AutoSeg: Automatic micro-segmentation policy generation via configuration analysis

Micro-segmentation isolates network segments within different parts of an application, reducing potential attack surfaces. This technique has become increasingly common for enhancing security in cloud application infrastructures. Despite its benefits, the complexity of managing numerous service interactions can make defining and maintaining micro-segmentation policies challenging and prone to errors. Previous solutions have attempted to simplify policy creation, but gaps remain in their applicability, auditability, and response times.

In this paper, we proposed the first configuration-based approach, AugoSeg, which automates the generation of micro-segmentation policies for cloud-native applications. By analyzing network configurations in service containers, AugoSeg identifies service dependencies and automatically creates corresponding policies. This system specifically targets commonly used, behavior-focused configurations, addressing the shortcomings of earlier systems through its design.

We systematically evaluated AugoSeg, using the 184 services from 61 popular projects, covering 14 programming languages. The results illustrated that AugoSeg can completely model service dependencies for over 96.7% of projects and formulate restrictive policies in an average time of 7.13 s. It effectively restricts attackers’ lateral movements within networks. This evaluation not only underscores the efficiency of AugoSeg but also demonstrates its practical applicability in cloud environments, setting a new approach for micro-segmentation in cloud-native security.