Automatic Generation of Network Micro-Segmentation Policies for Cloud Environments

Network segmentation is a technology that effectively defends against network threats, especially lateral movement attacks. However, the dynamics of the networks and the blurring of boundaries make it difficult for administrators to develop segmentation policies. In this paper, we propose a solution for the automatic generation of network micro-segmentation policies for cloud environments. We use dynamic and static analysis algorithms to obtain legitimate access relationships between services, which are used to construct network segments. Moreover, we design a policy engine to automatically convert network segments into low-level rules to achieve micro-segmentation policy recommendations. Finally, the results of our evaluation show that our scheme has a high level of accuracy and coverage.