Abstract: A method and apparatus is disclosed herein for security risk-based admission control. In one embodiment, the method comprises: receiving a request from the user device to access the network; determining whether to admit the user device based on a security-based admission control policy that admits user devices based on a constraint optimization that attempts to maximize the sum utility of the currently admitted user devices in view of a security assessment of the user device and security risk imposed on the network and already admitted user devices if the user device is admitted to the network, wherein the constraint optimization is based on a utility associated with admitting the user device to the network, a reputation value associated with the user device, and a botnet damage estimation on the network associated with the user device; and admitting the user device to the network based on results of determining whether to admit the user device.

Abstract: A method and apparatus is disclosed herein for security risk-based admission control. In one embodiment, the method comprises: receiving a request from the user device to access the network; determining whether to admit the user device based on a security-based admission control policy that admits user devices based on a constraint optimization that attempts to maximize the sum utility of the currently admitted user devices in view of a security assessment of the user device and security risk imposed on the network and already admitted user devices if the user device is admitted to the network, wherein the constraint optimization is based on a utility associated with admitting the user device to the network, a reputation value associated with the user device, and a botnet damage estimation on the network associated with the user device; and admitting the user device to the network based on results of determining whether to admit the user device.

Abstract: Security attacks on network entities can be compensated for and reduced through insurance that modifies incentives. In one example, a virtual slice provider includes a secure and non-secure slice having resources to provide network access to users through a service provider. The secure slice is assigned a first security level and a non-secure slice is assigned a second lower security level. In one embodiment, the second slice is isolated from the first slice. The virtual slice provider also has a risk policy between the slice provider and the service provider to establish different rates charged to the service provider for access to the secure and non-secure slices and to provide different levels of payment to the service provider for losses resulting from a lack of security in each slice.