A novel two-stage architecture based on SDN, NFV and network slicing is proposed to efficiently detect and quarantine malicious IoT devices in 5G mobile networks.