Scalable Implementation of Active Detection Mechanism for LAN Based Attacks

This research intends to find information about evidence of Address Resolution Protocol (ARP) Spoofing attacks that is the MAC address of the attacker and victim also the time of the attack. This research uses Wireshark tools to inspect network traffic, especially on the ARP protocol. It uses the National Institute of Technology Technology (NIST) method as a framework in the simulation process to produce evidence reports. ARP Spoofing attacks can lead to other attacks, such as Denial of Service and Man in the Middle Attack, this attack allows users not to be able to access the network and data theft. During the simulation stage, 2 ARP Spoofing attacks are carried out on 1 laptop and 1 router connected to the network. The results of the attack simulation found 2 attacks and obtained information about the MAC address of the attacker and victim and also the time of the attack. Based on the results of tests carried, successfully found all ARP Spoofing attacks that occur on the network with a success rate of 100%

The Address Resolution Protocol (ARP) is a foundational component of local area network communication, responsible for resolving IP addresses to MAC addresses within a subnet. Its stateless and unauthenticated design makes it susceptible to a class of attacks known as ARP spoofing, where a malicious actor transmits falsified ARP messages to corrupt the ARP caches of other devices on the same network segment. This paper presents a detailed analysis of ARP spoofing attacks, covering the protocol's inherent weaknesses, the step-by-step mechanics of cache poisoning, and the tools commonly used by attackers. It further investigates the impact of these attacks on LAN and public Wi-Fi environments, addressing data interception, session hijacking, and network availability disruption. A review of current mitigation techniques including Dynamic ARP Inspection (DAI), static ARP entries, and network monitoring is provided, along with an assessment of their practical effectiveness. The paper also discusses emerging trends such as machine learning-based anomaly detection and Software-Defined Networking as future directions for defending local networks against ARP-based threats. Keywords: ARP spoofing, ARP poisoning, MAC address, man-in-the-middle attack, LAN security, Dynamic ARP Inspection, session hijacking, gratuitous ARP, network monitoring

Local area network (LAN) access is the top vector for insider threats and misuses according to the Verizon's Data Breach Investigations Report. Address Resolution Protocol (ARP) is often exploited by the attackers who have gained access to the LAN. It is critical for students to learn how attacks on ARP work and know the countermeasures. In an earlier work, authors developed a hands-on lab to help students learn how an ARP spoofing attack works by asking them to create and send attack packets. To enhance learning further, we present an interactive visualization tool that intuitively shows the effects of the ARP spoofing attack in real-time. The Hacker Graphical User Interface (HGUI) is an interactive visualization tool developed to assist students in learning how ARP Spoofing works. By modeling a controlled ARP Spoofing attack using virtual machines, we give students the ability to alter elements of the attack by interacting with the visualization. This tool was developed using Processing, an open source programming language used in many visual art communities. It runs on virtual machines installed with Kali Linux. This tool animates attack packets, normal packets, and the status of ARP cache in real-time. If students have successfully carried out the ARP spoofing attack, they can see the normal packets being routed to the attacker machine and the victim's ARP cache being poisoned. In this paper, we present the design, implementation, and evaluation of the lab. Tests were conducted to measure the performance of students before and after using this tool. We also gave students surveys after they completed the hands-on lab. The result shows that this tool can significantly enhance students' understanding of the concept of ARP spoofing attacks and motivate them in learning more about cyber security.

Purpose The purpose of the study concludes detecting address resolution protocol (ARP) Spoofing attack in software-defined network (SDN) architecture meanwhile using different machine learning models to evaluate their effectiveness. Design/methodology/approach This research originates from building a SDN topology and researching into its changes under ARP Spoofing attack. Based on that, the authors propose four features which show obvious abnormalities in network under attack stage. The data collected from SDN controller is used to build a data set, which is then put into different machine learning models, which are: Artificial Neuron network (ANN), Convolutional Neural Networks (CNN), Long Short-Term Memory (LSTM), CNN-LSTM and Gated Recurrent Unit (GRU). Findings After applying this proposal in simulation and experimental environments, they achieve impressive performance metrics. In simulation environment, the GRU model stands out with the highest accuracy of 98.94%. In real environments, the CNN-LSTM model leads with a recall of 98.38% and an F1-Score of 98.57%, while the LSTM model has the highest precision (98.8%). The GRU model also performs strongly in real scenarios with a high accuracy of 97.65%. ANN, despite its reliability, struggles with lower recall and F1-Score across both environments. Originality/value This analysis emphasizes the importance of the proposed features when applied to different models and their high potential to conduct in practical environment.

The address resolution protocol (ARP) has proven to work well under regular circumstances, but it was not designed to cope with malicious hosts. By performing ARP spoofing attacks, a malicious host can either impersonate another host [man-in-the-middle attack (MiM) ] and gain access to sensitive information, or perform denial of service attack (DoS) on target hosts. Several security solutions, such as high-cost LAN switches and intrusion detection or prevention systems (IDS/IPS), are currently used to detect and prevent these attacks. In this paper, we evaluate, through extensive practical experiments, how effective these security solutions are in detecting ARP spoofing. We clearly show that ARP spoofing has not been given enough attention by most common security solutions which lack efficient detection and prevention mechanisms. We then propose an optimal algorithm that is capable of detecting all various ARP spoofing attacks; especially those not detected using the current mechanisms. The suggested algorithm can be easily integrated in any available security solution with very minimal overhead.

ABSTRACTModern operating systems (OSs) are expected to be more secure as they integrate robust security measures to ensure that users can perform their daily tasks reliably. In this article, through extensive experimentation, we evaluate how today’s most common OSs fare against the typical Address Resolution Protocol (ARP) poisoning attack in a local area network (LAN). We test some common variants of Linux along with two variants of Mac OS X and one variant of Windows, and observe that they are not impervious to ARP poisoning. Also, we conclude that Mac OS X is the most vulnerable of all the OSs tested, whereas the tested variants of Linux and Windows show the same resilience toward attack, even though Windows is believed to be less secure than the others.

Local Area Network (LAN) based attacks are due to compromised hosts in the network and mainly involve spoofing with falsified IP-MAC pairs. Since Address Resolution Protocol (ARP) is a stateless protocol such attacks are possible. Several schemes have been proposed in the literature to circumvent these attacks, however, these techniques either make IP-MAC pairing static, modify the existing ARP, patch operating systems of all the hosts etc. In this paper we propose an Intrusion Detection System (IDS) for LAN specific attacks without any extra constraint like static IP-MAC, changing the ARP etc. The proposed IDS is an active detection mechanism where every pair of IP-MAC are validated by a probing technique. The scheme is successfully validated in a test bed and results also illustrate that the proposed technique minimally adds to the network traffic.

Internet utilisation has steadily increased, predominantly due to the rapid recent development of information and communication networks and the widespread distribution of smartphones. As a result of this increase in Internet consumption, various types of services, including web services, social networking services (SNS), Internet banking, and remote processing systems have been created. These services have significantly enhanced global quality of life. However, as a negative side-effect of this rapid development, serious information security problems have also surfaced, which has led to serious to Internet privacy invasions and network attacks. In an attempt to contribute to the process of addressing these problems, this paper proposes a process to detect anomalous traffic using self-similarity analysis in the Anomaly Teletraffic detection Measurement analysis Simulator (ATMSim) environment as a research method. Simulations were performed to measure normal and anomalous traffic. First, normal traffic for each attack, including the Address Resolution Protocol (ARP) and distributed denial-of-service (DDoS) was measured for 48 h over 10 iterations. Hadoop was used to facilitate processing of the large amount of collected data, after which MapReduce was utilised after storing the data in the Hadoop Distributed File System (HDFS). A new platform on Hadoop, the detection system ATMSim, was used to identify anomalous traffic after which a comparative analysis of the normal and anomalous traffic was performed through a self-similarity analysis. There were four categories of collected traffic that were divided according to the attack methods used: normal local area network (LAN) traffic, DDoS attack, and ARP spoofing, as well as DDoS and ARP attack. ATMSim, the anomaly traffic detection system, was used to determine if real attacks could be identified effectively. To achieve this, the ATMSim was used in simulations for each scenario to test its ability to distinguish between normal and anomalous traffic. The graphic and quantitative analyses in this study, based on the self-similarity estimation for the four different traffic types, showed a burstiness phenomenon when anomalous traffic occurred and self-similarity values were high. This differed significantly from the results obtained when normal traffic, such as LAN traffic, occurred. In further studies, this anomaly detection approach can be utilised with biologically inspired techniques that can predict behaviour, such as the artificial neural network (ANN) or fuzzy approach.

The aim of this paper is to deploy a custom backdoor on to a target machine (Metasploit/Windows) from the source machine (Kali Linux) in a virtual environment (Hypervisor -Windows). For the Virtual system, a wired network is used. The overall goal of the project is to deploy malware such as a backdoor, on devices connected to the infected network, to showcase the threat posed by such malicious software. This work proposes a framework for the AI-based deployment of effective custom backdoors within a virtualized environment. The local virtualization platforms have leveraged to create scalable, isolated, and reproducible sandboxes for backdoor research. This is achieved by carrying out an ARP (Address Resolution Protocol) spoofing attack. It is followed by manipulation of DNS (Domain Name System) server response to redirect the victim to a malicious site or intercept HTTP (Hyper-Text Transfer Protocol) response to enable downloading of malicious files on the target system. Hence, the trojan downloaded can be of any form, like a key-logger or Backdoor. The Backdoor will help us get full system access to the target site and we will be able to download and upload files on or from the target machine, thus effectively creating a backdoor.

Tapping into the communication between two hosts on a LAN has become quite simple thanks to tools that can be downloaded from the Internet. Such tools use the address resolution protocol (ARP) poisoning technique, which relies on hosts caching reply messages even though the corresponding requests were never sent. Since no message authentication is provided, any host of the LAN can forge a message containing malicious information. We present a secure version of ARP that provides protection against ARP poisoning. Each host has a public/private key pair certified by a local trusted party on the LAN, which acts as a certification authority. Messages are digitally signed by the sender, thus preventing the injection of spurious and/or spoofed information. As a proof of concept, the proposed solution was implemented on a Linux box. Performance measurements show that PKI based strong authentication is feasible to secure even low level protocols, as long as the overhead for key validity verification is kept small.

Most of the LAN based-attacks involves the spoofing of the victim host with falsified IP-MAC pairs. MAC Spoofing is possible because of the stateless nature of the Address Resolution Protocol (ARP), which is responsible for resolving IP Addresses to MAC Addresses. Several mechanisms have been proposed to detect and mitigate ARP spoofing attempts both at the network level and at the host level, but each of them have their own drawback. In this paper we propose a Host-based Intrusion Detection system for LAN attacks which work without any extra constraint like static IP-MAC, modifying ARP etc. The scheme is successfully validated in a test bed with various attack scenarios and the results show the effectiveness of the proposed technique.KeywordsLocal Area NetworkAddress Resolution ProtocolReply PacketProbe RequestCache Poisoning AttackThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Address resolution protocol (ARP) is considered as the important protocol in computer communications due to frequent usage in individual as well as organization levels. Though efficient during regular scenarios, the design of ARP has not been designated to tackle malicious hosts. Considering the adverse circumstances, many researchers have developed strategies to improve the effectiveness of ARP by detecting and preventing the malicious attacks like spoofing, Denial of service (DoS) and Man in the middle (MITM) attacks. This paper discusses about the ARP poisoning attacks and focuses on reviewing various mechanisms developed for attack detection and prevention with specified analysis to their advantages. Different attack detection and mitigation methods are evaluated in addition to comparison in terms of key parameters. This study helps in understanding the strategy employed for ARP attack detection and mitigation and developing a framework for improvement.

Internet is widely depends on the IP over Ethernet networks architecture. IP and Ethernet protocols uses in each Local Area Network LAN, wire and wireless. Due to the rapid expansion of the technology field this architecture reveals many shortcomings. TCP/IP suite protocols are consists from layers, each layer accomplish its jobs separately. However, these layers susceptible to different attacks. Data link layer one of the most layers targeted by the attackers. Attack at lower layer may lead to more sophisticated attacks to upper layers, like Man-in-The-Middle (MiTM), DNS spoofing and Denial of Service (DoS). These attacks applicable even with encrypted protocols such as HTTPS and SSL. In this paper we discuss the security in the Data Link Layer in IP over Ethernet networks and the attacks depend on the Address resolution protocol (ARP). Moreover, explain our proposed method to prevent address resolution protocol attacks.

This paper's primary goal is to examine the detection and mechanism of ARP spoofing. One may argue that the Address Resolution Protocol, or ARP for simple terms, is crucial to computer science and forensics. ARP spoofing is one of the various computers hacking techniques used nowadays by individuals to transmit phony ARP packets across a Local Area Network (LAN). Such attacks might lead to changes in traffic patterns or, worse yet, a temporary or permanent stoppage of traffic. Even though this attack is only possible on networks with Address Resolution Protocols, ARP spoofing can be a precursor to more dangerous assaults that have the potential to do considerably more harm. An attacker seeking to launch this sort of attack will search for the Address Resolution Protocol's vulnerabilities. He may, for instance, be trying to take advantage of flaws like the message's inability to properly verify the sender. Because of this, hackers may find it very simple to alter or steal users' data. Because ARP spoofing poses a genuine risk to the security of every user on the network, all appropriate precautions must be taken to minimize harm.

Address Resolution Protocol is a protocol associated with mapping a given IP address with the associated MAC address. ARP Poisoning or Spoofing attack is an attack which carried out over a Local Area Network. In an ARP Poisoning/Spoofing attack malicious ARP Packets are sent to a default gateway on LAN with intent to change the IP address-MAC address pairings in the ARP cache table. ARP Spoof attack tool has been developed with a script written in Python Programming language using scapy library. A detection algorithm has been proposed for detecting the above generated ARP Poisoning attack (or any ARP Poisoning attack in general) and implemented the same using a python script with scapy library. The detection algorithm is based on analyzing the real MAC Address and response MAC Address of the ARP Packet sniffed for any discrepancies. Lastly, a prevention mechanism is proposed and implemented for ARP Poisoning attacks by implementing static entries in ARP table.