# A Micro-Segmentation Method Based on VLAN-VxLAN Mapping Technology
## 2 Relation Work
### Micro-Segmentation  
According to [PERSON] [19], micro-segmentation, a key component of zero trust architectures, was considered the optimal technology choice for achieving a zero trust model in cloud environments. Micro-segmentation focused on the inside of the cloud environment, monitored threats to east-west traffic, and provided true micro-level visibility as opposed to traditional network security solutions such as firewalls/intrusion detection systems. Many security organizations understood the benefits of micro-segmentation.  
The article [20] argued that the adoption of SDN technology had enabled the widespread implementation of micro-segmentation. Micro-segmentation served two critical tasks: identifying network traffic above the transport layer and controlling network traffic based on policies. By identifying network traffic above the transport layer, micro-segmentation provided greater visibility into network activity, allowing for more precise and effective monitoring and control. This was particularly important for security, as it enabled administrators to detect and respond to threats more quickly. Policy-based network traffic control referred to the ability to segment network traffic based on specific policies. By doing so, micro-segmentation enabled administrators to apply specific rules and controls to different segments of the network, providing a more granular level of control and greater security.  
[PERSON], [PERSON] et al. [21] classified micro-segmentation techniques into three categories: VM-based monitoring procedures, network isolation, and host-agent-based micro-segmentation. The article argued that host-agent-based micro-segmentation was the superior micro-segmentation approach and designed a zero trust security architecture using the host-agent approach. [PERSON], [PERSON] et al. [22] addressed the problem of host agent-based micro-segmentation taking up a lot of host resources. They designed a distributed intrusion detection-based host micro-segmentation automatic generation model, which improved the security of hosts within the data centre without taking up too many computing resources of servers. However, the host-agent-based approach brought with it compatibility risks and consumed host resources.  
[PERSON], [PERSON] et al. [23] deployed three virtual servers in a Microsoft Azure environment and utilized micro-segmentation using the Illumina Adaptive Security Platform to whitelist some of the traffic between the servers, allowing for communication, while denying access to the rest by default. The authors also highlighted that network-based micro-segmentation is simpler to implement compared to business-based micro-segmentation.  
[PERSON], [PERSON] et al. [24] proposed a method to evaluate micro-segmentation and compared it to traditional architectures in terms of exposure and robustness of the network. They designed a mathematical quantitative model for experimental comparison in terms of shortest path, maximum out-degree, average betweenness, etc. The experimental results showed that micro-segmentation was much more secure than traditional network architectures. We have examined the author's approach and introduce our own method of evaluation.