Security Domain Distribution Algorithms for Enhancing Corporate Network Protection: A Comparative and Vulnerability Weight-Based Approach

Increasing the security of corporate networks against unauthorized lateral movement requires transitioning from traditional single-perimeter defenses to logical network segmentation into dedicated security domains. This paper proposes a formal mathematical and algorithmic framework for partitioning network node-objects into security domains based on pattern recognition theory. Corporate network node-objects are modeled as a graph-tree structure G(U, V), characterized by m-dimensional binary or weighted service feature vectors. We develop and formalize two structural segmentation algorithms: (1) a comparative distribution algorithm (L-type), which groups nodes through logical matching and intersection of exposed service categories, and (2) a vulnerability weight-based distribution algorithm (G-type), which assigns normalized security risk weights to services based on CVSS severity metrics and aggregates them into cumulative security scores. Unlike prior heuristic approaches, this work explicitly establishes rigorous mathematical criteria for threshold selection (δ) and disambiguates static security risk scoring from dynamic network traffic load balancing. The algorithms are demonstrated on a representative enterprise network cluster consisting of a DNS server, a combined WWW/FTP server, and a software development workstation. The results show how logical service clustering and risk-weighted distance metrics converge to well-justified domain boundaries. While demonstrated on an illustrative three-server topology, the computational properties, model assumptions, and algorithmic boundaries for large-scale enterprise deployments are critically analyzed.