Towards a Zero-Trust Micro-segmentation Network Security Strategy: An Evaluation Framework

Nardine Basta
Macquarie University

Muhammad Ikram
Macquarie University

Dali Kaafar
Macquarie University

Andy Walker

Micro-segmentation <cit.> is an emerging security technique that separates physical networks into isolated logical micro-segments (workloads). By tying fine-grained security policies to individual workloads, it limits the attacker’s ability to move laterally through the enterprise network, even after infiltrating the perimeter defences. While micro-segmentation is proved to be effective for shrinking enterprise networks attack surface in general <cit.>, the impact assessment of micro-segmentation is almost absent in the literature. This research is dedicated to developing an analytical framework to characterise and quantify the effectiveness of micro-segmentation on enhancing enterprise networks security. We rely on a twofold graph-feature based framework of the network connectivity and attack graphs to evaluate the network exposure and robustness respectively. While the former assesses the network assets connectedness, reachability and centrality, the latter depicts the ability of the network to resist intelligent and goal-oriented attackers. Tracking the variation of formulated metrics values post the deployment of micro-segmentation reveals exposure reduction and robustness improvement in the range of 60% – 90%.

Micro-segmentation, zero-trust.

§ INTRODUCTION

Micro-segmentation <cit.> is a core component of the zero-trust security concept. It creates secure zones across cloud and data centre environments to isolate the different application workloads and secure them independently. It further enforces access control through the generated micro-segmentation policies. It protects the network assets and provides greater control and visibility over the growing amount of east-west traffic across the organization which bypasses the traditional firewalls.

Autonomously modelling application behaviour and accounting for workloads is a major challenge towards achieving a zero-trust architecture. This can be attributed to the fact that enterprises data centre has evolved from on-premises infrastructure to a distributed facility with inter-connected cloud infrastructure
where networks, applications and workloads are virtualized in multiple private and public clouds. Hence, in addition to the introduced complexity of the network architecture, enterprises have little confidence in their underlying network structure and connectivity.

While several micro-segmentation solutions are currently offered by industry (e.g., ditno <cit.>, Cisco <cit.>, and others), the general question of how effective and efficient these security controls are still persists. In fact, little is known about how implementing these controls would compare to security risks within flat networks. This is not only essential to understand what level of protection is offered by the different security controls within an enterprise network, but is also important to justify resources and investment to augment existing controls.

In this paper, we leverage attack-graph generation and probabilistic reasoning framework for comprehensive security and effectiveness analysis of network micro-segmentation. The main contributions of our work are as follow:

* We develop a framework to assess and quantify the effectiveness of micro-segmentation in reducing the enterprise network assets risk of exposure to insider and outsider threats. We further analyse the robustness of the network by measuring its ability to resist intelligent and goal-oriented attackers.

* To generate a reproducible and objective evaluation framework we base our formulated metrics on graph feature analysis of the generated network connectivity and attack graphs.

* We rely on two enterprises network data and our proposed framework to perform an empirical analysis of the effectiveness of micro-segmentation. To the best of our knowledge, no previous work to quantify the impact of micro-segmentation, while relying on real-life network traffic, exists.

The rest of the paper is organised as follows: Section <ref> presents background information about micro-segmentation and overviews related work. Section <ref> introduces the characterization framework where Subsection <ref> discusses the exposure metrics while Subsection <ref> proposes the robustness metrics. In Section <ref> we present the results and an empirical analysis of the different formulated metrics and conclude the paper in Section <ref>.

§ BACKGROUND AND RELATED WORK

§.§ Background

Micro-segmentation is an implementation of a distributed virtual firewall that regulates access to network assets based on security rules that have been determined on each workload (micro-segment). The firewalls examine the internal network traffic up to layer four (transport layer) of the  Open Systems Interconnection (OSI) model and enforce access control through the generated micro-segmentation policies. Figure <ref> depicts the connectivity structure of a sample enterprise network before and after micro-segmentation.

[Flat network]

[Segmented network]

An example of flat and micro-segmented network topologies of an enterprise network. In Figure <ref>, the nodes represent workloads (or micro-segments) that are fully connected with no restrictions on the internal communication. In Figure <ref>, the flat-network is micro-segmented into different workloads (shown in circles) thus restricting the east-west traffic

Unlike traditional firewalls that have no business logic or context into applications, the micro-segmentation firewalls are often implemented in software and deployed on each network workload. Machine-learning techniques are used to leverage the meta-data from micro-segments for firewall rules generation and generalisation across similar workloads. The network micro-segmentation firewalls are all linked to central management that pushes the policies to each firewall. It, therefore, enables granular policy enforcement throughout the enterprise network, not just at the perimeter.

There exist different possible architectures for dividing IT services into multiple tiers. Services are most commonly divided into three tiers; web servers, application servers and databases. Nevertheless, some approaches combine the web and application server tiers. Workloads within a single IT service are allowed to communicate to each other through very restrictive rules to minimise the propensity of lateral movements. As a result, micro-segmentation offers better visibility and accountability of network resources and communication among micro-segments.

§.§ Related Work

Efforts have been deployed in the domain of measuring and quantifying network security in general and the effectiveness of firewalls in particular. In fact, quantifying security is one of the well-recognized open problems <cit.> where most of the approaches quantify the overall network security performance <cit.>. Some approaches were specially dedicated to analysing the deployed firewalls <cit.> and quantifying their effectiveness <cit.>.

Although micro-segmentation has gained momentum in reducing the network attack surface, improving breach containment and strengthening regulatory compliance, the assessment and quantification of its performance are almost absent in the academic and industrial literature. Only one approach is found to quantify the overall efficacy of micro-segmentation by measuring the time it takes the attacker to traverse the network and compromise its assets <cit.>.
Nevertheless, the utilised metric is based on the attacker's skills rather than the strength of the micro-segmentation techniques thus it fails to measure the efficacy of micro-segmentation techniques. Additionally, the tests were conducted in a simulated network environment rather than a real network.
In this paper, we fill the gap by providing more comprehensive and reproducible metrics to accurately represent the impact of micro-segmentation on enhancing the security of enterprise networks.

§ MICRO-SEGMENTATION IMPACT QUANTIFICATION FRAMEWORK

In this section, we outline our framework which assesses the impact of micro-segmentation on enterprises network security through quantitative metrics based on graph analysis.
In particular, we characterise the impact of micro-segmentation on the network exposure and robustness.

§.§ Network Exposure

Keeping pace with the dynamic nature of the industry, enterprise networks are evolving fast. In fact, network exposure, due to expanding the network connectivity, is the new IT risk many businesses are ignoring at their peril. Hence, comes the importance of micro-segmentation to block the illegitimate, insecure or unneeded connections and control the east-west traffic within the enterprise network.

To formally define network exposure, let $\mathit{C(A,V,w)}$ be the network connectivity directed graph where $\mathit{V}$ is the set of graph vertices representing the network assets. $\mathit{A}$ is the set of graph directed edges indicating that the connected vertices are allowed to communicate, where $\mathit{A \subseteq \{ (x,y) \;| \; (x,y) \in V^2 \land x \neq y\}}$. $\mathit{w: A \rightarrow \mathbb{R}}$ is a weight function representing the number of services that the network assets are allowed to use for communicating in the direction of the connection. We classify the network exposure metrics into three categories: connectedness, reachability, and centrality.

connectedness: A direct indicator of the internal network exposure is the amount of connections allowed to and from the different enterprise network assets. In fact, the higher the connectedness between the network assets, the more the possibilities/ways that are presented to attackers in order to achieve their malicious target.

We formulate the first metric to quantify the enterprise network exposure in this context, namely the Enterprise Network Internal Connectivity Exposure (ENICE). We compute the ENICE metric as the total sum of weights of the connectivity graph edges as indicated by Equation <ref>. The weights designate the number of allowed services that the network assets use to communicate in the direction of the connection.

\begin{equation}\label{eq:ENICE}
ENICE = \sum\limits_{a\in A} w(a)
\end{equation}

The clustering coefficient of a connectivity graph measures how interconnected a vertex’s neighbours are to one another. The higher the clustering coefficient, the more exposed the network assets are to lateral attacker movement after a successful attack. The global clustering coefficient is designed to give an overall indication of the clustering in the network based on triplets of nodes. A triplet is three nodes that are connected by either two (open triplet) or three (closed triplet) ties. Accordingly, the second exposure metric, namely the Global Clustering coefficient (GC), of the network connectivity graph is calculated as follows:

\begin{equation}\label{eq:GCC}
GC_C={\frac{number\;of\;closed\;triplets}{total\;number\;of\; triplets}}
\end{equation}

Reachability: Given the network connectivity graph, finding out the vertices that are reachable from another vertex $\mathit{v}$ is an indicator of the number of possibly compromised assets in case $\mathit{v}$ is illegitimately accessed. A direct measure of reachability is the shortest path analysis of the network connectivity graph. The shortest path represents the minimum hops an attacker needs to exploit until reaching a target asset. The longer the shortest path, the more effort an attacker needs to deploy to gain access to a target asset.

The Mean of shortest Path Length (MPL), the first reachability metric, represents the average number of hosts, in the best case, an attacker needs to access before compromising a target network asset. It is a strong indicator of how likely are the network assets reachable from a compromised source.  Let us denote by $\mathit{LSP_C}$ the list of shortest paths in the connectivity graph $\mathit{C}$ and by $\mathit{p}$ a path in the connectivity graph where $\mathit{|p|}$ is the number of vertices in the path $\mathit{p}$. $\mathit{MLP_C}$ is calculated following Equation <ref>.

\begin{equation}\label{eq:avgp}
MPL_C={\frac{1}{|LSP_C|}\sum\limits_{\forall p \in LSP_C}|p|}
\end{equation}

The diameter of a graph is the maximum eccentricity of any vertex in the graph. It is equal to the maximum shortest path length of the connectivity graph. It is an indicator of the longest chain an attacker is forced to pursue to compromise a target network asset from a compromised source asset. The latter is assuming the attacker always aims at taking the shortest path to reach its target asset. Let $s(u,v)$ denote the shortest path distance from vertex $u$ to vertex $v$. The Connectivity graph Diameter (CD), the second reachability metric, can be defined as follows:

\begin{equation}\label{eq:MITCO}
CD_C=\max_{\forall v,u \in V}{\left \{ s(u, v) \right\}}
\end{equation}

The transitive closure of a connectivity graph $\mathit{C}$ is a graph $\mathit{C^T=(A^T,V)}$ such that for all $\mathit{i,j \in V}$ there is a link $\mathit{(i,j)}$ if and only if there exists a path from $\mathit{i}$ to $\mathit{j}$ in $\mathit{C}$. Therefore, it provides a more detailed perspective of how far an attacker can go subsequently to compromising a network asset. A direct indicator of the latter is the number of transitive paths in the network represented by the transitive closure graph edges. Standing on this ground, we proceed by formulating the third reachability metric, namely the Transitive Internal Network Reachability (TINR), following Equation <ref> where $\mathbb{A^T}$ is the set of edges of the transitive closure graph $\mathit{C^T}$ corresponding to the network connectivity graph $\mathit{C}$.

\begin{equation}\label{eq:TINE}
TINR_C =|A^T|
\end{equation}

Centrality: Nodal centrality quantifies how important a node is within a network. Hence, it implies the impact of compromising the node on the overall network security. The out-degree centrality metric of the network connectivity graph vertex $\mathit{v}$ outlines the number of possibly compromised assets by the attacker in case $\mathit{v}$ is compromised. Accordingly, we develop a metric namely AVerage Out-Degree (AVOD) to account for the typical number of possibly compromised assets after a successful attack. Let $\mathit{OD(v)}$ be the out-degree of a connectivity graph $\mathit{C(A,V)}$ node $\mathit{v \in V}$. The average out-degree is given by:

\begin{equation}\label{eq:avgOD}
AVOD_C={\frac{1}{|V|}\sum\limits_{\forall v \in V}OD(v)}
\end{equation}

The closeness centrality is tightly related to the notion of distance between nodes. It highlights nodes that may reach any other nodes within a few hops and nodes that may be very distant in the graph. The closeness centrality value of a network asset $\mathit{v}$ indicates how fast an attacker, after compromising $\mathit{v}$, can access all other nodes in the network. The CLoseness centrality (CL) of node $\mathit{v}$ is computed following Equation <ref> where $\mathit{d(v, u)}$ is the distance (number of hops) between $v$ and $u$:

\begin{equation}\label{eq:cl}
CL(v)={\frac{1}{\sum\limits_{\forall u \in V}d(v,u)}}
\end{equation}

Accordingly, the average closeness, the second centrality metric, of the network connectivity graph nodes is an indicator of how fast the whole network can be compromised after a breach. It is calculated as follows:

\begin{equation}\label{eq:avcl}
AC_C={\frac{1}{|V|}\sum\limits_{\forall v \in V}CL(v)}
\end{equation}

§.§ Network Robustness

Network robustness is the ability of a network to resist intelligent and goal-oriented attackers. To measure enterprise networks robustness, we leverage the attack graph structure in conjunction with a component metric such as the Common Vulnerability Scoring System (CVSS) <cit.>. An attack graph is a succinct representation of all paths through a system that ends in a state where an intruder has successfully achieved his goal <cit.>. We classify the attack graph-based network robustness security metrics into three categories; non-path analysis security metrics, path analysis security metrics and CVSS-based metrics. We generate the network attack graph using the MulVAL tool <cit.> by combining the output of the vulnerability scanner Nessus <cit.> and the enterprise network perimeter and micro-segmentation firewall policies.

To formally define network robustness, let $\mathit{G(E, N)}$ be the enterprise network attack graph which consists of a set of nodes $\mathit{N}$ of three types <cit.>: attack step nodes, privilege nodes signifying a compromised asset and configuration nodes that represent a fact about the current network configuration that contributes to attack possibilities. Let $\mathit{R_G}$ be the root nodes of the attack graph $\mathit{G}$ representing network configurations that contribute to one or more attack possibilities. Let $\mathit{L_G}$ be the set of privilege nodes of $\mathit{G}$ denoting the compromised assets. The set of paths $\mathit{P_G}$ of the attack graph $\mathit{G}$ comprises all directed attack paths starting at the root nodes $\mathit{R_G}$ and ending at the privilege nodes $\mathit{L_G}$.

Path-Based metrics: The shortest path metric indicates the minimum number of attack steps an attacker should perform to compromise an asset in the network. Since a chain is only as strong as its weakest link, it is a significant indicator of the network robustness. Indeed, attackers would need a global view of the system vulnerabilities to be able to deliberately exploit the shortest path. However, the probability of the shortest path to be exploited is directly proportional to the number of shortest paths in the network <cit.>. Hence, we define the Number of Shortest Paths metric (NSP) to describe the total number of attack paths with a length equal to the shortest path between every root node $\mathit{r \in R_G}$ and every privilege node $\mathit{l \in L_G}$ in the attack graph $\mathit{G}$. Let us denote by $\mathit{LSAP_G}$ the list of shortest attack paths in the attack graph $\mathit{G}$. The $\mathit{NSP}$ metric is given by:

\begin{equation}\label{eq:nshortp}
\end{equation}

The Minimum Shortest Path Length metric (MSPL) denotes the absolute minimum number of steps an attacker needs to performs to compromise a network asset. Let $\mathit{p}$ a path in the attack graph where $\mathit{|p|}$ is the number of nodes in the path $\mathit{p}$, accordingly:

\begin{equation}\label{eq:minsp}
MSPL_G=\min_{\forall p \in LSAP_G}{\left \{ |p| \right\}}
\end{equation}

The count of paths with length equal to the minimum shortest paths' length, in conjunction with the MSPL metric, is a direct indicator of the likelihood of a successful attack by outlining the number of network weakest links. Consequently, we define the Count of Minimum Path Length (CMPL) metric. Let $\mathit{LMP_G}$ be the list of paths with length equals to $\mathit{MSPL_G}$ in the attack graph $\mathit{G}$. Accordingly, the $\mathit{CMPL}$ metric is given by:

\begin{equation}\label{eq:Nminp}
\end{equation}

Non-Path-Based metrics: The count of the attack graph configuration nodes is an intuitive yet significant non-path-based measure of the network robustness. The configuration nodes depict facts about the current network configuration that contributes to one or more attack possibilities. Hence, they stand as the attacker's entry point to the network. We proceed by formulating the first non-path metric namely the Count of Mis-Configurations (CMC) following Equation <ref> where $\mathit{R_G \subset N}$ is the set of root nodes of the attack graph $\mathit{G}$:

\begin{equation}\label{eq:CMC}
\end{equation}

The out-degree metric (OD) of the privilege attack graph nodes $\mathit{L_G}$ is an indicator of the number of possible attacks succeeding a compromised network asset. We define two metrics to characterise the attack graph out-degree; the average out-degree $\mathit{AOD_G}$ and the maximum out-degree $\mathit{MOD_G}$ metrics. While the earlier is an indicator of the typical number of attacks after a compromised asset the latter represents the worst-case scenario, indicating the maximum number of possible attacks consequent to acquiring an illegitimate network privilege.

Let $\mathit{OD(n)}$ be the out-degree of an attack graph privilege node $\mathit{n}$. The Average Out-Degree (AOD) and the Maximum Out-Degree (MOD) metrics of an attack graph $\mathit{G}$ are given by Equations <ref> and <ref>, respectively.

\begin{equation}\label{eq:avgODA}
AOD_G={\frac{1}{|L_G|}\sum\limits_{\forall n \in L_G}OD(n)}
\end{equation}

\begin{equation}\label{eq:maxOD}
MOD_G=\max_{\forall n \in L_G}{\left \{ OD(n) \right\}}
\end{equation}

The betweenness centrality of an attack privilege node is the extent to which the vertex plays a bridging role in a network. In other words, it measures the extent that the privilege node falls on the shortest path to other privilege nodes. Accordingly, the higher the betweenness of a compromised privilege node, the more widespread across the network the subsequent privileges the attacker can acquire. The betweenness metric further provides insight into the network weak links that should be prioritised for redemption. The betweenness centrality of a privilege node $\mathit{n}$ is calculated following Equation <ref> where $\mathit{NSP_{rl}}$ is the number of shortest paths from root $\mathit{r \in R_G}$ to privilege $\mathit{l \in L_G}$, $\mathit{NSP_{rl}(n)}$ is the number of shortest paths from root $\mathit{r}$ to privilege $\mathit{l}$ passing through $\mathit{n \in L_G}$ and $\mathit{r \neq l \neq n}$.

\begin{equation}\label{eq:btn}
BN(n)={\sum\limits_{ r \in R_G \land  l \in L_G}\frac{ NSP_{rl}(n)}{ NSP_{rl}}}
\end{equation}

The Average Betweenness (AB) of the attack graph privilege nodes depicts the typical contribution of an illegitimately acquired network privilege in other potential attacks across the network compromising privileges that the attacker could not have reached otherwise. In other words, its propensity of being an attack step in more sophisticated attacks widespread across the network. It is calculated following Equation <ref> where  $\mathit{L_G}$ is the set of privilege nodes of the attack graph $\mathit{G}$.

\begin{equation}\label{eq:Avfbtn}
AB_G={\frac{1}{|L_G|}\sum\limits_{\forall l \in L_G}BN(l)}
\end{equation}

Common Vulnerability Scoring System (CVSS) metrics: Another approach used in attack graph-based security metrics is to assign complexity values to vulnerabilities in the network for communicating the characteristics and severity of software vulnerabilities. This approach reflects differences in the difficulty of exploiting the different vulnerabilities <cit.>. A standard, such as the CVSS <cit.>, may be used to provide guidance in scoring vulnerabilities.

While there is currently no standard way of aggregating vulnerability metrics, a critical issue in measuring network security is to combine measures of individual vulnerabilities, resources, and configurations into a global measure <cit.>. We rely on the work presented in <cit.> to analyse the enterprise network generated attack graph for the purpose of calculating cumulative metrics and aggregate the vulnerability scores. The cumulative score of a given privilege node indicates the likelihood that the corresponding resource is compromised during an attack, or equivalently, among all attackers attacking the given network over a given time period, the average fraction of attackers who can successfully compromise the resource, taking into consideration the effects of all possible inter-plays between vulnerabilities <cit.>. More details of the mathematical model underlying the cumulative risk computation can be found in <cit.>.

The MulVAL attack graph is used as a structural basis for the aggregated score calculation. As previously mentioned, the MulVAL attack graph nodes can be of three types; configuration nodes, privilege nodes (exploits) $\mathit{E}$, and attack step nodes (conditions) $\mathit{C}$. For the purpose of cumulative score computation, the configuration nodes are ignored, therefore an attack graph $\mathit{G}$ can be defined by $\mathit{ G(E \cup C, R_r \cup R_i) }$ where $\mathit{E}$ is a set of exploits, $\mathit{C}$ a set of conditions, $\mathit{R_r \subset C \times E}$ and $\mathit{R_i \subset E \times C}$ <cit.>. The cumulative metric calculation accounts for two types of relations between the different nodes. The first relation is the intersection. It is usually between multiple attack steps (conditions) required to compromise a network asset. The second relation is union. It usually exists between multiple exploits that satisfy the same condition that serves as a prerequisite to another exploit. Let $\mathit{e}$ be an exploit and $\mathit{c_1, c_2}$ be two conditions. Let $\mathit{P(e)}$ be the cumulative probability of exploit $\mathit{e}$ and $\mathit{P(c)}$ be the cumulative probability of condition $\mathit{c}$. Let $\mathit{p}$ be the CVSS individual vulnerability scoring function where $\mathit{ p : E \cup C \rightarrow [0, 1] }$. If the execution of $\mathit{e}$ requires two conditions $\mathit{c_1}$ and $\mathit{c_2}$, then <cit.>:

\begin{equation}\label{eq:cum1}
P(e) = P(c_1)\cdot P(c_2)\cdot p(e)
\end{equation}

However, if a condition $\mathit{c}$ can be satisfied by either $\mathit{e_1}$ or $\mathit{e_2}$ or both, then <cit.>:

\begin{equation}\label{eq:cum2}
P(c) = p(c) \cdot (P(e_1)+ P(e_2) - P(e_1) \cdot P(e_2))
\end{equation}

Accordingly, the generic cumulative score function $\mathit{P : E \cup C \rightarrow [0, 1] }$ is given by <cit.>:

\begin{equation}\label{eq:cum3}
P(e) =  p(e) \cdot \prod\limits_{c\in R_r(e)}P(c)
\end{equation}

If $\mathit{R_i(c) = \emptyset }$, then <cit.>:

\begin{equation}\label{eq:cum4}
P(c) =  p(c)
\end{equation}

Otherwise, let $\mathit{\oplus}$, for any $\mathit{e \in E}$, be recursively defined as:

\begin{equation}\label{eq:cum5}
\oplus(e) = P(e)
\end{equation}

and for any $\mathit{S_1 \subset E, S_2 \subset E}$ such that $\mathit{S_1 \cap S_1 = \emptyset}$:

\begin{equation}\label{eq:cum6}
\oplus( S_1 \cup S_2) = \oplus S_1 + \oplus S_2 - \oplus S_1 \cdot \oplus S_2
\end{equation}

Accordingly, $\mathit{P(c)}$ can be given by <cit.>:

\begin{equation}\label{eq:cum7}
P(c) =  p(c) \cdot \oplus_{e\in R_i(c)} P(e)
\end{equation}

§ ANALYSIS AND RESULTS

In this section, we assess the effectiveness of the proposed framework in evaluating the impact of micro-segmentation on enterprise network security. In particular, we are interested in characterising the impact performance on network exposure and robustness.

To construct the network connectivity graph, representing the basis of the exposure analysis, we identify the network hosts forming the graph nodes. While the flat network connectivity graph is a complete graph, we rely on the micro-segmentation firewall rules to identify the edges of the segmented network connectivity graph. The firewall rules are described in terms of the source host, destination host, service protocol and service destination port.

To assess robustness, the attack graph is generated using the MulVAL tool where the inputs are the Nessus vulnerabilities scanner XML output and the network firewall rules. While the earlier depicts the hosts' vulnerabilities and configurations including the running software and services, the latter models the assets access control list regulating all communications between hosts that are allowed by the network. The firewall rules include the micro-segmentation rules, if any, in addition to the enterprise network firewall rules regulating north-south traffic. In the case of a flat network, the micro-segmentation rules are replaced by one generic rule allowing all internal network traffic.

We consider the network data of two enterprises; a university and a life-care organisation. Table <ref> provides statistics describing the two networks. The connections depict the count of asset pairs allowed to communicate. While we were able to assess the exposure of both enterprises, due to the unavailability of the Nessus vulnerability scanner data for the life-care organisation, the robustness analysis was only limited to the university enterprise network.

The metrics are calculated twice; once prior to the deployment of micro-segmentation and again after the deployment. The results are then compared, assessed and used to draw conclusions which lead to useful insights that follow in this section.

Network configuration

Enterprise     Business     Hosts     Flat Connections     Segmented Connections

Enterprise A     University      300     90,000     4,045

Enterprise B      Life-care organization     238     56,644     3,007

§.§ Network Exposure Analysis

After micro-segmentation deployment, the ENICE values of Enterprises A and B networks are decremented by 99.92% and 99.78% respectively as shown in Figure <ref>. Since the flat network topology, by definition, allows all internal network communications, we assumed that devices can listen on any port. Hence, for the flat network topology, we considered that all connections have an equivalent weight equal to 65,535. It can be argued that hosts are not necessarily listening on every possible port. However, in the flat network topology, nothing can stop a network asset from listening to a particular port. In fact, not many organizations, prior to deploying micro-segmentation, are fully aware of all the ports their assets are listening on. Therefore, micro-segmentation not only regulates the hosts that are allowed to directly communicate, it further restricts the services used for communication between the different network assets.

Restricting the network connectedness further minimises the impact of the zero-day attacks by limiting the ports the micro-segments are listening to. Let us consider the zero-day threat caused by the Windows vulnerability SMBGhost <cit.> affecting the Microsoft Server Message Block (SMB) of the network file sharing protocol. Successful exploitation of this vulnerability enables the attacker to execute arbitrary code on the SMB server or client. The attacker could then possibly install programs; view, edit or remove data. Deploying micros-segmentation, the control rules deny the file-sharing capability on all the enterprise database servers while only allowing connectivity on the SQL port. Despite the presence of a zero-day vulnerability that could be exploited, no attacker is able to connect to the database server on the port that is vulnerable.

Similar behaviour is depicted by the global clustering coefficient. As shown in Figure <ref>, for the flat networks, the GC metric values are close to one indicating a high proportion of closed triads in the graphs. The latter implies that the graph nodes are involved in as many transitive relations as possible. On the other hand, the segmented network GC values are reduced by 80% for Enterprise A and 70% for Enterprise B. It can be remarked that Enterprise A clustering coefficient improvement percentage is higher than B. This can be attributed to the fact that B has leveraged infrastructure across applications thus allowing more transitive connections. In other words, Enterprise B has fewer dedicated unique servers per application. For example, it has three applications sharing the same database server.

[Network Internal Exposure]

enlarge y limits=0.36,upper,
enlarge x limits=0.35,
legend pos=north east,
legend columns=2,
legend style=nodes=scale=0.5, transform shape,
yticklabel style=font=,
xticklabel style=font=,
ytick style=font=,
symbolic x coords=University, Lifecare,
nodes near coords,
nodes near coords align=vertical,
nodes near coords style=font=,
+ coordinates (University, 17635468500) (Lifecare, 11089701630);
+ coordinates (University, 14523704) (Lifecare, 24489385);

Flat, Seg.;

[Global Clustering Coef.]

enlarge y limits=0.36,upper,
enlarge x limits=0.35,

legend pos=north east,
legend columns=2,
legend style=nodes=scale=0.5, transform shape,
ylabel=Clustering Coef.,
yticklabel style=font=,
xticklabel style=font=,
ytick style=font=,
symbolic x coords=University, Lifecare,
nodes near coords,
nodes near coords align=vertical,
nodes near coords style=font=,
+ coordinates (University, 0.99) (Lifecare, 0.99);
+ coordinates (University, 0.19) (Lifecare, 0.29);

Flat, Seg.;

Connectedness exposure analysis

We begin by analysing the distribution of the shortest paths of the network connectivity graphs. Figure <ref> presents the paths length distribution before and after micro-segmentation. The x-axis denotes the relation identifier of the possibly connected pair of hosts and the y-axis represents the shortest path length connecting the two nodes if any. The shortest path length of the flat network of both enterprises has a constant value of one. Hence, an attacker can reach any other network asset in one step. This represents the situation of an employee laptop directly communicating with an enterprise database. In the event the laptop is infected with malware or a CryptoLocker, it could directly infect the connected databases. Contrastingly, the majority of paths length in the segmented network of both enterprises falls in the range of $[2,3]$ with an average value of 2.14 for Enterprise A and 2.17 for Enterprise B as Shown in Figure <ref>. It should be noted that the shortest path length values reflect the number of IT services tiers the organization have. For the two hereby considered enterprises, services have either three tiers (user $\rightarrow$ web server, web server $\rightarrow$ application server, application server $\rightarrow$ database) or two tiers (when the web server and application server tiers are merged together). Consequently, the typical effort an attacker needs to deploy in order to reach a target asset is doubled as a result of micro-segmentation deployment.

The paths with length going to infinity characterising the segmented network of both enterprises designate that there is no path between the two possibly connected assets. The percentage of infinity paths of the segmented Enterprises A and B networks are 5.6% and 27.3% respectively which further limits the assets reachability by restricting the attacker's lateral movement within the network. It is worth mentioning that A has fewer infinity paths because it has more management services characterised by their high connectivity.

Similar behaviour is observed with the worst-case reachability value depicted by the Connectivity graph Diameter metric (CD). Since the connectivity graph of the flat network is complete, the attacker can reach any target asset in exactly one step. Contrastingly, in the case of the micro-segmented network, the maximum effort deployed to attain the intended asset is tripled for both enterprises as Shown in Figure <ref>. This can be explained by the fact that, for these two enterprises, IT services are divided into a maximum of three tiers. Therefore, to compromise the database tier, the attacker needs to first gain access to the web server and the web application tiers.

Whilst the impact of micro-segmentation on the mean shortest path length and diameter of both enterprises is almost identical, the TINR metric exhibits a different behaviour as highlighted by Figure <ref>. For Enterprise A, the transitive reachability is decreased by 5.6% only whereas for Enterprise B, it is decreased by 27.3%. The latter values are found to be identical to the percentages of disconnected nodes as a result of deploying micro-segmentation. Hence, it can be safely deduced that the risk of compromising the network assets is a factor of the number of allowed internal network connections.

[University Network]

every pin/.style=fill=yellow!50!white,rectangle,rounded corners=3pt,font=,
small dot/.style=fill=black,circle,scale=0.3

grid style=dashed,
xlabel=Path ID,
ylabel=Shortest path length,
ytick distance=1,

legend pos=north east,
legend columns=2,
legend style=nodes=scale=1, transform shape,
yticklabel style=font=,
xticklabel style=font=,
yticklabels=0, 0, 1, 2, 3, 4, 5, 6, ., ., .,inf,
no marks,
table [col sep=comma,trim cells=true,x=ID,y=flat] graphs/pathlength3.csv;
table [col sep=comma,trim cells=true,x=ID,y=Seg] graphs/pathlength3.csv;

Flat, Seg

[Life-care Network]

every pin/.style=fill=yellow!50!white,rectangle,rounded corners=3pt,font=,
small dot/.style=fill=black,circle,scale=0.3

grid style=dashed,
xlabel=Path ID,
ylabel=Shortest path length,
ytick distance=1,

legend pos=north east,
legend style=nodes=scale=1, transform shape,
legend columns=2,
yticklabel style=font=,
xticklabel style=font=,
yticklabels=0, 0, 1, 2, 3, 4, 5, 6, ., ., .,inf,
no marks,
table [col sep=comma,trim cells=true,x=ID,y=flat] graphs/pathlength_rsl.csv;
table [col sep=comma,trim cells=true,x=ID,y=Seg] graphs/pathlength_rsl.csv;

Flat, Seg.

Connectivity graph shortest path length

[Mean S.P. Length]

legend pos=north east,
legend columns=2,
legend style=nodes=scale=0.5, transform shape,

ylabel=Mean S.P. Length,
yticklabel style=font=,
xticklabel style=font=,
ytick style=font=,
symbolic x coords=University, Lifecare,
nodes near coords,
nodes near coords align=vertical,
nodes near coords style=font=,
+ coordinates (University, 1) (Lifecare, 1);
+ coordinates (University, 2.15) (Lifecare, 2.17);

Flat, Seg.;

enlarge y limits=0.35,upper,
enlarge x limits=0.35,
legend pos=north east,
legend columns=2,
legend style=nodes=scale=0.5, transform shape,
ylabel=Average Out-Degree,
yticklabel style=font=,
xticklabel style=font=,
ytick style=font=,
symbolic x coords=University, Lifecare,
nodes near coords,
nodes near coords align=vertical,
nodes near coords style=font=,
+ coordinates (University, 1) (Lifecare, 1);
+ coordinates (University, 3) (Lifecare, 3);

Flat, Seg.;

[Transitive Closure Edges]

enlarge y limits=0.35,upper,
enlarge x limits=0.35,
legend pos=north east,
legend columns=2,
legend style=nodes=scale=0.5, transform shape,
ylabel=Edge Count,
yticklabel style=font=,
xticklabel style=font=,
ytick style=font=,
symbolic x coords=University, Lifecare,
nodes near coords,
nodes near coords align=vertical,
nodes near coords style=font=,
+ coordinates (University, 90000) (Lifecare, 56644);
+ coordinates (University, 84970) (Lifecare, 41179);

Flat, Seg.;

Reachability exposure analysis

The flat topology, by definition, allows all internal network traffic resulting in a complete connectivity graph. If any node is compromised the whole network is at risk as depicted by the linear out-degree distribution of Figure <ref>. In contrast, micro-segmentation significantly reduces the out-degree centrality by 95.5% and 94.7% for Enterprise A and Enterprise B, respectively as shown in Figure <ref>.

Despite the undeniable improvement of micro-segmentation on the overall network out-degree centrality, Figure <ref> exhibits unexpected behaviour of the values of the individual nodes. It can be noticed that some nodes have a high out-degree and can be a source of risk if compromised. After further analysis, they are found to belong to common management services (e.g. active directory, backup, ntp, dns, etc.) characterised by high connectivity.

The Closeness centrality distribution values presented in Figure  fall in the range of [0,1]. A value close to zero indicates that a given node is distant from other nodes in the network. It further signifies that numerous links need to be traversed to get to other nodes in the network. Figure <ref> displays the average closeness values of both enterprises before and after micro-segmentation. It can be remarked that the flat networks closeness values are equal to one. This can be attributed to the fact that all flat network nodes are exactly one hop away distant from each other. Therefore, after acquiring an illegitimate privilege, an attacker can access any other asset by traversing only one link. On the other hand, after micro-segmentation, the overall closeness is reduced by almost half for both enterprises. The high spikes characterising the individual nodes' closeness distribution of Figure <ref> belong to common management services.

[University Network]

every pin/.style=fill=yellow!50!white,rectangle,rounded corners=3pt,font=,
small dot/.style=fill=black,circle,scale=0.3

grid style=dashed,
xlabel=Node ID,

legend pos=north east,
legend columns=2,
legend style=nodes=scale=1, transform shape,
yticklabel style=font=,
xticklabel style=font=,
no marks,
table [col sep=comma,trim cells=true,x=ID,y=outDegflat] graphs/outDegrees.csv;
table [col sep=comma,trim cells=true,x=ID,y=outDegSeg] graphs/outDegrees.csv;

Flat , Seg.

[Life-care Network]

every pin/.style=fill=yellow!50!white,rectangle,rounded corners=3pt,font=,
small dot/.style=fill=black,circle,scale=0.3

grid style=dashed,
xlabel=Node ID,
ylabel=Out-degree ,

legend pos=north east,
legend columns=2,
legend style=nodes=scale=1, transform shape,
yticklabel style=font=,
xticklabel style=font=,
no marks,
table [col sep=comma,trim cells=true,x=ID,y=outDegflat] graphs/outDegrees_rsl.csv;
table [col sep=comma,trim cells=true,x=ID,y=outDegSeg] graphs/outDegrees_rsl.csv;

Flat, Seg.

Connectivity graph out-degree

[University Network]

every pin/.style=fill=yellow!50!white,rectangle,rounded corners=3pt,font=,
small dot/.style=fill=black,circle,scale=0.3

enlarge y limits=0.35,upper,
grid style=dashed,
xlabel=Connectivity graph nodes,
ylabel=Node closeness Centrality,

legend pos=north east,
legend columns=2,
legend style=nodes=scale=1, transform shape,
yticklabel style=font=,
xticklabel style=font=,
no marks,
table [col sep=comma,trim cells=true,x=ID,y=flat] graphs/closeness.csv;
table [col sep=comma,trim cells=true,x=ID,y=Seg] graphs/closeness.csv;

Flat , Seg.

[Life-care Network]

every pin/.style=fill=yellow!50!white,rectangle,rounded corners=3pt,font=,
small dot/.style=fill=black,circle,scale=0.3

enlarge y limits=0.35,upper,
grid style=dashed,
xlabel=Connectivity graph nodes,
ylabel=Node closeness Centrality,

legend pos=north east,
legend columns=2,
legend style=nodes=scale=1.0, transform shape,
yticklabel style=font=,
xticklabel style=font=,
no marks,
table [col sep=comma,trim cells=true,x=ID,y=flat] graphs/closeness_rsl.csv;
table [col sep=comma,trim cells=true,x=ID,y=Seg] graphs/closeness_rsl.csv;

Flat, Seg.

Connectivity graph closeness centrality

[Average Out-Degree]

enlarge y limits=0.36,upper,
enlarge x limits=0.35,

legend pos=north east,
legend columns=2,
legend style=nodes=scale=0.5, transform shape,
yticklabel style=font=,
xticklabel style=font=,
ytick style=font=,
symbolic x coords=University, Lifecare,
nodes near coords,
nodes near coords align=vertical,
nodes near coords style=font=,
+ coordinates (University, 299) (Lifecare, 237);
+ coordinates (University, 13) (Lifecare, 12);

Flat, Seg.;

[Average Closeness]

enlarge y limits=0.36,upper,
enlarge x limits=0.35,
legend pos=north east,
legend columns=2,
legend style=nodes=scale=0.5, transform shape,
ylabel=Average closeness,
yticklabel style=font=,
xticklabel style=font=,
ytick style=font=,
symbolic x coords=University, Lifecare,
nodes near coords,
nodes near coords align=vertical,
nodes near coords style=font=,
+ coordinates (University, 1) (Lifecare, 1);
+ coordinates (University, 0.45) (Lifecare, 0.4);

Flat, Seg.;

Centrality exposure analysis

[Path Length]

bar width=3 pt,
enlarge y limits=0.38,upper,
enlarge x limits=0.15,
yticklabel style=font=,
xticklabel style=font=,
ytick style=font=,
xlabel=Paths Count,
ylabel=Paths Length,

xtick distance=2,
nodes near coords,
nodes near coords align=horizontal,
nodes near coords style=font=,rotate=90, anchor=west,
legend pos=north west,
legend columns=2,
legend style=nodes=scale=0.5, transform shape
+ coordinates (2, 359) (4, 5461) (6, 52760) (8, 359281) (10, 1027326) (12, 188253);
+ coordinates (2, 265) (4, 1462) (6, 1538) (8, 190) (10, 0) (12, 0);

Flat, Seg.;

every pin/.style=fill=yellow!50!white,rectangle,rounded corners=3pt,font=,
small dot/.style=fill=black,circle,scale=0.3

enlarge y limits=0.35,upper,
grid style=dashed,
xlabel=Node ID,
ylabel=Node closeness,

legend pos=north east,
legend columns=2,
legend style=nodes=scale=1, transform shape,
yticklabel style=font=,
xticklabel style=font=,
no marks,
table [col sep=comma,trim cells=true,x=ID,y=flat] graphs/betweeness.csv;
table [col sep=comma,trim cells=true,x=ID,y=Seg] graphs/betweeness.csv;

Flat , Seg.

Attack graph distributions

§.§ Network Robustness Analysis

Path-based: Reducing the number of attack paths is a direct indicator of improving the network robustness manifesting the ability of networks to resist failures or attacks. In fact, assessing the NSP metric representing the count of shortest attack paths, before and after micro-segmenting the network of Enterprise A, reveals the efficacy of micro-segmentation to significantly reduce the total number of attack paths by 99%.

We proceed by investigating the distribution of attack paths lengths of Figure <ref>. While the large number of paths with lengths greater than eight in the flat network might give the impression that the flat network is more resilient to attacks as it requires more steps to be performed by the attacker, the total number of attack paths clears the doubt. Unlike the segmented topology, the unrestricted nature of the flat network provides a multitude of direct and indirect possibilities of attacking the network.

The MSPL metric output, representing the weakest link of the network, is found to be the same for both the flat and segmented topology. However, the count of paths that equals the minimum indicating the probability that an attacker exploits the network weakest link is reduced by 26% after deploying micro-segmentation.

Non-path-based: Network misconfigurations raise the probability of success in exploiting the assets' vulnerabilities hence increasing the impact of the latter. For example, an error in the access control list configuration makes it possible for a user to save a file to the file server which increases the probability of an attacker exploiting a vulnerability in the file server. While micro-segmentation is unable to reduce the network vulnerabilities, we claim that the change in the system security configuration influence the likelihood of exploiting the vulnerabilities. We proceed by analysing the count of misconfigurations (CMC) metric. Although the number of network vulnerabilities has not changed as demonstrated by the Nessus vulnerabilities scan, we notice that the number of micro-segmented network generated attack graph root nodes (representing misconfigurations/vulnerabilities) is reduced by 65%. Accordingly, we demonstrate that micro-segmentation significantly reduces the attacker accessibility to system vulnerabilities.

Network robustness analysis

Metric     Flat     Segmented     Reduction

Mis-configurations count     635      221     65.2%

Shortest paths count     1633440      3455     99.7%

Average shortest path length     5      10     -

Min shortest path length     2      2     0%

Min shortest path count     359      265     26.2%

Average out-degree     28      2     92.9%

Maximum out-degree     35      11     68.6%

Average betweenness     0.04      0.0005     98.8%

The AOD and MOD metrics results, indicating the typical and worst-case number of attacks succeeding a compromised network privilege, reveal the significant impact of micro-segmentation on improving the network ability to resist intelligent and goal-oriented attackers. By applying Zero-Trust security controls around the individual workloads, it allows organizations to isolate the different micro-segments limiting the access of the compromised asset to other network assets. Therefore, it restricts the attacker's lateral movement and exploration, reducing the average possibly generated attacks after a network breach by 93% and the maximum number of possibly conducted attacks by 69% as indicated by Table <ref>.

Finally, we analyse the betweenness centrality distribution of the network attack graphs before and after micro-segmentation. Compromised privilege assets with high betweenness centrality have a significant influence on the network robustness by virtue of their control over the paths leading to other privilege nodes, increasing the attacker ability to extend their attained privileges. In fact, micro-segmentation, not only reduced the average betweenness by more than 98%, it further changed the network topology resulting in a more linear distribution of the betweenness metric. Hence, unlike the jigsaw distribution provided by the flat topology which is characterised by multiple peaks, it evenly distributed the reduced impact of compromising any asset on the network robustness as demonstrated by Figure <ref> of the appendix.

Common Vulnerability Scoring System (CVSS): Next, we analyse the quantitative security of a networked system through the cumulative probability that a network asset is compromised by an attacker. As previously discussed, the probability that an attacker succeeds in obtaining an illegitimate privilege is a function of the severity of a system vulnerability and the accessibility of the vulnerability to the attacker.
While the first factor remains intact, after micro-segmentation the second factor is significantly altered as a result of modifying the network topology and limiting the accessibility to the network assets.

We proceed by calculating the cumulative risk values of the network privilege nodes before and after micro-segmentation following the model in <cit.>. The distribution of the values reveals an average improvement of 20% after micro-segmentation deployment. While this value represents a significant improvement of the overall enterprise network security risk, it is remarkably lower than the calculated improvements achieved by assessing the network exposure and robustness. This can be attributed to the fact that a major parameter contributing to the risk calculated values, namely the vulnerabilities severity, identified by the Common Vulnerability Scoring System <cit.>, remains unchanged.

To further analyse the latter finding, let us consider the attack graph privilege node execCode(V, User). It implies that the attacker has gained user privilege to execute code on the victim host V. The cumulative risk value of acquiring this privilege in the flat network is found to be 0.8 while in the segmented network it is reduced to 0.64. Further analysis of the attack graphs confirms our interpretation of the aggregated risk values. While both attack graphs have the same vulnerabilities on host V (four), the flat network has 38 misconfiguration nodes while the segmented network comprises only three misconfiguration nodes involving V. Table <ref> of the appendix presents the attack graph privilege and configuration nodes involving V.

§ CONCLUSION

Micro-segmentation is proved to be an effective technique for shrinking enterprise networks attack surface in general. Despite the fact, the impact assessment of micro-segmentation is almost absent in the literature. In this paper, we propose a suite of metrics to analyse the impact of micro-segmentation on improving network security. We rely on graph feature analysis to study the network exposure and robustness to attacks. Hence, the presented work is the first to formulate subjective metrics for quantifying the effectiveness of micro-segmentation and relying on real enterprise network data to perform an empirical analysis of the developed suite of metrics.

The analysis of the formulated metrics before and after the deployment of micro-segmentation proves that the latter is one of the most effective strategies to protect against cyber threats. Comparing and assessing the exposure and robustness metrics, highlighting possible threats to the enterprise network, reveals an improvement in the range of 60% – 90%.

Attack-graph nodes involving host “V"

Flat network attack-graph nodes     Micro-segmented network attack-graph nodes

Privilege     execCode(V,user) 0.8      execCode(V,user) 0.64

vulExists(V, CVE-2014-3802, debug interface_access software development kit, remote-Exploit, privEscalation),
vulExists(V, CVE-2017-5715, cortex-a, localExploit, privEscalation), vulExists(V, CVE-2017-5753, cortex-a, localExploit, privEscalation), vulExists(V, CVE-2017-5754, cortex-a, localExploit, privEscalation)

vulExists(V,CVE-2014-3802, debug interface_access software development kit, remote-Exploit, privEscalation),
vulExists(V, CVE-2017-5715, cortex-a, localExploit, privEscalation), vulExists(V, CVE-2017-5753, cortex-a, localExploit, privEscalation), vulExists(V, CVE-2017-5754, cortex-a, localExploit, privEscalation)

hasAccount(V victim,  V, user),
networkServiceInfo(V, debug interface access software development kit, Windows, 2, user),
hacl(internet, V, Windows, 2), hacl(V, AL, Windows Microsoft Bulletins, 2),
hacl(V, AG, Windows Microsoft Bulletins, 2),
hacl(V, AU, Windows Microsoft Bulletins, 2),
hacl(V, AU, Windows, 2),
hacl(V, BA, Windows Microsoft Bulletins, 2),
hacl(V, AO, Windows, 2),
hacl(V, HO, Windows Microsoft Bulletins, 2),
hacl(V, KI, Windows Microsoft Bulletins, 2),
hacl(V, KI, Windows, 2),
hacl(V, MA, Windows Microsoft Bulletins, 2),
hacl(vancouver, mimttul, Windows Microsoft Bulletins, 2),
hacl(V, MI, Windows, 2),
hacl(V, NA, Windows, 2),
hacl(V, NE, Misc., 3),
hacl(V, NE, Windows, 2),
hacl(V, OU, Windows, 2),
hacl(V, OV, Windows Microsoft Bulletins, 2),
hacl(V, PA, Databases, 3),
hacl(V, PA, Windows Microsoft Bulletins, 2),
hacl(V, TE, Windows Microsoft Bulletins, 2),
hacl(V,  V, Windows, 2),
hacl(V, WI, Windows Microsoft Bulletins, 2),
hacl(V, WI, Windows Microsoft Bulletins, 3),
hacl(TE,  V, Windows, 2),
hacl(OV,  V, Windows, 2),
hacl(NA,  V, Windows, 2),
hacl(MI,  V, Windows, 2),
hacl(MA,  V, Windows, 2),
hacl(KI,  V, Windows, 2),
hacl(HO,  V, Windows, 2),
hacl(CO,  V, Windows, 2),
hacl(BA,  V, Windows, 2),
hacl(AU,  V, Windows, 2),
hacl(AG,  V, Windows, 2),
hacl(AL,  V, Windows, 2),
hacl(WI,  V, Windows, 2),

hasAccount(V victim,  V, user), networkServiceInfo(V, debug interface access software development kit, Windows, 2, user), hacl(internet, V, Windows, 2)

Table <ref> presents the attack graph privilege and configuration nodes involving V. As shown in the table, the cumulative risk value of acquiring this privilege in the flat network is 0.8 while in the segmented network it is reduced to 0.64. Further analysis of the attack graphs confirms our interpretation of the aggregated risk values.


# On the topology and geometry of certain $13$-manifolds

Wen Shen  Department of Mathematics, Capital Normal University, Beijing,
P.R.China<EMAIL_ADDRESS>
###### Abstract.

This paper gives the classifications of certain manifolds $\mathcal{M}$ of
dimension $13$ up to diffeomorphism, homeomorphism, and homotopy equivalence,
whose cohomology rings are isomorphic to $H^{\ast}(\mathrm{CP}^{3}\times
S^{7};\mathbb{Z})$. Moreover, we prove that either $\mathcal{M}$ or
$\mathcal{M}\\#\Sigma^{13}$ admits a metric of non-negative sectional
curvature where $\Sigma^{13}$ is a certain exotic sphere of dimension 13.

###### 2020 Mathematics Subject Classification:

Primary 57R19, 57R50, 53C20

##  1\. Introduction

Classification of the manifolds with a given cohomology ring (up to
diffeomorphism, homeomorphism, or homotopy) is one of the central problems in
geometric topology. The Poincar$\acute{e}$ theorem is a special case. For a
more complicated cohomology ring, there also exist many investigations. In the
general case, Wall [26, 28] studied $(s-1)$-connected $2s$-manifolds and
$(s-1)$-connected $(2s+1)$-manifolds. For concrete cases with specified
dimensions, we also list some results. Barden [3] classified simply connected
5-manifolds, and Kreck and Su [19] classified certain nonsimply connected
5-manifolds. Wall [27], Jupp [12] classified simply connected 6-manifolds. For
the dimension $7$, Kreck and Stolz [17, 18] gave a classification for the
$7$-manifolds modeled on Aloff-Wallach spaces [2]. Subsequently, a homotopy
classification of Aloff-Wallach spaces was given by Kruggel [20]. Besides,
there are other classifications for the $7$-manifolds with certain cohomology
rings, such as [6] [16]. More recently, Fang and Shen [7] considered the
$13$-manifolds, named Bazaikin spaces [4].

In this paper, we consider manifolds that look like $\mathrm{CP}^{3}\times
S^{7}$. More precisely, the manifold, denoted by $\mathcal{M}$, is a
1-connected closed smooth manifold with the same cohomology ring as
$\mathrm{CP}^{3}\times S^{7}$, where $\mathrm{CP}^{3}$ is the complex
projective space. Many examples of these $13$-manifolds arise from the
following construction [30]: From an $S^{1}$ action on $S^{7}\times S^{7}$
given by $\theta\circ(x,y)=(e^{il\theta}x,e^{-ik\theta}y),$ $(k,l)=1$, we get
the $S^{1}$-bundle $S^{1}\to S^{7}\times S^{7}{\to}\mathcal{M}$. In addition,
Kerin [13] gave an example with almost positive curvature, which is an
$S^{7}$-bundle over $\mathrm{CP}^{3}$.

Then, we make some conventions. Throughout the rest of the paper, let
$H^{i}(-)$ (or $H_{i}(-)$) denote the integral cohomology (or homology) group
$H^{i}(-;\mathbb{Z})$ (or $H_{i}(-;\mathbb{Z})$) unless other statements are
given. We always choose the cup product $x^{2}$ as the generator of
$H^{4}(\mathcal{M})$, where $x$ is a generator of $H^{2}(\mathcal{M})$.

######  Definition 1.1.

Let $x:\mathcal{M}\to\mathrm{CP}^{\infty}$ denote the generator $x$ of
$H^{2}(\mathcal{M})$. We call that $\mathcal{M}$ admits a restriction lift if
there exists a lift $f:\mathcal{M}\to\mathrm{CP}^{4}$ such that the following
diagram is homotopy commutative

$\textstyle{\mathrm{CP}^{4}\ignorespaces\ignorespaces\ignorespaces\ignorespaces}$$\textstyle{\mathcal{M}\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces}$$\scriptstyle{x}$$\scriptstyle{f}$$\textstyle{\mathrm{CP}^{\infty}}$

Now, we are ready to present the main theorems of this paper.

######  Theorem 1.2.

Assume that $\mathcal{M}$, $\mathcal{M}^{\prime}$ are nonspin and admit
restriction lifts. Then

$\mathcal{M}$ is diffeomorphic to $\mathcal{M}^{\prime}\\#\Sigma^{13}$ if and
only if $p_{1}(\mathcal{M})=p_{1}(\mathcal{M}^{\prime})$. If
$p_{1}(\mathcal{M})=p_{1}(\mathcal{M}^{\prime})\neq 0\mod 3$, $\mathcal{M}$ is
diffeomorphic to $\mathcal{M}^{\prime}$.

$\mathcal{M}$ is homeomorphic to $\mathcal{M}^{\prime}$ if and only if
$p_{1}(\mathcal{M})=p_{1}(\mathcal{M}^{\prime})$.

$\mathcal{M}$ is homotopy equivalent to $\mathcal{M}^{\prime}$ if and only if
$p_{1}(\mathcal{M})=p_{1}(\mathcal{M}^{\prime})\mod 24$.

Applying the 1) and 2) of Theorem 1.2, we have

######  Corollary 1.3.

If $\mathcal{M}$ is nonspin and admits a restriction lift, then the underlying
topological manifold of $\mathcal{M}$ is the total space of a topological
$S^{7}$-bundle over $\mathrm{CP}^{3}$; if $\mathcal{M}$ additionally satisfies
$p_{1}(\mathcal{M})\neq 0\mod 3$, then it is the total space of a
$S^{7}$-bundle over $\mathrm{CP}^{3}$.

On the one hand, many geometers use curvatures to detect the topology of
manifolds. On the other hand, one of the most interesting problems in
Riemannian geometry is whether a smooth manifold admits a metric of non-
negative sectional curvature or positive sectional curvature. Here, we use the
topology of manifolds to investigate the metrics. From Theorem 1.2, Corollary
1.3 and Lemma 7.1, we have

######  Theorem 1.4.

Let $\mathcal{M}$ be nonspin and admit a restriction lift. If
$p_{1}(\mathcal{M})\neq 0\mod 3$, $\mathcal{M}$ admits a metric of non-
negative sectional curvature; otherwise, $\mathcal{M}\\#\Sigma^{13}$ admits a
metric of non-negative sectional curvature for some homotopy sphere
$\Sigma^{13}$.

For the general spin case, the same theorem as Theorem 1.2 is unclear.
However, for some special spin manifolds, we have

######  Theorem 1.5.

For any homotopy $7$-spheres $\Sigma^{7}$ and $\Sigma^{\prime 7}$,
$\mathrm{CP}^{3}\times\Sigma^{7}$ is diffeomorpic to
$\mathrm{CP}^{3}\times\Sigma^{\prime 7}$.

Obviously,
$\mathrm{CP}^{3}\times\Sigma^{7}\stackrel{{\scriptstyle\mathrm{diff}}}{{\cong}}\mathrm{CP}^{3}\times
S^{7}$. Thus we have

######  Corollary 1.6.

For any homotopy sphere $\Sigma^{7}$, $\mathrm{CP}^{3}\times\Sigma^{7}$ admits
a metric of non-negative sectional curvature.

We mainly use the surgery theory [15] to prove the classification theorems,
i.e. Theorem 1.2 and 1.5. In Section 2, we establish a suitable bordism theory
for the considered spaces in the smooth category. In Section 3, we consider
the surgery obstruction. Then, we compute a certain bordism group in Section
4. To classify the considered manifolds up to homotopy equivalence, we give a
model in Section 5. Finally, the proofs of the classification theorems are
presented in Section 6. At last, we discuss the metrics of the sphere bundles
of some $8$-dimensional vector bundles in Section 7.

##  2\. The normal $5$-smoothing

Let $\pi:{B}\to\mathrm{BO}$ be a fibration over the classifying space
$\mathrm{BO}$. As described in [15], given a smooth manifold $M$ with the
Gauss map $\mathscr{N}_{M}:M\to\mathrm{BO}$, a normal ${B}$-structure of $M$
is a lift $\bar{\mathscr{N}}_{M}:M\to{B}$ of ${\mathscr{N}}_{M}$. Moreover,
$\bar{\mathscr{N}}_{M}$ is called a normal $\ell$-smoothing when it is a
$(\ell+1)$ homotopy equivalence.

Let $\mathcal{M}$ admit a restriction lift $f:\mathcal{M}\to\mathrm{CP}^{4}$.
Denote the first Pontryagin class of $\mathcal{M}$ by
$p_{1}(\mathcal{M})=sx^{2}$ $s\in\mathbb{Z}$, the second Stiefel-Whitney class
by $w_{2}(\mathcal{M})=sx\mod{2}$. Let $\mathcal{H}$ denote the Hopf bundle
over $\mathrm{CP}^{4}$. If $s\geq 0$, let $\xi$ be the complementary bundle of
the Whitney sum $s\mathcal{H}$; if $s<0$, let $\xi$ be the Whitney sum
$-s\mathcal{H}$. Formally $\xi=-s\mathcal{H}$. Note that the Chern classes

$c_{1}(\xi)=-sx\quad c_{2}(\xi)=\frac{s(s+1)}{2}x^{2},$

the first Pontryagin class $p_{1}(\xi)=-sx^{2}$. Let
$\mathscr{N}_{\mathcal{M}}$ denote both the Gauss map
$\mathcal{M}\to\mathrm{BO}$ and the stable normal bundle of $\mathcal{M}$.
Obviously the difference bundle $\mathscr{N}_{\mathcal{M}}-f^{\ast}\xi$ has a
$\mathrm{BO}\langle 8\rangle$-structure. Considering the classifying map

$\pi:{B}=\mathrm{BO}\langle 8\rangle\times\mathrm{CP}^{4}\to\mathrm{BO}$

of the bundle $\gamma_{8}\times\xi$ where $\gamma_{8}$ is the universal bundle
over $\mathrm{BO}\langle 8\rangle$, we claim that $\mathcal{M}$ has a normal
${B}$-structure, i.e., the Gauss map $\mathscr{N}_{\mathcal{M}}$ lifts to
$\bar{\mathscr{N}_{\mathcal{M}}}:\mathcal{M}\to{B}$ which is furthermore a
$7$-equivalence.

All $n$-dimensional manifolds with the normal ${B}$-structure form a bordism
group $\Omega_{n}^{\mathrm{O}\langle 8\rangle}(\xi)$ which is isomorphic to
the homotopy group $\pi_{n}(\mathrm{M{B}})$ by the Pontryagin-Thom
isomorphism. Here, $\mathrm{M{B}}=\mathrm{MO}\langle
8\rangle\wedge\mathrm{M}\xi$; $\mathrm{M}\xi$ and $\mathrm{MO}\langle
8\rangle$ are the Thom spectra of the bundles $\xi$ and $\gamma_{8}$.

##  3\. Surgery obstruction

Assume that the $W^{14}$ has the ${B}=\mathrm{BO}\langle
8\rangle\times\mathrm{CP}^{4}$-structure with the boundary
$\mathcal{M}\sqcup-\mathcal{M}^{\prime}$ which is the disjoint union. From
surgery theory [29], we can take appropriate $W$ such that $\phi:W\to B$ is a
$7$-equivalence, and the embedding $i:\mathcal{M}\to W$ induces the
isomorphisms $H_{n}(\mathcal{M})\cong H_{n}(W)$ for $0\leq n\leq 6$. From the
long exact sequences for the pair $(W,\mathcal{M})$ and the triple
$(W,\partial W,\mathcal{M}),$ we have that $H_{7}(W)\cong
H_{7}(W,\mathcal{M})\oplus\mathbb{Z}$ is torsion free.

Considering the surgery obstruction for replacing $W$ with an h-cobordism, we
first transform the elements in $H_{7}(W,\mathcal{M})$ into the kernel of the
homomorphism $\phi_{\ast}:\pi_{7}(W)\to\pi_{7}(B)$.

$\textstyle{\pi_{8}(B)=\mathbb{Z}\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces}$$\textstyle{\pi_{8}(B,W)\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces}$$\scriptstyle{\cong}$$\textstyle{\pi_{7}(W)\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces}$$\scriptstyle{\phi_{\ast}}$$\scriptstyle{h_{\ast}}$$\textstyle{\pi_{7}(B)=0\ignorespaces\ignorespaces\ignorespaces\ignorespaces}$$\textstyle{H_{8}(W)=0\ignorespaces\ignorespaces\ignorespaces\ignorespaces}$$\textstyle{H_{8}(B)=\mathbb{Z}^{2}\ignorespaces\ignorespaces\ignorespaces\ignorespaces}$$\textstyle{H_{8}(B,W)\ignorespaces\ignorespaces\ignorespaces\ignorespaces}$$\textstyle{H_{7}(W)\ignorespaces\ignorespaces\ignorespaces\ignorespaces}$$\textstyle{H_{7}(B)=0}$

By chasing the above commutative diagram, we have

######  Lemma 3.1.

$ker\phi_{\ast}=\pi_{7}(W)\cong H_{7}(W)\oplus\mathbb{Z}\cong
H_{7}(W,\mathcal{M})\oplus\mathbb{Z}^{2}.$

By smooth embedding theorem [22], every element $u\in H_{7}(W,\mathcal{M})$
can be represented by the embedding $S^{7}\to W$. From [14], any
$7$-dimensional vector bundle over $S^{7}$ is trivial. Hence, the normal
bundle of this embedding is trivial. Thus, $u$ can be represented by the
embedding $\bar{u}:S^{7}\times D^{7}\to W$. Let $F$ be the homotopy fiber of
$\pi:B\to\mathrm{BO}$. Due to $\pi_{7}(F)=0$, the embedding $\bar{u}$ is a
compatible embedding. So, we can replace the $W$ with an $h$-cobordism.

######  Lemma 3.2.

If $\mathcal{M}$ is $B-$coborant to $\mathcal{M}^{\prime}$, then there is a
smooth $h$-cobordism $(W,\mathcal{M},\mathcal{M}^{\prime}).$

##  4\. The computations of certain bordism groups

Recall that $\Omega_{\ast}^{\mathrm{O}\langle
8\rangle}(\xi)\cong\pi_{\ast}(\mathrm{M{B}})$ where
$\mathrm{M{B}}=\mathrm{MO}\langle 8\rangle\wedge\mathrm{M}\xi$,
$\mathrm{M}\xi$ and $\mathrm{MO}\langle 8\rangle$ are the Thom spectra of the
bundles $\xi$ and $\gamma_{8}$.

There is an Atiyah-Hirzebruch spectral sequence (AHSS) for
$\pi_{\ast}(\mathrm{MB})$

$E_{2}^{p,q}\cong H_{p}(\mathrm{M}\xi;\pi_{q}(\mathrm{MO}\langle
8\rangle))\Longrightarrow\mathrm{MO}\langle
8\rangle_{\ast}(\mathrm{M}\xi)\cong\pi_{\ast}(\mathrm{MO}\langle
8\rangle\wedge\mathrm{M}\xi).$

Recall the $E_{2}$-terms of the Adams spectral sequence (ASS) for
$\mathrm{MO}\langle 8\rangle$ as in Fig.1. In dimension $i\leq 14$ [8, 11],
$\pi_{i}(\mathrm{MO}\langle 8\rangle)$ is as follows.

$i$ | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9
---|---|---|---|---|---|---|---|---|---|---
$\pi_{i}(\mathrm{MO}\langle 8\rangle)$ | $\mathbb{Z}$ | $\mathbb{Z}_{2}$ | $\mathbb{Z}_{2}$ | $\mathbb{Z}_{24}$ | 0 | 0 | $\mathbb{Z}_{2}$ | 0 | $\mathbb{Z}\oplus\mathbb{Z}_{2}$ | $\mathbb{Z}_{2}\oplus\mathbb{Z}_{2}$

$i$ | 10 | 11 | 12 | 13 | 14
---|---|---|---|---|---
$\pi_{i}(\mathrm{MO}\langle 8\rangle)$ | $\mathbb{Z}_{6}$ | 0 | $\mathbb{Z}$ | $\mathbb{Z}_{3}$ | $\mathbb{Z}_{2}$

$0$$s$$t-s$123456789101112131415161712345678$h_{0}$$h^{2}_{0}$$h_{1}$$h^{2}_{1}$${h^{3}_{1}=h^{2}_{0}h_{2}}$${h_{2}}$${h^{2}_{2}}$${c_{0}}$${\omega}$${h_{1}^{3}\omega=h^{2}_{0}h_{2}\omega}$${h_{2}\omega}$${h^{2}_{2}\omega=h^{2}_{0}d_{0}}$${\tau}$${d_{0}}$${h^{2}_{0}\kappa=h_{1}d_{0}}$${\kappa}$
Fig 1.  $\mathrm{Ext}^{s,t}_{\mathscr{A}_{2}}(\mathbb{Z}_{2},\mathbb{Z}_{2})$

In the AHSS for $\Omega_{13}^{\mathrm{O}\langle 8\rangle}(\xi)$, all
nontrivial $E_{2}$-terms are $E_{2}^{0,13}=\mathbb{Z}_{3}$ and
$E_{2}^{4,9}=\mathbb{Z}_{2}^{2}$. Let $G=E_{\infty}^{4,9}$. Obviously the
$2$-primary part ${{}_{2}\pi}_{13}(\mathrm{MB})$ is isomorphic to
$G=\mathbb{Z}_{2}^{n}$ where $n=0,1$ or $2$. Next, we will observe the $G$ in
the ASS

$E_{2}^{s,t}(\mathrm{ASS})=Ext_{\mathscr{A}}^{s,t}(H^{\ast}(\mathrm{MB};\mathbb{Z}_{2}),\mathbb{Z}_{2})\Longrightarrow{{}_{2}\pi}_{t-s}(\mathrm{MB})$
$Ext^{s,t}=Ext_{\mathscr{A}}^{s,t}(H^{\ast}(\mathrm{MB};\mathbb{Z}_{2}),\mathbb{Z}_{2})\cong
Ext_{\mathscr{A}_{2}}^{s,t}(H^{\ast}(\mathrm{M}\xi;\mathbb{Z}_{2}),\mathbb{Z}_{2})$

where $H^{\ast}(\mathrm{M}\xi;\mathbb{Z}_{2})\cong
H^{\ast}(\mathrm{CP}^{4};\mathbb{Z}_{2})\cup U$ as $\mathbb{Z}_{2}$-vector
space, $U$ is the stable Thom class of the bundle $\xi$. In particular, for
any $a\in H^{\ast}(\mathrm{CP}^{4};\mathbb{Z}_{2})$

$\mathrm{Sq}^{n}(aU)=\Sigma_{i=0}^{n}\mathrm{Sq}^{i}a\cup\mathrm{Sq}^{n-i}U$
$\mathrm{Sq}^{i}U=w_{i}(\xi)U$

where $w_{i}(\xi)$ is the $i$th Stiefel-Whitney of bundle $\xi$.

$0$$s$$t-s$12345678$12$$13$$14$${\tau U}$${\omega x^{2}U}$${h^{4}_{0}\omega
x^{2}U}$${c_{0}x^{2}U}$${h_{1}c_{0}x^{2}U}$${h_{1}\omega x^{2}U}$${h_{2}\omega
xU}$${h_{0}h_{2}\omega xU}$${h^{2}_{0}h_{2}\omega xU}$${\tau
xU}$${h_{0}^{5}\tau xU}$ Fig 2. Partial $E_{1}$-terms of
${Ext}^{s,t}_{\mathscr{A}_{2}}(H^{\ast}(\mathrm{M}\xi;\mathbb{Z}_{2}),\mathbb{Z}_{2})$

By the Algebraic Atiyah-Hirzebruch spectral sequence (AAHSS) ( also see [7])

$E_{1}^{s,m,n}={Ext}_{\mathscr{A}_{2}}^{s,s+m}(\mathbb{Z}_{2},\mathbb{Z}_{2})\otimes
H^{n}(\mathrm{M}\xi;\mathbb{Z}_{2})\Longrightarrow Ext^{s,s+m+n}$

we get quickly the results shown in Fig.2 and the following proposition

######  Proposition 4.1.

More details for the elements of Fig.2 are

  * •

Case 1: $w_{2}(\xi)=w_{4}(\xi)=0$. Only $h_{1}c_{0}x^{2}U,h_{0}^{s}h_{2}\omega
xU$ $(s=0,1)$ survive to $E_{\infty}^{\ast,13-n,n}$.

  * •

Case 2: $w_{2}(\xi)\neq 0$, $w_{4}(\xi)=0$. Only $h_{1}c_{0}x^{2}U$ and
$h_{1}\omega x^{2}U$ do not survive to $E_{\infty}^{\ast,13-n,n}$.

  * •

Case 3: $w_{2}(\xi)=0$, $w_{4}(\xi)\neq 0$. Only $h_{1}c_{0}x^{2}U$ survive to
$E_{\infty}^{\ast,13-n,n}$.

  * •

Case 4: $w_{2}(\xi)\neq 0$, $w_{4}(\xi)\neq 0$. Only $h_{1}c_{0}x^{2}U$ and
$h_{1}\omega x^{2}U$ do not survive to $E_{\infty}^{\ast,13-n,n}$.

For all cases, $\tau xU\in E_{\infty}^{\ast,14-n,n}$ in the AAHSS.

###### Proof.

Let $d_{r}$ be the differential of the AAHSS

$d_{r}:E_{r}^{s,m,n}\to E_{r}^{s+1,m+r-1,n-r}$

All $E_{1}^{s,m,n}$-terms are shown in Fig.2 for $n+m=12,13$.

Case 1: By $\mathrm{Sq}^{2}(xU)=x^{2}U$, we have $d_{2}(h_{1}^{s}\omega
x^{2}U)=h_{1}^{s+1}\omega xU$ for $s=0,1$. Since $h_{0}^{2}h_{2}\omega
xU=h_{1}^{3}\omega xU$, $d_{2}(h_{1}^{2}\omega x^{2}U)=h_{1}^{3}\omega xU$. By
the degrees of differentials $d_{r}$, we have
$E_{\infty}^{\ast,13-n,n}=E_{3}^{\ast,13-n,n}$.

Case 2: By $\mathrm{Sq}^{2}(x^{2}U)=x^{3}U$, we have
$d_{2}(c_{0}x^{3}U)=h_{1}c_{0}x^{2}U$ and $d_{2}(\omega x^{3}U)=h_{1}\omega
x^{2}U$.

Similarly, Cases 3 and 4 follows from the $\mathrm{Sq}^{2}$, $\mathrm{Sq}^{4}$
actions. By the degrees of differentials $d_{r}$, $h_{0}^{s}\tau xU\in
E_{\infty}^{3+s,14-n,n}$. ∎

The Fig.2 and Proposition 4.1 show
${Ext}^{s,13+s}_{\mathscr{A}_{2}}(H^{\ast}(\mathrm{M}\xi;\mathbb{Z}_{2}),\mathbb{Z}_{2})$
and
${Ext}^{s,12+s}_{\mathscr{A}_{2}}(H^{\ast}(\mathrm{M}\xi;\mathbb{Z}_{2}),\mathbb{Z}_{2})$
for $s\geq 0$ completely. Some nontrivial Adams differentials are given in the
following lemma.

######  Lemma 4.2.

For cases $1,2,4$, $d_{2}(\tau xU)=h_{2}\omega xU$ in the $\mathrm{ASS}$.

###### Proof.

Let $\xi|2$ be the restriction bundle over $\mathrm{CP}^{1}$ of $\xi$,
$\mathrm{M}\xi|_{2}$ be its Thom spectrum. On the one hand, by the AHSS

$E_{2}^{p,q}(|_{2})=H_{p}(\mathrm{M}\xi|_{2};\pi_{q}(\mathrm{MO}\langle
8\rangle))\Longrightarrow\pi_{p+q}(\mathrm{MO}\langle
8\rangle\wedge\mathrm{M}\xi|_{2})$

we have ${}_{2}\pi_{13}(\mathrm{MO}\langle
8\rangle\wedge\mathrm{M}\xi|_{2})=0.$ On the other hand, for all cases as
described in Proposition 4.1,
${Ext}^{5+s,18+s}_{\mathscr{A}_{2}}(H^{\ast}(\mathrm{M}\xi|_{2};\mathbb{Z}_{2}),\mathbb{Z}_{2})$
is generated by $h_{0}^{s}h_{2}\omega xU$ ($s\geq 0$);
${Ext}^{3,17}_{\mathscr{A}_{2}}(H^{\ast}(\mathrm{M}\xi|_{2};\mathbb{Z}_{2}),\mathbb{Z}_{2})$
is generated by $\tau xU$, and
${Ext}^{s,14+s}_{\mathscr{A}_{2}}(H^{\ast}(\mathrm{M}\xi|_{2};\mathbb{Z}_{2}),\mathbb{Z}_{2})=0$
($0\leq s\leq 2$). Thus $d_{2}(\tau xU)=h_{2}\omega xU$ in the $\mathrm{ASS}$
for the spectrum $\mathrm{MO}\langle 8\rangle\wedge\mathrm{M}\xi|_{2}$. By the
naturality and Proposition 4.1, the desired result follows. ∎

Summarizing Fig.2, Proposition 4.1, and Lemma 4.2, we have

######  Lemma 4.3.

For cases $1,3$, ${{}_{2}\pi}_{13}(\mathrm{MB})=\mathbb{Z}_{2}\langle
h_{1}c_{0}x^{2}U\rangle.$

For cases $2,4$, ${{}_{2}\pi}_{13}(\mathrm{MB})=0$.

Finally, we consider the $3$-primary part ${{}_{3}\pi}_{13}(\mathrm{MB})$.

######  Lemma 4.4.

(1) ${{}_{3}\pi}_{13}(\mathrm{MB})\cong\mathbb{Z}_{3}$ or $0$.

(2) A nontrivial element with order $3$ in $\Omega_{13}^{\mathrm{O}\langle
8\rangle}(\xi)$ is represented by an exotic sphere $\Sigma^{13}$.

###### Proof.

By the AHSS, it is easy to get (1). Let $\iota:S^{0}\to\mathrm{M}\xi$ be the
unit. Then, we have the morphism of the spectral sequences

$\textstyle{\bar{E}_{2}^{p,q}=H_{p}(S^{0};\pi_{q}(\mathrm{MO}\langle
8\rangle))\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces}$$\textstyle{\pi_{p+q}(\mathrm{MO}\langle
8\rangle)\ignorespaces\ignorespaces\ignorespaces\ignorespaces}$$\scriptstyle{\iota_{\ast}}$$\textstyle{{E}_{2}^{p,q}=H_{p}(\mathrm{M}\xi;\pi_{q}(\mathrm{MO}\langle
8\rangle))\ignorespaces\ignorespaces\ignorespaces\ignorespaces}$$\textstyle{\pi_{p+q}(\mathrm{MO}\langle
8\rangle\wedge\mathrm{M}\xi)}$

If ${E}_{\infty}^{0,13}={E}_{2}^{0,13}$, then a nontrivial element with order
$3$ in $\Omega_{13}^{\mathrm{O}\langle 8\rangle}(\xi)$ lies in the image of
$\iota_{\ast}$. By [14], an exotic sphere $\Sigma^{13}$ is a generator of
$\pi_{13}(\mathrm{MO}\langle 8\rangle)$. So, the (2) follows. ∎

Now, we calculate ${{}_{3}\pi}_{13}(\mathrm{MB})$ clearly by the Adams
spectral sequence.

######  Lemma 4.5.

If $p_{1}(\xi)\neq 0\mod 3$, ${{}_{3}\pi}_{13}(\mathrm{MB})=0$.

###### Proof.

From [1] and [11], $\pi_{13}(\mathrm{MO}\langle 8\rangle)=\mathbb{Z}_{3}$ is
generated by

$b_{0}h_{1,0}\in Ext_{\mathcal{A}}^{3,16}(H^{\ast}(\mathrm{MO}\langle
8\rangle;\mathbb{Z}_{3}),\mathbb{Z}_{3})$

in the ASS, where $\mathcal{A}$ is the mod $3$ Steenrod algebra. By the proof
of the (2) of Lemma 4.4, $b_{0}h_{1,0}U$ is nontrivial in
$Ext_{\mathcal{A}}^{3,16}(H^{\ast}(\mathrm{MB};\mathbb{Z}_{3}),\mathbb{Z}_{3})$
if ${{}_{3}\pi}_{13}(\mathrm{MB})=\mathbb{Z}_{3}$, where $U$ is the stable
Thom class of $\mathrm{M}\xi$. Note that

  * (1)

$\mathcal{P}^{1}U=p_{1}(\xi)U\mod 3$ where $\mathcal{P}^{1}$ is the reduced
Steenrod power in the mod $3$ Steenrod algebra $\mathcal{A}$ [21].

  * (2)

$h_{1,0}$ is the dual of $\mathcal{P}^{1}$.

If $p_{1}(\xi)\neq 0\mod 3$, then $\delta(b_{0}p_{1}(\xi)U)=b_{0}h_{1,0}U$ in
the cobar complex of
$Ext_{\mathcal{A}}^{\ast,\ast}(H^{\ast}(\mathrm{MB};\mathbb{Z}_{3}),\mathbb{Z}_{3})$.
In other words, $b_{0}h_{1,0}U$ is trivial. Hence, the desired result follows
from the (1) of Lemma 4.4. ∎

##  5\. The $S^{7}$-fibrations over $\mathrm{CP}^{3}$

For a fibration $E\to B$ with fiber $F$, we say “a fibration $F\to E\to B$”
instead of “an $F$-fibration”. For the $S^{n-1}$-fibrations, there exists a
classifying space $\mathrm{BG}_{n}$. Furthermore, by the natural sequence

$\cdots\to\mathrm{BG}_{n-1}\to\mathrm{BG}_{n}\stackrel{{\scriptstyle
r_{n}^{G}}}{{\to}}\mathrm{BG}_{n+1}\to\cdots$

we have the telescope $\mathrm{BG}$, where the homotopy fiber of
$r_{n}^{G}:\mathrm{BG}_{n}\to\mathrm{BG}_{n+1}$ is $(n-2)$-connected [23]. By
taking the sphere bundle, we have a natural map
$\alpha_{n}:\mathrm{BO}_{n}\to\mathrm{BG}_{n}$, which induces the map
$\alpha:\mathrm{BO}\to\mathrm{BG}$. The classifying spaces $\mathrm{BO}$ and
$\mathrm{BG}$ for the stable bundle theories are infinite loop spaces and the
natural map between them is an infinite loop map by theorems of Boardman and
Vogt [5]. In fact, they are homotopy equivalent to the $0$th spaces in the
$\Omega$-spectra of the multiplicative cohomology theories $KO$ and $KG$
respectively. Thus, there is a natural map between the $\Omega$-spectra $KO$
and $KG$, which is induced by $\alpha:\mathrm{BO}\to\mathrm{BG}$. In addition,
the homotopy fiber $G/O$ of $\alpha:\mathrm{BO}\to\mathrm{BG}$ is also an
infinite loop space.

######  Lemma 5.1.

The following items hold:

(1)
$\widetilde{KO}^{0}(\mathrm{CP}^{3})\cong[\mathrm{CP}^{3},\mathrm{BO}_{8}]$,
$\widetilde{KG}^{0}(\mathrm{CP}^{3})\cong[\mathrm{CP}^{3},\mathrm{BG}_{8}]$.

(2)
$\widetilde{KO}^{0}(\mathrm{CP}^{3})\to\widetilde{KG}^{0}(\mathrm{CP}^{3})$ is
an epimorphism.

###### Proof.

Let $V=O$, $G$. The homotopy fiber of
$r_{8\ast}^{V}:\mathrm{BV}_{8}\to\mathrm{BV}$ is $6$-connected at least. Then,
it is easy to get (1).

It is well known that $\pi_{1}(G/O)=\pi_{3}(G/O)=\pi_{5}(G/O)=0$ [25]. By the
obstruction theory, any map from $\mathrm{CP}^{3}$ to $\mathrm{BG}$ can be
lifted to $\mathrm{BO}$. Thus, the (2) follows. ∎

By Sanderson [24], we have $\widetilde{KO}^{0}(\mathrm{CP}^{2})=\mathbb{Z}$
and $\widetilde{KO}^{0}(\mathrm{CP}^{3})\cong\mathbb{Z}$. Furthermore, the
stable class of a vector bundle over $\mathrm{CP}^{3}$ is determined by its
first Pontrjagin class.

######  Lemma 5.2.

Let $\eta$, $\eta^{\prime}$ be any $8$-dimensional vector bundles over
$\mathrm{CP}^{3}$. The $S^{7}$-bundle of $\eta$ is fiber homotopy equivalent
to the $S^{7}$-bundle of $\eta^{\prime}$ if
$p_{1}(\eta)=p_{1}(\eta^{\prime})\mod 24$.

###### Proof.

For the cofibration sequence $S^{2}\to\mathrm{CP}^{2}\to S^{4}\to\Sigma
S^{2}$, we have the following exact sequences

$\textstyle{0\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces}$$\textstyle{[S^{4},\mathrm{BO}]\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces}$$\scriptstyle{\alpha_{4}}$$\textstyle{[\mathrm{CP}^{2},\mathrm{BO}]\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces}$$\textstyle{[S^{2},\mathrm{BO}]\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces\ignorespaces}$$\scriptstyle{\alpha_{2}}$$\textstyle{0\ignorespaces\ignorespaces\ignorespaces\ignorespaces}$$\textstyle{[S^{3},\mathrm{BG}]\ignorespaces\ignorespaces\ignorespaces\ignorespaces}$$\scriptstyle{\rho_{3}}$$\textstyle{[S^{4},\mathrm{BG}]\ignorespaces\ignorespaces\ignorespaces\ignorespaces}$$\textstyle{[\mathrm{CP}^{2},\mathrm{BG}]\ignorespaces\ignorespaces\ignorespaces\ignorespaces}$$\textstyle{[S^{2},\mathrm{BG}]\ignorespaces\ignorespaces\ignorespaces\ignorespaces}$$\scriptstyle{\rho_{2}}$$\textstyle{\cdots}$

Note that $\alpha_{2}$ is an isomorphism,
$\alpha_{4}:\mathbb{Z}\to\mathbb{Z}_{24}$ is an epimorphism, and
$[\mathrm{CP}^{2},\mathrm{BO}]=\mathbb{Z}$. By [31],
$\rho_{3}:\mathbb{Z}_{2}\to\mathbb{Z}_{24}$ is a monomorphism. Therefore,
$[\mathrm{CP}^{2},\mathrm{BO}]=\mathbb{Z}\to[\mathrm{CP}^{2},\mathrm{BG}]=\mathbb{Z}_{24}$
is an epimorphism. By the exact sequences for the cofibration sequence
$\mathrm{CP}^{2}\to\mathrm{CP}^{3}\to S^{6}\to\Sigma\mathrm{CP}^{2}$, we have
that
$[\mathrm{CP}^{3},\mathrm{BO}]=\mathbb{Z}\to[\mathrm{CP}^{3},\mathrm{BG}]=\mathbb{Z}_{24}$
is an epimorphism. So, the desired result follows. ∎

##  6\. Proofs of Theorems 1.2 and 1.5

Proof of Theorem 1.2: For any nonspin manifold $\mathcal{M}$ with a
restriction lift, the corresponding bordism group $\pi_{13}(\mathrm{MB})$ as
in Section 2 satisfies the case $2$ or $4$ as in Lemma 4.3. Let
$\mathcal{M}^{\prime}$ be another considered manifold so that
$p_{1}(\mathcal{M})=p_{1}(\mathcal{M}^{\prime})$. Then, they lie in the same
bordism group.

By Lemma 4.4 and 3.2, $\mathcal{M}$ is diffeomorphic to
$\mathcal{M}^{\prime}\\#\Sigma^{13}$. Especially, by Lemma 4.5, $\mathcal{M}$
is diffeomorphic to $\mathcal{M}^{\prime}$ if $p_{1}(\mathcal{M})\neq 0\mod
3$.

In the topological category, we also have the same lemma as Lemma 3.2. So
$\mathcal{M}$ is homeomorphic to $\mathcal{M}^{\prime}$ by Lemma 4.4.

Note that the first Pontrjagin class of the stable class of the standard Hopf
bundle over $\mathrm{CP}^{3}$ is $x^{2}\in H^{4}(\mathrm{CP}^{3})$. Hence, for
any $k\in\mathbb{Z}$, there exists an $8$-dimensional vector bundle $\eta$
over $\mathrm{CP}^{3}$ so that $p_{1}(\eta)=kx^{2}$. Besides, the total space
$\overline{\mathcal{M}}$ of the $S^{7}$-bundle of $\eta$ has the first
Pontrjagin class $(4+k)x^{2}$. By the 1) and 2) of Theorem 1.2, Corollary 1.3
follows. By Lemma 5.2 and Corollary 1.3, $\mathcal{M}$ is homotopy equivalent
to $\mathcal{M}^{\prime}$ if
$p_{1}(\mathcal{M})=p_{1}(\mathcal{M}^{\prime})\mod 24$. Furthermore, $p_{1}$
mod $24$ is a homotopy invariant [10]. $\Box$

Proof of Theorem 1.5: Since $\Omega_{7}^{\mathrm{O}\langle
8\rangle}\cong\pi_{7}(\mathrm{MO}\langle 8\rangle)$, there exists an
$8$-manifold $W$ with $\mathrm{BO}\langle 8\rangle$-structure so that
$\partial W=\Sigma^{7}$ for any homotopy $7$-sphere $\Sigma^{7}$.
$\mathrm{CP}^{3}\times\Sigma^{7}$ has a normal $B$-structure as in Section 2.
It is obvious that $\mathrm{CP}^{3}\times W$ also has a normal $B$-structure.
Thus, $\mathrm{CP}^{3}\times\Sigma^{7}$ equals to
$\mathrm{CP}^{3}\times\Sigma^{\prime 7}$ as the bordism class in
$\Omega_{13}^{\mathrm{O}\langle 8\rangle}(\xi)$. Hence, Theorem 1.5 follows by
Lemma 3.2. $\Box$

##  7\. A metric of non-negative sectional curvature

The real $K$-theory of projective spaces are well known, see [24]. The ring
$\widetilde{KO}(\mathrm{CP}^{n})$ is generated by $r(\mathcal{H})-2$, where
$\mathcal{H}$ is the complex canonical line bundle over $\mathrm{CP}^{n}$,
$r:K\to KO$. Let $n=3$. Note that

$\mathrm{CP}^{3}=\mathrm{U}(4)/(\mathrm{U}(1)\times\mathrm{U}(3))=G/H$

and $r(\mathcal{H})$ is homogeneous, i.e. it is a bundle of the form
$(G\times\mathbb{R}^{2})/H$, where $H$ acts on $\mathbb{R}^{2}$ by means of a
real linear representation $\rho\in\mathrm{Rep}_{\mathbb{R}}(H)$. In
particular, $\rho(H)$ lies in $\mathrm{O}(2)$.

Since $[\mathrm{CP}^{3},\mathrm{BO}(8)]\cong\widetilde{KO}(\mathrm{CP}^{3})$,
any $8$-dimensional vector bundle over $\mathrm{CP}^{3}$ is homogeneous. Then
we take its sphere bundle, i.e. it is a bundle of the form $(G\times
S^{7})/H$, where $H$ acts on $S^{7}$ by means of a real linear representation
$\rho^{\prime}$ such that $\rho^{\prime}(H)$ lies in $\mathrm{O}(8)$.

######  Lemma 7.1.

Let $\eta$ be any $8$-dimensional vector bundle over $\mathrm{CP}^{3}$. The
total space of the $S^{7}$-bundle of $\eta$ admits a metric of non-negative
sectional curvature.

###### Proof.

As in [9], we can endow $G\times S^{7}$ with the product metric of
$\langle,\rangle_{G}$ and the standard sphere metric. By O’Neill’s Theorem on
Riemannian submersions, the lemma follows. ∎

## References

  * [1] Aikawa, T. 3-dimensional cohomology of the mod $p$ Steenrod algebra, Math. Scand. 47 (1980), 91-115.
  * [2] Aloff, S., Wallach, N. An infinite family of 7-manifolds admitting positively curved Riemannian structures. Bull. Am. Math. Soc. 81 (1975), 93-97.
  * [3] Barden, D. Simply connected five-manifolds. Ann. of Math. (2) 82 (1965), 365-385.
  * [4] Bazaikin, Y. V. On a certain family of closed 13-dimensional Riemannian manifolds of positive curvature. Sib. Math. J. 37, No. 6 (1996), 1219-1237.
  * [5] Boardman, J. M.; Vogt, R. Homotopy invariant algebraic structures, Lecture Notes in Mathematics 347 Springer-Verlag (1973).
  * [6] Crowley, D.; Nordstr$\ddot{\mathrm{o}}$m, J. The classification of $2$-connected $7$-manifolds. Proc. Lond. Math. Soc. (3) 119 (2019), no. 1, 1-54.
  * [7] Fang, F.; Shen, W. Topological classification of Bazaikin spaces. appearing. https://doi.org/10.48550/arXiv.2307.13303.
  * [8] Giambalvo, V. On $\left\langle 8\right\rangle$-cobordism. Ill. J. Math. 15 (1971), 533-541.
  * [9] Gonz$\acute{\mathrm{a}}$lez-$\acute{\mathrm{A}}$lvaro, D. Nonnegative curvature on stable bundles over compact rank one symmetric spaces. Adv. Math. 307 (2017), 53-71.
  * [10] Hirzebruch, F. A Riemann-Roch theorem for differentiable manifolds. Seminaire Bourbaki, expose 177, 1959.
  * [11] Hovey, M. A.; Ravenel, D. C. The 7-connected cobordism ring at p=3. Trans. Amer. Math. Soc. 347 (1995), no. 9, 3473-3502.
  * [12] Jupp, P. E. Classification of certain $6$-manifolds. Proc. Cambridge Philos. Soc. 73 (1973), 293-300.
  * [13] Kerin, M. Some new examples with almost positive curvature. Geom. Topol. 15 (2011), no. 1, 217-260.
  * [14] Kervaire, M. A.; Milnor, J. W. Groups of homotopy spheres. I. Ann. of Math. (2) 77 (1963), 504-537.
  * [15] Kreck, M. Surgery and duality. Ann. of Math. (2) 149 (1999), no. 3, 707-754.
  * [16] Kreck, M. On the classification of $1$-connected $7$-manifolds with torsion free second homology. J. Topol. 11 (2018), no. 3, 720-738.
  * [17] Kreck, M.; Stolz, S. A diffeomorphism classification of 7-dimensional homogeneous Einstein manifolds with $SU(3)\times SU(2)\times U(1)$-symmetry. Ann. of Math. (2) 127 (1988), no. 2, 373-388.
  * [18] Kreck, M.; Stolz, S. Some nondiffeomorphic homeomorphic homogeneous 7-manifolds with positive sectional curvature. J. Differential Geom. 33 (1991), no. 2, 465-486.
  * [19] Kreck, M.; Su, Y. On 5-manifolds with free fundamental group and simple boundary links in $S^{5}$. Geom. Topol. 21 (2017), no. 5, 2989-3008.
  * [20] Kruggel, B. A homotopy classification of certain 7-manifolds. Trans. Amer. Math. Soc. 349 (1997), no. 7, 2827-2843.
  * [21] Milnor, J. W. Characteristic classes, Mimeographed Notes, Princeton Univ, Princeton, N. J., 1957.
  * [22] Milnor, J. W. Lectures on the cobordism theorem. Notes by L. Siebenmann and J. Sondow Princeton University Press, Princeton, N.J. 1965.
  * [23] Rudyak, Y. B. On Thom Spectra, Orientability, and Cobordism, Springer Mongraphs in Mathematics,Corrected 2nd printing, Springer, 2008.
  * [24] Sanderson, B. J. Immersions and embeddings of projective spaces. Proc. London Math. Soc. (3) 14 (1964), 137-153.
  * [25] Sullivan, D. On the Hauptvermutung for manifolds. Bull. Amer. Math. Soc. 73 (1967), 598-600.
  * [26] Wall, C. T. C. Classification of $(n-1)$-connected $2n$-manifolds. Ann. of Math. (2) 75 (1962), 163-189.
  * [27] Wall, C. T. C. Classification problems in differential topology. V. On certain $6$-manifolds. Invent. Math. 1 (1966), 355-374.
  * [28] Wall, C. T. C. Classification problems in differential topology, VI: Classification of $(s-1)$-connected $(2s+1)$-manifolds, Topology 6 (1967) 273-296.
  * [29] Wall, C. T. C. Surgery on Compact Manifolds, London Math. Soc. Monographs 1, Academic Press, New York, 1970.
  * [30] Wang, M. Y.; Ziller, W. Einstein metrics on principal torus bundles. J. Differential Geom.31 (1990), no. 1, 215-248.
  * [31] Wang, X. On the classification of certain $1$-connected $7$-manifolds and related problems. Q. J. Math.73 (2022), no. 2, 711-727.