# A Micro-Segmentation Method Based on VLAN-VxLAN Mapping Technology
## 3 Proposed Method
### Enhanced Behavioural Profiling Algorithm

Table 3: Aggregation values for each node in Figure 6.  
```
1:while asset; in [\"asset1\", \"asset2\", \"asset3\",...]do
2:for day in range(1, 30)do
3: capture_traffic(asset\({}_{i}\))
4: separate_minute_traffic(asset\({}_{i}\))
5: separate_in_out_traffic(asset\({}_{i}\))
6: analyze_traffic(asset\({}_{i}\))
7: matrix\({}_{i}\_day=[]\)
8:for minute in range(1, 2880)do
9: matrix\({}_{i}\_day\_row=[]\)
10: matrix\({}_{i}\_day\_row+=\) asset\({}_{i}\).get_traffic_vector(minute)
11: matrix\({}_{i}\_day\_append(matrix_{i}\_day\_row)\)
12:endfor
13:endfor
14: matrix\({}



The data centre's SDN network architecture comprised an SDN controller, a Spine node switch, and two-Leaf node switches. A distributed VxLAN deployment model was utilized for the SDN network, where the Leaf node switches performed the dual roles of encapsulating VxLAN messages and functioning as Layer 3 gateways to VxLAN. The private cloud data centre's physical servers served as host nodes for the cloud platform, with each host accommodating multiple virtual machines. To enable virtualization, a virtual switch was created at each host node using virtualization software. However, due to the use of different vendors for the cloud platform and the SDN network, extending the SDN network to the virtual network of the cloud platform was not feasible. It is important to note that Figure 7 only shows a subset of the network assets present in the data centre. In the context of ZTA, auditing traffic between virtual machines is of paramount importance. In pursuit of this objective, we implemented a traffic mirroring mechanism, whereby the network traffic of the intranet was duplicated and analysed by a situational awareness system, enabling prompt identification of anomalies in the intranet. However, the efficacy of situational awareness in detecting abnormal traffic is contingent on the integrity of the traffic mirror, which must be positioned as close as possible to the point of traffic origination, i.e., close to the virtual machine. In our environment, the vSwitch does not provide the necessary mirroring capabilities, and using Open vSwitch ([[http://www.openvswitch.org](http://www.openvswitch.org)]([http://www.openvswitch.org](http://www.openvswitch.org))) to mirror traffic on each downlink port would compromise the host NIC's performance and require configuration on each vSwitch. Hence, we elected to perform traffic mirroring at the Leaf nodes, necessitating minimal configuration at the two Leaf nodes and ensuring that the traffic mirroring setup would not need modification as the private cloud platform scales up. However, this approach is less comprehensive than port mirroring directly on the vSwitch, as it does not capture all traffic, such as that between VM1 and VM2 belonging to the same VLAN and exchanging traffic via vSwitch A.

Figure 7: An example of network topology. ### Business Interruption Time

Although the utilization of VxLAN technology and VNI isolation in the data centre provided some level of security, complete visibility of network traffic within the data centre was not achieved. Specifically, traffic within the same tenant remained invisible. To address this issue, modifying the VNI would have been necessary, which would have entailed changing the service addresses of the virtual machines, configuring new routing entries, and informing end users of the new service addresses. Such modifications could cause significant business disruptions lasting from minutes to hours. In an enterprise setting, the implementation of micro-segmentation poses significant challenges, hindering its widespread adoption, as highlighted in previous research [19]. These challenges primarily pertain to the configuration, operations, and maintenance aspects of micro-segmentation, as well as the required outage windows. This study evaluates the implementation challenges of micro-segmentation within an existing business environment, where virtualized servers are deployed, offering flexibility in configuring CPU, memory, disk space, and network cards.