Network slicing has become a fundamental property for next-generation networks, especially because an inherent part of 5G standardisation is the ability for service providers to migrate some or all of their network services to a virtual network infrastructure, thereby reducing both capital and operational costs. With network function virtualisation (NFV), network functions (NFs) such as firewalls, traffic load balancers, content filters, and intrusion detection systems (IDS) are either instantiated on virtual machines (VMs) or lightweight containers, often chained together to create a service function chain (SFC). In this work, we review the state-of-the-art NFV and SFC implementation frameworks and present a taxonomy of the current proposals. Our taxonomy comprises three major categories based on the primary objectives of each of the surveyed frameworks: (1) resource allocation and service orchestration, (2) performance tuning, and (3) resilience and fault recovery. We also identify some key open research challenges that require further exploration by the research community to achieve scalable, resilient, and high-performance NFV/SFC deployments in next-generation networks.

This paper presents a method for detecting attacks in smart home cyber-physical systems that combines network traffic analysis with physical sensor data. We apply the Shiryaev-Roberts and CUSUM change-point procedures to two data streams: packet counts at the residential gateway and motion readings from occupancy sensors, and compare four strategies for combining evidence from both streams. The system was tested on 31 hours of residential traffic with 16 synthetically injected Mirai-style attacks; both the attack traffic and the corresponding physical shifts are injected into the dataset. Score Fusion achieved an F1-score of 0.822 and the lowest false alarm rate of all seven methods tested (0.040). The network-only detector responded in 1.3 minutes on average but produced false alarms at roughly twice the rate. The physical stream detector caught all 16 attacks but took (4.4 minutes with the centered window used in this study; 5.4 minutes with a causal trailing window because the injected physical shift is applied after a modelled propagation delay. When attacks produce no physical effect, the cyber-only detectors are unaffected while fusion methods that depend on the physical stream drop to near-zero recall. Running the full pipeline on a Raspberry Pi 4 took 71 milliseconds for the entire dataset, the approach therefore runs on low-cost gateway hardware without specialist acceleration.