Software-Defined Wide Area Networks (SD-WAN) have emerged as the state of the art in enterprise connectivity by decoupling control and data planes; however, this flexibility expands the cyberattack surface and renders static perimeter defenses insufficient. This paper presents a Systematic Literature Review (SLR) following established guidelines, covering 91 studies from four indexed databases (2020–2025). Existing surveys address Software-Defined Networking (SDN) security, SD-WAN architectures, Service Function Chaining (SFC) optimization, and Intent-Based Networking (IBN) individually, yet none integrates these domains to examine automated, risk-driven incident response: a gap this review sets out to fill. The 91 works were organized into secondary studies (29.67%) and primary studies (70.33%), the latter analyzed under four functional axes: Security Risk Classification (Axis 1), Response Orchestration Mechanisms (Axis 2), their Integration (Axis 3), and Validation Strategies (Axis 4). The results expose a structural asymmetry: 31.25% of primary studies address exclusively threat detection and risk classification (Axis 1), while 9.38% explore exclusively dynamic SFC orchestration (Axis 2), predominantly focused on performance and Quality of Service (QoS), yet only 1.56% (Axis 3) investigate the integration of these two domains for security purposes. Moreover, 93.75% rely on non-operational validation (broad-sense simulation), revealing a gap with operational environments. From the literature retrieved by this review, this survey formalizes the Risk-Orchestration Gap, defined as the inability of current systems to convert, at runtime, a contextual security risk classification into adaptive topological reconfiguration via SFC. Three research directions emerge: decision-layer mechanisms linking risk classification to SFC orchestration, functional attributes such a layer should exhibit, and validation protocols closer to operational conditions.
Network slicing is a key technology for enabling differentiated services with strict Quality of Service (QoS) guarantees over a shared network infrastructure. In the context of transport network slicing, ensuring bounded latency for heterogeneous and bursty traffic remains a significant challenge, particularly when attempting to achieve both stringent QoS guarantees and efficient bandwidth utilization. This paper extends the model proposed by the Internet Engineering Task Force (IETF), along with our previous work on Hierarchically Controlled Transport Network Slicing (HCTNS), to provide a deterministic framework for deriving delay bounds associated with 5G QoS classes and network slices. The proposed methodology computes maximum delay bounds at both the individual node level and the end-to-end transport network level, taking into account scheduling mechanisms based on Priority Queuing (PQ) and Deficit Round Robin (DRR). In addition, the paper offers practical guidelines for configuring network nodes to satisfy the latency requirements of all traffic classes. Experimental results demonstrate that the proposed approach guarantees latency under diverse traffic conditions while preserving efficient bandwidth sharing across network slices.
Optimizing the ordering of packet-filtering firewalls is crucial to ensure high packet classification efficiency. In this perspective, the literature has investigated the problem either in a static or batch fashion, by estimating traffic statistics and then computing a new rule ordering offline or on demand, or through dynamic approaches following an estimate-and-optimize paradigm and relying on ad-hoc heuristics based on hand-crafted metrics and tuning choices. Therefore, there is a need for novel algorithms that can learn adaptive rule prioritization strategies directly from experience, possibly in a separate environment from the one responsible for decision making. To this aim, this paper presents TwinWall, a digital-twin-based firewall architecture in which a digital optimizer uses reinforcement learning to derive adaptive rule orderings based on the observed traffic, and periodically exports them to the real firewall. In this way, TwinWall reframes the rule-ordering problem as a continuous learning process, where prioritization emerges directly from traffic interaction rather than from predefined optimization algorithms. A prototype implementation of TwinWall was developed and validated on three datasets with different traffic characteristics, including two real packet traces and one synthetic workload generated with the ClassBench benchmarking tools. The obtained results show that the proposed approach can significantly reduce both the number of rule checks and the corresponding packet processing time, and that it outperforms static and frequency-based baseline strategies.
