# A Micro-Segmentation Method Based on VLAN-VxLAN Mapping Technology
## 3 Proposed Method
### Enhanced Behavioural Profiling Algorithm
Further investigation through log queries revealed that this asset was an IoT face recognition terminal, which did not exhibit any attack behaviour. The fluctuation in data was attributed to network instability. The terminal temporarily stored data locally and then uploaded them to the server at 10.7.1.194 when the network conditions were stable. These findings highlight the effectiveness of our algorithm in accurately discerning anomalies, particularly when considering the time dimension and differentiating irregular behaviour from genuine threats. By leveraging this approach, we have achieved a high accuracy rate in anomaly detection, ensuring the reliability and robustness of our algorithm in practical scenarios. We implemented our algorithm on 20 assets within a campus network to monitor their traffic behaviour throughout the duration of a network security attack and defense drill. The performance of our approach was compared with the existing security protection system deployed on the campus network. During the drill, an attacker successfully breached a monitored server in the internal network using a near-source attack. The attack method was highly covert, resulting in the generation of only a single log entry within the traditional security log. Due to the high volume of logs produced during the drill, the defense personnel did not detect this critical log entry in time, thereby failing to identify the attacker. However, by applying our algorithmic model, we were able to detect abnormal behaviour in the compromised internal network asset. When the attacker attempted lateral movements within the internal network, our system promptly identified and blocked the malicious activity, effectively preventing further intrusion. Our timely response and appropriate countermeasures were recognized and commended by the referee team overseeing the drill. This incident demonstrates the efficacy of our micro-segmentation architecture and asset behaviour algorithm in countering internal threats and addressing complex cyber-attacks. ## 5 Conclusions

The \"Zero Trust Architecture\" represents a novel cybersecurity framework that emphasizes the continuous auditing of all assets within cyberspace. Achieving comprehensive visibility of network traffic, devoid of any blind spots, is a fundamental requirement for this approach, and it can be accomplished through the implementation of micro-segmentation. This research article investigates two models of micro-segmentation, namely network micro-segmentation and host micro-segmentation. While network micro-segmentation offers certain advantages in terms of resource consumption and program compatibility, it is susceptible to audit blind spots and does not facilitate real-time services. To mitigate these limitations, this paper introduces a micro-segmentation technique based on VLAN-VxLAN mapping, which is protocol-independent and ensures auditing of all network traffic. Moreover, this article quantifies the network micro-segmentation approach in terms of network aggregation and traffic visibility. Furthermore, this paper presents an enhanced algorithm for profiling asset behaviour, which is specifically tailored to the implementation of micro-segmentation. This algorithm effectively identifies abnormal behaviour exhibited by intranet assets, offering valuable insights for prompt disposal of such assets once their abnormal behaviour is detected. By leveraging the principles of differential segmentation and the proposed asset behaviour profiling algorithm, organizations can efficiently manage and mitigate potential risks arising from intranet assets. Through this research, we aim to contribute to the advancement of cybersecurity practices by addressing the challenges associated with network visibility, micro-segmentation, and asset behaviour analysis. The proposed solutions provide a foundation for the development of more robust and efficient cybersecurity systems in the context of the evolving threat landscape. Writing--original draft, D.L. ; funding acquisition, Z.Y.