  With the recent trend of "network softwarisation", enabled by emerging
technologies such as Software-Defined Networking (SDN) and Network Function
Virtualisation (NFV), system administrators of data centres and enterprise
networks have started replacing dedicated hardware-based middleboxes with
virtualised network functions running on servers and end hosts. This radical
change has facilitated the provisioning of advanced and flexible network
services, ultimately helping system administrators and network operators to
cope with the rapid changes in service requirements and networking workloads.
This thesis investigates the challenges of provisioning network security
services in "softwarised" networks, where the security of residential and
business users can be provided by means of sets of software-based network
functions running on high performance servers or on commodity compute devices.
The study is approached from the perspective of the telecom operator, whose
goal is to protect the customers from network threats and, at the same time,
maximize the number of provisioned services, and thereby revenue. Specifically,
the overall aim of the research presented in this thesis is proposing novel
techniques for optimising the resource usage of software-based security
services, hence for increasing the chances for the operator to accommodate more
service requests while respecting the desired level of network security of its
customers. In this direction, the contributions of this thesis are the
following: (i) a solution for the dynamic provisioning of security services
that minimises the utilisation of computing and network resources, and (ii)
novel methods based on Deep Learning and Linux kernel technologies for reducing
the CPU usage of software-based security network functions, with specific focus
on the defence against Distributed Denial of Service (DDoS) attacks.
