AuNF: Adaptive Micro-Network Functions With Runtime Per-VNF Granularity Control for IIoT Edge Security Chains

Abstract

Network Function Virtualisation (NFV) security chains on Industrial Internet-of-Things (IIoT) edge gateways face a performance-resource trade-off: a monolithic chain uses one core but its latency degrades under load, while full pipeline decomposition reaches the latency floor only by dedicating a core to every stage. Existing adaptive NFV systems tune scaling and placement but, to the best of our knowledge, do not switch a function’s execution mode at runtime. Without this capability, a deployment is locked to one end of that trade-off, paying either the monolith’s latency under load or the full decomposition’s core budget, with no runtime path between them. We present AuNF, a per-VNF (Virtual Network Function) granularity controller whose Adaptive Granularity Engine (AGE) monitors per-stage load through Exponentially Weighted Moving Average (EWMA) smoothing with a predictive term and switches each VNF among four execution modes (Mono, Vert, Decomp, Vert+Decomp) using pre-spawned worker threads and deterministic, training-free <inline-formula> <tex-math notation="LaTeX">$O(N)$ </tex-math></inline-formula> decisions. Implemented in Rust on a five-VNF IIoT security chain and compared against eight common-codebase re-implementations, AuNF holds median end-to-end latency at the 21,000 packets/second peak to 60 <inline-formula> <tex-math notation="LaTeX">$\mu $ </tex-math></inline-formula>s on two cores, a <inline-formula> <tex-math notation="LaTeX">$\sim 1.8\times $ </tex-math></inline-formula> reduction over the single-threaded baselines (around 106–107 <inline-formula> <tex-math notation="LaTeX">$\mu $ </tex-math></inline-formula>s). Of the eight, only two (Static Monolith and NFVnice) are like-for-like single-thread comparators; the six pipeline systems deliver about one core in this single-host harness and are reference points, not head-to-head competitors. A static two-core pin reaches the same peak latency, showing that the second core provides the fixed-load latency gain. AuNF’s contribution is deciding when and where that core is needed, releasing it when it is no longer needed, and protecting the P99 tail under contention. The primary latency results are measured on a desktop-class x86 host; the embedded validation below uses a four-core Raspberry Pi 5. Reported IDS timing and detection results use replayed precomputed Edge-IIoTset feature vectors; live header-field extraction is not exercised. Reaching the 44 <inline-formula> <tex-math notation="LaTeX">$\mu $ </tex-math></inline-formula>s full-decomposition floor instead requires seven cores (six deployable), beyond a typical IIoT gateway budget, so AuNF delivers decomposition-class latency at a fraction of the core cost, keeping cores free for other factory-critical workloads. Load is not the only source of tail latency: on a shared gateway, a co-tenant can steal CPU cycles and inflate the tail without registering on the load index at all. A second, independent sensor for CPU contention (scheduling pressure, distinct from the load index) drives a fourth state that relocates the contended worker onto a clean core, restoring 99th-percentile tail latency from 44.3 ms to 221 <inline-formula> <tex-math notation="LaTeX">$\mu $ </tex-math></inline-formula>s (<inline-formula> <tex-math notation="LaTeX">$\sim 200\times $ </tex-math></inline-formula>) at no additional core cost, a figure scoped to one x86 host, one synthetic co-tenant profile, and one host-calibrated gate, and reproduced on a four-core ARM gateway at <inline-formula> <tex-math notation="LaTeX">$\sim 73\times $ </tex-math></inline-formula>. AuNF thus occupies the resource-proportional knee of the latency-cores trade-off within a 4-core IIoT budget (measured occupancy on our x86 testbed). Validation on a four-core Raspberry Pi 5 reproduces the qualitative latency and elasticity behaviour, with absolute latency approximately <inline-formula> <tex-math notation="LaTeX">$3\times $ </tex-math></inline-formula> that measured on the x86 host, and reports contention, capacity, power, memory, and thermal results on the embedded gateway. More broadly, runtime per-VNF granularity control makes low-latency security inspection practical on commodity IIoT gateways that cannot over-provision cores.