# A Micro-Segmentation Method Based on VLAN-VxLAN Mapping Technology
## 3 Proposed Method
### Enhanced Behavioural Profiling Algorithm
For example, if 10.8.6.130 was accessed only by 10.8.6.122 and 10.8.6.125 at 14:04 on 16 February 2023 with 24 KB and 198 KB of traffic in the inbound direction, respectively, then the traffic for 10.8.6.130 at that time point was converted into a vector (0, 0, \(\ldots\), 24, 0, 0, 198, 0, \(\ldots\), 0), with the locations of 24 and 198 corresponding to 10.8.6.122 and 10.8.6.125 in the asset table. The daily traffic for each asset was parsed to form a 2880 \(\times\) 936 matrix, which represents the variation in intranet traffic for that asset over a day. By continuously training the model, a behavioural portrait of each intranet asset can be created. Understanding the traffic relationships between intranet assets has been a crucial objective of our analysis. To optimize efficiency, we have limited our packet capture to the initial 84 bytes of message content, which includes important parameters such as source address, destination address, source port, destination port, protocol, and payload length. In order to avoid overfitting, we have simulated attacks to augment our capture data. For instance, we have simulated a periodic data leak in the traffic associated with 10.8.6.130 during instances of manual data synchronization. Additionally, we have subjected the

\begin{table}
\begin{tabular}{c c c} \hline \hline
**IP Address** & **Communication Objects** & **Communication Time** \\ \hline
10.8.6.122 & 10.8.6.0/24 & All day \\ \hline
10.8.6.123 & 10.8.6.0/24 & All day \\ \hline
10.8.6.124 & 10.8.6.0/24 & All day \\ \hline
10.8.6.125 & 10.8.6.0/24 & All day \\ \hline
10.8.6.126 & 10.8.6.0/24 & All day \\
10.8.6.127 & 10.8.6.0/24 & All day \\ \hline
10.8.6 target asset to sporadic large file uploads to simulate anomalous bursts of traffic, while also conducting simulated intranet scan attacks using nmap or fscan, as well as hourly timed scans using 10.8.6.138. To assess the susceptibility of assets to vulnerabilities, we have utilized 10.8.9.15, our vulnerability scanning appliance, to conduct regular periodic scans every Friday night. Our study has focused on the traffic relationships between intranet assets, and hence we have not examined the contents of message payloads. The analysis of the traffic relationship between asset 10.8.6.130 and other assets is presented in Figure 9, which illustrates the flow over the course of a day. The horizontal axis denotes the time dimension of the day, while the vertical axis represents the flow, with inbound directional flow indicated by values greater than 0 and outbound directional flow indicated by values less than 0. Asset 10.8.6.130 is utilized as an example to demonstrate the traffic flow. The graphical depiction in Figure 9 reveals a pattern of lower network traffic volatility between the intranet asset 10.8.6.130 and its counterparts. Notably, several of these counterparts exhibit a discernible cyclicality. This traffic characteristic is indicative of a shared attribute, with the majority of internal assets found within a typical data centre. The primary objective of our experiments was to promptly identify intranet assets exhibiting anomalous behaviour, necessitating an initial comprehension of their typical behaviour. Accordingly, we established a rudimentary model delineating the traffic rela

Figure 9: The extent of PoAE’s improvements. tionship between the asset of focus and other intranet assets. In particular, we observed apparent periodic traffic surges resulting from data synchronisation, data backup, and other analogous events. To scrutinize the traffic in minute detail, we generated two traffic records for each minute, recording the inbound and outbound traffic flows to and from the asset under consideration and other intranet assets, respectively. This traffic was mirrored to the nearest VTEP switch's traffic analysis device, and after pre-processing, machine learning was performed on the data to obtain an asset traffic profile. Comparisons between networks with and without micro-segmentation were conducted.