{F})$ is the standard deviation between delay threshold and feedback. The higher the deviation, the better the model is in terms of delay.

In our actor design, we want to ensure resilience by using three ILP formulations, i.e. SP, PSVM, and SRP. Here, SP is the solution for the placement of services in the normal working state (i.e. attack-free state). One of the important constraints for the SP solution is the redundancy (Eq (3)) where we limit the deployment to no more than one instance of each service type on the same edge node. This is to ensure the availability of the same type of service from multiple edge nodes. Along with SP, we also solve PSVM in the attack-free state. The PSVM is the proactive approach and determines an effective secondary V2E mapping for vehicles to be used when the network is under attack. It plays a major role in our algorithm and helps avoid service disconnection or breakage and minimizes the average performance loss for the sensitive service types, such as driving.

Upon an attack, our framework promptly activates PSVM secondary mappings to maintain service availability to the attack-affected vehicles and minimize the impact of the attack until recovery takes place. In the meantime, we start to solve the SRP to find the best possible service instance recovery placements for the given state of the environment. Once the SRP is solved, it is activated to enhance the network performance in terms of delay and the network will become resilient to the attack with a negligible loss in the network performance, which we verify in detail in Section VI. The SRP decision will remain in force until the attacked edge is restored and be ready again to participate in the service placement.

Our proposed attack-resilient service placement framework is solved iteratively to take into account of the dynamic nature of the IoV network and described in Algorithm 1 and Algorithm 2. Algorithm 1 serves as a general resilient service placement framework and works recursively from steps 1-12. First, it initializes the service profile, edge profile, and the critic neural network (NN) model. Then, it starts with the data collection and SI calculation in step 2 and 3, respectively. The data collection is the request for set of services $S$ by vehicles $V$ following the service model discussed in Section III-B. Step 4-7 indicate that in the beginning at time $t=1$ where SP and PSVM are solved for initial decisions. The service placements from SP are sent back to the environment as $\overline{x_{e}^{s}}$. For the later iterations, step 9 calculates a new solution for $x_{e}^{s}$ using Algorithm 2.

The decision is communicated back to the environment with the purpose that vehicles start getting services from the edge servers where their desired service type is deployed. At each time unit $t$, the vehicles generate feedback and send it to the critic model in step 10. The feedback indicates the performance of an environment in terms of the delay observed by the vehicles. In step 11, the critic NN model uses feedback as an input feature to generate the Q-value. This value is sent to the actor model for further evaluation and to find a new placement decision.

Algorithm 2 computes the resilience-based actor policy to find new optimal placements for services. Step 1 indicates the reception of input (service request) at time unit $t$. Steps 2-4 indicates good-quality system performance where vehicles continue to receive service from the same edge nodes. On the contrary, if the system performance quality is poor, the network will check for an attack or no-attack scenario in steps 5-17. The type of attack we study here is discussed in Section III-C where the edge node fails because of any type of outage attack which results in the blackout of the edge node. Step 6-9 indicate the no-attack case, but due to poor $Q_{value}$, the SP and PSVM are re-optimized to find new placements and secondary V2E mappings.

Step 10-17 indicate the failure of an edge node and the state where network is under attack. Step 11 finds out the node under attack as $\mathcal{N}_{a}$. Steps 12-13 find out the set of service instances under attack as $\zeta_{a}$ and the set of vehicles affected by the attack as $\mathcal{V^{\prime}}$. In step 14, the secondary V2E mappings solved from PSVM are communicated to $\mathcal{V^{\prime}}$ to minimize the impact of the attack until recovery takes place. Steps 15-16 solve the SRP to find the recovery placements for $\zeta_{a}$. Step 17 excludes node $\mathcal{N}_{a}$ from the placement decision. Finally, the decision is updated in step 18 by including instance recovery placements into it.

In this section, we present the performance study of our optimization models and proposed framework. We first start with a summary of experimental settings and then evaluate our framework for several primary performance metrics. We also provide insights into the effectiveness of different IoV environments with varying vehicle densities and compare it against an existing baseline solution of BR reservation.

In this paper, we proposed a framework for attack resilient service placement and service availability in edge-enabled IoV networks and developed three ILP models to jointly solve the problem with a DRL model. The proposed method determines the optimal service placement in the first stage of attack-free scenario taking into account the service delay observed by vehicles and edge resources usage. It also calculates the optimal secondary V2E mappings proactively to maintain disruption-free (or low disruption) service availability to the attack-affected vehicles until recovery takes place. Our model achieves resilience without pre-reserving expensive resources. Upon a failure, we find optimal service recovery placements with the objective of minimizing the edge resource usage. Our proposed solution not only improves the user experience by maintaining low service latency but also reduces the system cost in terms of resource usage and number of active edge nodes. The effect of dynamic traffic changes on service placement and system performance quality is addressed by integrating ILP models with a DRL framework. We carried out extensive performance study to verify the effectiveness of the proposed framework using different datasets representing different city environments.