# A Micro-Segmentation Method Based on VLAN-VxLAN Mapping Technology
## 3 Proposed Method
### Enhanced Behavioural Profiling Algorithm
Each virtualized server is equipped with at least one virtual network card connected to a vSwitch. A virtual NIC assigned to a virtual machine is associated with a port group that possesses a VLAN ID. Packets transmitted by the virtual machine carry the VLAN ID, and the vSwitch directly forwards packets if the destination address is within the same VLAN as the source address. Otherwise, the packet is forwarded to an upper-layer network device, namely a VTEP switch. The VTEP switch then forwards packets either directly to the corresponding interface within the same VNI based on the VLAN-VxLAN mapping relationship or to the L3 VxLAN Gateway if the source and target are not within the same VNI. In our experimental setup, the VTEP switch also serves as the L3 VxLAN Gateway. The study presented herein details a three-stage process for the implementation of micro-segmentation. The initial stage consisted of planning the VLAN-VxLAN mapping relationship, which was subsequently disseminated to each VTEP switch via the SDN controller. The second stage involved modifying the global configuration of the vSwitch to incorporate the newly designed VLAN. Finally, in the third stage, the port group ID linked to the virtual NIC on the cloud platform management software was changed, while remaining transparent to the application's network configuration. Nevertheless, this alteration requires careful consideration of operational implementation difficulties and service interruptions. The modification of the port group results in a brief service disruption, which was measured multiple times in our analysis. The disruption duration was recorded to be less than 1 s, with an average packet loss of 1. Figure 8 illustrates a real-time network reachability screenshot of the asset with IP 10.8.6.122 during the micro-segmentation transformation. Figure 8: Network packet loss during the implementation of micro-segmentation. ### Asset Correlation Analysis

Our micro-segmentation model was used to analyse traffic within the data centre. We conducted a survivability scan of the data centre intranet assets, and after manual confirmation, there were a total of 938 assets, of which the more critical 9 assets were selected for packet capture analysis. The IPs of the 9 assets and the main access relationships are shown in Table 4.

Assets 10.8.6.122, 10.8.6.124, 10.8.6.126, 10.8.6.127, and 10.8.6.129 were all cluster hosts within a business, with the main data traffic coming from within the cluster. Assets 10.8.6.123 and 10.8.6.125 were hosts for the cluster's external distribution service, with some internal traffic from the cluster. In addition to 10.8.6.130 was a shared database that needed to synchronize data with the database on the 10.7.2.0/24 network segment at the start of each hour. This asset experienced a significant burst of traffic during each full hour. Finally, asset 10.7.1.194 functioned as an IoT server, communicating not only with servers on the same network segment but also with the IoT endpoint network segment at 10.255.73.0/24. This study is focused on intranet assets and assumes that a host failure on the intranet will generate anomalous traffic. To detect anomalous traffic, it is necessary to first learn about the behaviour of intranet assets and create a behavioural portrait of them. Intranet assets were sorted and 936 assets with different IPs were identified. Continuous packet capture analysis of the assets in Table 4 was carried out and the capture files were truncated at 1 min intervals, generating 1440 pcap files per day. The inbound and outbound traffic of each asset was separated, split into two segments, and then aggregated by peer IP to form two vectors of 936 eigenvalues.