# A Micro-Segmentation Method Based on VLAN-VxLAN Mapping Technology
## 3 Proposed Method
### Micro-Segmentation
#### 3.1.3 Evaluation of the Effect of Differential Segmentation  
The utilization of diagrams as a means to represent intricate data object relationships was explored by [PERSON], [PERSON] et al. [29]. In a similar vein, [PERSON], [PERSON] et al. [24] proposed a graph theory-based approach to quantify the reduction in network exposure resulting from micro-segmentation. In this study, we adopt their methodology and employ the directed graph \(C(A,V)\) to represent the data centre network, where each node in the set \(V\) corresponds to a network asset, and the set of directed edges \(A\) contains all possible connections between nodes, with \(x\)\(\in\)\(V\), \(y\)\(\in\)\(V\) and \(x\)\(\
eq\)\(y\). An edge (\(x\),\(y\)) exists if \(x\) can access \(y\) directly, and (\(x\),\(y\)) \(\in\)\(A\). Here, \(x\) serves as the incoming node of \(y\), and \(y\) serves as the outgoing node of \(x\). To provide a visual representation, we present a network schematic diagram in Figure 6, where Figure 6a illustrates the network connectivity without micro-segmentation, and Figure 6b demonstrates the network connectivity with micro-segmentation. In the diagram, \(V_{r}\) represents a router, \(V_{ai}\)\(i\) = 1, 2, 3 denotes a host in subnet \(a\), and \(V_{bj}\)\(j\) = 1, 2, 3 denotes a host in subnet \(b\). In the absence of micro-segmentation, hosts within a subnet are adjacent nodes to each other, and access across subnets must go through the router. For instance, to reach \(V_{b2}\) from \(V_{a1}\), traffic must traverse the edges: \(V_{a1}\), \(V_{r}\), and \(V_{r}\), \(V_{b2}\). When a source node requires passage through an intermediate node to reach a target node, traffic on this edge can be intercepted for traffic analysis. However, when a source node can reach the target node directly, traffic analysis cannot be performed on this edge, and the traffic between them cannot be visualized. This topology can be effectively represented using graph theory, providing a comprehensive view of the network's connectivity and facilitating network analysis. The inability of a third party to capture traffic increases the likelihood of a successful lateral attack, as there is a low probability that the attack will be exposed. Conversely, as the amount of uncaptured traffic in the network increases, the probability of success for such an attack also increases. In this context, we introduce the concept of Probability of Attack Exposure (PoAE), which is defined as follows:  
\[PoAE=\frac{\text{traffic that can be analysed}}{TT}, \tag{1}\]  
Figure 6: Illustration of nodes access relationships. \[TT=\sum_{x\in V}F_{x}. \tag{2}\]  
In Equation (1), the term _traffic that can be analysed_ represents the sum of the traffic obtained through network mirroring, while \(TT\) corresponds to the total traffic on the intranet. In Equation (2), \(F_{x}\) denotes the sum of the incoming and outgoing flows at node \(x\). In the absence of micro-segmentation, traffic within the same subnet bypasses the router, rendering it unattainable for third-party capture. For example, if 80% of the traffic on a subnet was within the subnet and 20% was outside the subnet, the PoAE for that subnet would be 20%. With the implementation of micro-segmentation, the original subnet undergoes fragmentation into multiple new subnets. Each new subnet, except for the router, consists of a single node, necessitating that all traffic pass through the router. Consequently, the likelihood of attack exposure reaches 100% within this configuration. The vulnerability to lateral attacks increases for nodes exhibiting a higher in-degree, while nodes with a greater out-degree experience more severe consequences following compromise. To quantify the concentration of connections within a node, two parameters are utilized: the in-degree aggregation coefficient (IdAC) and the out-degree aggregation coefficient (OdAC).