# A Micro-Segmentation Method Based on VLAN-VxLAN Mapping Technology
## 3 Proposed Method
### Enhanced Behavioural Profiling Algorithm
Subsequently, we established differential segments for multiple assets and monitored them continuously for a certain duration. Table 5 enumerates the maximum and minimum flow values for each asset within a day, along with the number of assets they have flows with, while Table 6 displays the expected total flows in both inbound and outbound directions for each asset in a day, as well as the variance after normalisation. Tables 7 and 8 represent the data before the implementation of micro-segmentation. Table 5 provides evidence of the effects of micro-segmentation on the behaviour of intranet assets. Specifically, it shows that, with the exception of 10.7.1.194, the behaviour of assets becomes more predictable after the implementation of micro-segmentation, as evidenced by the relatively small range of fluctuations in the number of peer assets generating traffic. This result suggests that micro-segmentation has effectively stabilized the behaviour of these assets. In contrast, 10.7.1.194, a face recognition server with distributed terminals across the campus, exhibits a higher level of traffic variability during the winter break when the number of terminals is reduced to 1/4 of the peak and with less than 1/60 th of the peak face recognition transmission data. The traffic data presented in Table 7 for asset 10.7.1.194 is devoid of the winter break data, and as such, it reflects a similar level of stability to other intranet assets. Upon comparing the two datasets, it is evident that there was an increase in the total amount of traffic visible for all assets after the implementation of micro-segmentation. The increase in traffic visibility is dependent on the type of business traffic associated with the asset, where a greater amount of traffic within the same segment before micro-segregation leads to a higher increase in visibility traffic after micro-segregation. Specifically, the visibility traffic of asset 10.8.6.129 increased from approximately 210 KB to approximately 13,400 KB, a growth of approximately 63.5 times, while 10.7.1.194 only increased by 27% due to most of its traffic being cross-segment traffic. As micro-segmentation identified all traffic, the PoAE after micro-segmentation was 100%, and the PoAE before micro

\begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{**Asset**} & \multicolumn{2}{c}{**Flows in the Inbound Direction**} & \multicolumn{2}{c}{**Flows in the Outbound Direction**} & \multicolumn{2}{c}{**Number of Assets Generating Flow**} \\ \cline{2-6}  & **Minimum (KB)** & **Maximum (KB)** & **Minimum (KB)** & **Maximum (KB)** & **Minimum** & **Maximum** \\ \hline
10.8.6.122 & 2576 & 3527 & 2935 & 3037 & 3 & 3 \\ \hline
10.8.6.123 & 24,739 & 36,081 & 42 & 93 & 2 & 3 \\ \hline
10.8.6.124 & 169 & 207 & 125 & 203 & 1 & 2 \\ \hline
10.8.6.125 & 2099 & 4742 & 61 & 68 & 3 & 4 \\ \hline
10.8 segmentation can be calculated as the ratio of traffic before micro-segmentation to traffic after micro-segmentation. The increase in PoAE for each asset is shown in Figure 10.

The comparison of data before and after micro-segmentation revealed a significant increase in traffic from other assets to the target asset after the implementation of micro-segmentation. These assets were already communicating with the target asset prior to micro-segmentation, but their traffic was not captured. The set of peer assets analysed before micro-segmentation, denoted as \(Au\), was found to be a subset of the set of peer assets analysed after micro-segmentation, denoted as \(Aw\). For example, asset 10.8.6.130 had three communicating assets before micro-segmentation, and at most eleven assets, including the original three, after micro-segmentation. This indicates a decrease in the total degree of the asset. The effectiveness of this degree reduction is demonstrated in Figure 11, where the total maximum visible degree decreased. ### Asset Abnormal Behaviour Detection

Using the KMEANS algorithm proposed by [PERSON], [PERSON] et al.