An Active Host-Based Detection Mechanism for ARP-Related Attacks

Local Area Network (LAN) based attacks are due to compromised hosts in the network and mainly involve spoofing with falsified IP-MAC pairs. Since Address Resolution Protocol (ARP) is a stateless protocol such attacks are possible. Several schemes have been proposed in the literature to circumvent these attacks, however, these techniques either make IP-MAC pairing static, modify the existing ARP, patch operating systems of all the hosts etc. In this paper we propose an Intrusion Detection System (IDS) for LAN specific attacks without any extra constraint like static IP-MAC, changing the ARP etc. The proposed IDS is an active detection mechanism where every pair of IP-MAC are validated by a probing technique. The scheme is successfully validated in a test bed and results also illustrate that the proposed technique minimally adds to the network traffic.

The function of Address Resolution Protocol (ARP) is critical in local area networking as well as for routing Internet traffic across gateways. ARP, being a Stateless protocol, is prone to various attacks such as ARP spoofing, ARP flooding and ARP poisoning. This work discusses about an efficient scalable implementation of an Intrusion Detection System (IDS) with active detection, to detect ARP spoofing, flooding and related attacks like Man-in-the-Middle(MiTM) and Denial-of-Service(DoS) etc.

The Address Resolution Protocol (ARP) is a foundational component of local area network communication, responsible for resolving IP addresses to MAC addresses within a subnet. Its stateless and unauthenticated design makes it susceptible to a class of attacks known as ARP spoofing, where a malicious actor transmits falsified ARP messages to corrupt the ARP caches of other devices on the same network segment. This paper presents a detailed analysis of ARP spoofing attacks, covering the protocol's inherent weaknesses, the step-by-step mechanics of cache poisoning, and the tools commonly used by attackers. It further investigates the impact of these attacks on LAN and public Wi-Fi environments, addressing data interception, session hijacking, and network availability disruption. A review of current mitigation techniques including Dynamic ARP Inspection (DAI), static ARP entries, and network monitoring is provided, along with an assessment of their practical effectiveness. The paper also discusses emerging trends such as machine learning-based anomaly detection and Software-Defined Networking as future directions for defending local networks against ARP-based threats. Keywords: ARP spoofing, ARP poisoning, MAC address, man-in-the-middle attack, LAN security, Dynamic ARP Inspection, session hijacking, gratuitous ARP, network monitoring

Local area network (LAN) access is the top vector for insider threats and misuses according to the Verizon's Data Breach Investigations Report. Address Resolution Protocol (ARP) is often exploited by the attackers who have gained access to the LAN. It is critical for students to learn how attacks on ARP work and know the countermeasures. In an earlier work, authors developed a hands-on lab to help students learn how an ARP spoofing attack works by asking them to create and send attack packets. To enhance learning further, we present an interactive visualization tool that intuitively shows the effects of the ARP spoofing attack in real-time. The Hacker Graphical User Interface (HGUI) is an interactive visualization tool developed to assist students in learning how ARP Spoofing works. By modeling a controlled ARP Spoofing attack using virtual machines, we give students the ability to alter elements of the attack by interacting with the visualization. This tool was developed using Processing, an open source programming language used in many visual art communities. It runs on virtual machines installed with Kali Linux. This tool animates attack packets, normal packets, and the status of ARP cache in real-time. If students have successfully carried out the ARP spoofing attack, they can see the normal packets being routed to the attacker machine and the victim's ARP cache being poisoned. In this paper, we present the design, implementation, and evaluation of the lab. Tests were conducted to measure the performance of students before and after using this tool. We also gave students surveys after they completed the hands-on lab. The result shows that this tool can significantly enhance students' understanding of the concept of ARP spoofing attacks and motivate them in learning more about cyber security.

This research intends to find information about evidence of Address Resolution Protocol (ARP) Spoofing attacks that is the MAC address of the attacker and victim also the time of the attack. This research uses Wireshark tools to inspect network traffic, especially on the ARP protocol. It uses the National Institute of Technology Technology (NIST) method as a framework in the simulation process to produce evidence reports. ARP Spoofing attacks can lead to other attacks, such as Denial of Service and Man in the Middle Attack, this attack allows users not to be able to access the network and data theft. During the simulation stage, 2 ARP Spoofing attacks are carried out on 1 laptop and 1 router connected to the network. The results of the attack simulation found 2 attacks and obtained information about the MAC address of the attacker and victim and also the time of the attack. Based on the results of tests carried, successfully found all ARP Spoofing attacks that occur on the network with a success rate of 100%

Internet utilisation has steadily increased, predominantly due to the rapid recent development of information and communication networks and the widespread distribution of smartphones. As a result of this increase in Internet consumption, various types of services, including web services, social networking services (SNS), Internet banking, and remote processing systems have been created. These services have significantly enhanced global quality of life. However, as a negative side-effect of this rapid development, serious information security problems have also surfaced, which has led to serious to Internet privacy invasions and network attacks. In an attempt to contribute to the process of addressing these problems, this paper proposes a process to detect anomalous traffic using self-similarity analysis in the Anomaly Teletraffic detection Measurement analysis Simulator (ATMSim) environment as a research method. Simulations were performed to measure normal and anomalous traffic. First, normal traffic for each attack, including the Address Resolution Protocol (ARP) and distributed denial-of-service (DDoS) was measured for 48 h over 10 iterations. Hadoop was used to facilitate processing of the large amount of collected data, after which MapReduce was utilised after storing the data in the Hadoop Distributed File System (HDFS). A new platform on Hadoop, the detection system ATMSim, was used to identify anomalous traffic after which a comparative analysis of the normal and anomalous traffic was performed through a self-similarity analysis. There were four categories of collected traffic that were divided according to the attack methods used: normal local area network (LAN) traffic, DDoS attack, and ARP spoofing, as well as DDoS and ARP attack. ATMSim, the anomaly traffic detection system, was used to determine if real attacks could be identified effectively. To achieve this, the ATMSim was used in simulations for each scenario to test its ability to distinguish between normal and anomalous traffic. The graphic and quantitative analyses in this study, based on the self-similarity estimation for the four different traffic types, showed a burstiness phenomenon when anomalous traffic occurred and self-similarity values were high. This differed significantly from the results obtained when normal traffic, such as LAN traffic, occurred. In further studies, this anomaly detection approach can be utilised with biologically inspired techniques that can predict behaviour, such as the artificial neural network (ANN) or fuzzy approach.

Network security has become a concern with the rapid growth and expansion of the Internet. While there are several ways to provide security for communications at the application, transport, or network layers, the data link layer security has not yet been adequately addressed. Dynamic Host Configuration Protocol (DHCP) and Address Resolution Protocol (ARP) are link layer protocols that are essential for network operation. They were designed without any security features. Therefore, they are vulnerable to a number of attacks such as the rogue DHCP server, DHCP starvation, host impersonation, man-in-the-middle, and denial of service attacks. Vulnerabilities in ARP and DHCP threaten the operation of any network. The existing solutions to secure ARP and DHCP could not mitigate DHCP starvation and host impersonation attacks. This work introduces a new solution to secure ARP and DHCP for preventing and mitigating these LAN attacks. The proposed solution provides integrity and authenticity for ARP and DHCP messages. Security properties and performance of the proposed schemes are investigated and compared to other related schemes.

The address resolution protocol (ARP) has proven to work well under regular circumstances, but it was not designed to cope with malicious hosts. By performing ARP spoofing attacks, a malicious host can either impersonate another host [man-in-the-middle attack (MiM) ] and gain access to sensitive information, or perform denial of service attack (DoS) on target hosts. Several security solutions, such as high-cost LAN switches and intrusion detection or prevention systems (IDS/IPS), are currently used to detect and prevent these attacks. In this paper, we evaluate, through extensive practical experiments, how effective these security solutions are in detecting ARP spoofing. We clearly show that ARP spoofing has not been given enough attention by most common security solutions which lack efficient detection and prevention mechanisms. We then propose an optimal algorithm that is capable of detecting all various ARP spoofing attacks; especially those not detected using the current mechanisms. The suggested algorithm can be easily integrated in any available security solution with very minimal overhead.

Purpose The purpose of the study concludes detecting address resolution protocol (ARP) Spoofing attack in software-defined network (SDN) architecture meanwhile using different machine learning models to evaluate their effectiveness. Design/methodology/approach This research originates from building a SDN topology and researching into its changes under ARP Spoofing attack. Based on that, the authors propose four features which show obvious abnormalities in network under attack stage. The data collected from SDN controller is used to build a data set, which is then put into different machine learning models, which are: Artificial Neuron network (ANN), Convolutional Neural Networks (CNN), Long Short-Term Memory (LSTM), CNN-LSTM and Gated Recurrent Unit (GRU). Findings After applying this proposal in simulation and experimental environments, they achieve impressive performance metrics. In simulation environment, the GRU model stands out with the highest accuracy of 98.94%. In real environments, the CNN-LSTM model leads with a recall of 98.38% and an F1-Score of 98.57%, while the LSTM model has the highest precision (98.8%). The GRU model also performs strongly in real scenarios with a high accuracy of 97.65%. ANN, despite its reliability, struggles with lower recall and F1-Score across both environments. Originality/value This analysis emphasizes the importance of the proposed features when applied to different models and their high potential to conduct in practical environment.

The aim of this paper is to deploy a custom backdoor on to a target machine (Metasploit/Windows) from the source machine (Kali Linux) in a virtual environment (Hypervisor -Windows). For the Virtual system, a wired network is used. The overall goal of the project is to deploy malware such as a backdoor, on devices connected to the infected network, to showcase the threat posed by such malicious software. This work proposes a framework for the AI-based deployment of effective custom backdoors within a virtualized environment. The local virtualization platforms have leveraged to create scalable, isolated, and reproducible sandboxes for backdoor research. This is achieved by carrying out an ARP (Address Resolution Protocol) spoofing attack. It is followed by manipulation of DNS (Domain Name System) server response to redirect the victim to a malicious site or intercept HTTP (Hyper-Text Transfer Protocol) response to enable downloading of malicious files on the target system. Hence, the trojan downloaded can be of any form, like a key-logger or Backdoor. The Backdoor will help us get full system access to the target site and we will be able to download and upload files on or from the target machine, thus effectively creating a backdoor.

Smart home systems, which integrate diverse IoT devices for automation and energy efficiency, are increasingly targeted by cyber threats such as Man-in-the-Middle (MitM) and Denial-of-Service (DoS)/Distributed DoS (DDoS) attacks. Traditional security mechanisms often lack the adaptability and responsiveness needed for real-time protection, leaving devices vulnerable to data breaches and manipulation. This paper proposes a behavioural fingerprinting-based security framework that combines threshold-based detection with machine learning (ML) classification to identify anomalies in device activity patterns, including round-trip time (RTT) and Address Resolution Protocol (ARP) behaviour. The proposed approach is evaluated in a real smart home testbed environment using an IP camera, Raspberry Pis, and an ASUS router. Experimental results demonstrate a high detection accuracy across varied attack scenarios. The results show that the proposed system can detect attacks in near real-time, while maintaining compatibility with third-party applications, making it a practical and effective solution for enhancing smart home security.

The paper proposes a real-time dynamic watermarking (DWM) detection method for networked inverted pendulum servo systems (NIPSSs). Firstly, considering network-induced delay, the discrete model of NIPSSs is established, which may be changed as cyber attacks occur. Secondly, according to DWM technology, an active detection mechanism is constructed to detect cyber attacks that distort the measurements from the sensor fed to the NIPSSs. Thirdly, to conform security and real-time requirements of NIPSSs, a real-time window-based DWM detection algorithm is designed to detect cyber attacks, where two indicators are defined to judge whether the measurement has been distorted. The proposed detection algorithm can detect cyber attacks in time and is easily implementable in the NIPSSs since there is no hardware update requirements. Finally, the effectiveness and feasibility of the DWM detection algorithm are confirmed by experimental analysis of the NIPSSs.

Grant-free random access is a promising mechanism to support modern massive machine-type communications in which devices are sporadically active with small payloads. Under this random access, a unique challenge is the detection of device activity without the cooperation from devices. Furthermore, for only a few bits of data, it is more efficient to embed the data to the signature sequences so that the activity and data detection can be jointly carried out. However, compared with the vanilla device activity detection problem, joint activity and data detection has an extra discontinuous sparsity constraint, which makes the detection problem more challenging. In contrast to the prevalent way of first neglecting the discontinuous sparsity constraint and re-enforcing it at the end, this paper proposes a novel penalty-based algorithm to gradually enforce the discontinuous sparsity constraint during the optimization procedure. Simulation results demonstrate that the proposed method achieves around 10 times better detection performance than state-of-the-art approaches.

The Open Network and Host Based Intrusion Detection Test bed (ONBIT) has been designed to make use of both network and host-based monitoring while validating and evaluating IDS tools and algorithms. This test bed was found to be of critical need for scenarios in which external test beds cannot be used. The ONBIT test bed can be used to verify algorithms, concepts, and protocols, as well as discover more practical problems for future security research. This test bed is unique in its real-time nature and real-world performance and efficiency metrics, critical metrics for capabilities being readied for deployment. The ONBIT test bed was built using open source software and was designed to take accuracy and repeatability into consideration at each step of experimentation. Using a link emulator called Dummy Net, the ONBIT test bed has the ability to control how the network behaves. Dummy Net creates controlled packet loss, introduces latency, and allows for the configuration of various size network pipes. We show the benefit of correlating host-based and network-based IDS data in a real-world demonstration of the testbed's use.

Address Resolution Protocol (ARP) based attacks are caused by compromised hosts in the LAN and mainly involve spoofing with falsified IP-MAC pairs. Since ARP is a stateless protocol such attacks are possible. Neither there are signatures available for these attacks nor any significant statistical behavior change can be observed. So existing signature or anomaly intrusion detection systems are unable to detect these type of attacks. Several schemes have been proposed in the literature to circumvent these attacks, however, these techniques either make IP-MAC pairing static, modify the existing ARP, violate network layering architecture etc. In this paper a host based Discrete Event System (DES) approach is proposed for detecting ARP spoofing attacks. This approach does not require any extra constraint like static IP-MAC, changing the ARP or violation of network layering architecture.