# A Micro-Segmentation Method Based on VLAN-VxLAN Mapping Technology
## 3 Proposed Method
### Enhanced Behavioural Profiling Algorithm
(2017), we conducted an analysis of the traffic per minute for nine assets over one month, resulting in 4772 outliers being detected out of a total of 777,600 data with 728 million data points. However, upon examining these anomalies, several issues were observed. Firstly, the algorithm's automatic determination of the number of clusters through its boundary function is computationally slow. Secondly, the algorithm's high recognition rate for bursty traffic changes may lead to the aggregation of these data points into a cluster, causing them to be missed during anomaly detection, which is a major factor contributing to the lower-than-expected detection rate. Thirdly, periodic bursts of traffic may lead to false positives. Fourthly, the algorithm's identification of points with significantly lower traffic than the cluster's prime as anomalies may result in the false detection of points that do not exceed the expected traffic level. Figure 11: The extent of decline in asset degrees. Figure 10: The extent of PoAE’s improvements. To alleviate the limitations of the KMEANS algorithm, an improved algorithm has been developed to profile asset behaviour in the context of network traffic analysis. The proposed approach utilizes DBSCAN for noise point calculation and anomaly detection, thereby reducing the computational complexity associated with the algorithm. Additionally, a time dimension has been incorporated into the analysis by aggregating data across different dates based on the opposite end's address. This integration of a time dimension enables the detection of anomalies at specific times across different dates, mitigating the issue of missed anomalies resulting from prolonged traffic bursts. Notably, the inclusion of lateral clustering enhances the algorithm's capability to accurately identify periodic traffic patterns. Leveraging this enhanced algorithm, a comprehensive analysis of historical traffic for the nine assets was conducted, leading to the identification of 33,916 anomalous data points that warranted further investigation. The investigation of anomalous behaviour on the intranet asset 10.8.6.122 yielded 2551 anomalies, with 2386 of those being concentrated on a subset of intranet assets, namely 10.8.6.123, 10.8.6.124, 10.8.6.125, 10.8.6.126, 10.8.6.127, and 10.8.6.129. Further analysis of these peer assets showed that most of their anomalies were related to 10.8.6.122. Subsequent examination of the anomalous data identified 1905 instances that were present on both 10.8.6.122 and the peer assets. Since these anomalies occurred on at least two assets simultaneously, it indicated abnormal communication between the pair at the time of occurrence. Of the 1905 anomalies, 223 were observed at multiple assets and locations, and these were found to be concentrated in time periods. For example, anomalies were detected on 10.8.6.123 and 10.8.6.124 around 9:00 a.m. on a particular day, with both originating from 10.8.6.122. It is noteworthy that all of the anomalies were correctly identified. To illustrate the impact of the time dimension on periodic traffic analysis, consider the example of asset 10.8.6.130, which exhibits sporadic traffic for only 2 min within an hour when communicating with 10.7.2.30. When utilizing the KMEANS algorithm, these two minutes of traffic might be classified as anomalous. However, with the incorporation of the time dimension in our algorithm, this behaviour can be accurately identified as normal. Additionally, our algorithm can effectively distinguish non-periodic burst traffic, which is predefined as anomalous, enhancing the accuracy of anomaly detection. Upon conducting a thorough analysis of the anomalies individually, we achieved an accuracy rate exceeding 86%. The occurrence of false alarms was primarily concentrated among assets demonstrating irregular behaviours. For instance, asset 10.7.1.194 had an IP address of 10.255.73.146 on the opposite end, which exhibited minimal regular traffic at consistent time points each day and fluctuating data.