Abstract:The Address Resolution Protocol (ARP) spoofing is a form of attack typically used by attackers to cause a denial of service or man-in-the-middle attacks. This attack comes from ARP weaknesses and aims to compromise victims' ARP caches by sending ARP packets containing fake IP-MAC pairs. To overcome ARP spoofing attacks, several approaches leverage the advantages of software-defined networking (SDN) to detect malicious users in the network. To achieve their goal, the SDN controller consecutively checks the characteristics of each ARP packet to ensure its correctness. However, this verification method can lead to latency and congestion at the controller level or render the system unusable for large-scale networks. To address this drawback, we propose a game-theoretic approach to provide an optimal verification method that considers the intelligent attackers' decision-making process during an ARP cache poisoning attempt. This approach is a zero-sum game between the attacker who wants to poison the victims' ARP caches and the defender who must avoid this poisoning. The game model results in mixed-strategy Nash equilibria that identify optimal verification methods to prevent control plane latency and congestion during attacker detection. The results show that an intelligent attacker will refrain from poisoning ARP caches with a high-impact strategy because the defender frequently checks such a strategy. In addition, the attacker's penalty value can deter both rational and irrational attackers from poisoning ARP caches. Simulations in the Mininet simulator have shown that the proposed approach can significantly mitigate control plane latency and congestion during the attacker's characteristic checking.

Research on Defense Strategy of Kaminsky DNS Cache Poisoning

An intelligent proactive defense against the client‐side DNS cache poisoning attack via self‐checking deep reinforcement learning

DNS Cache Poisoning Attack Reloaded: Revolutions with Side Channels

Adaptive IP Mutation: A Proactive Approach for Defending against Worm Propagation

Adaptive Caching Approach to Prevent DNS Cache Poisoning Attack

The Maginot Line: Attacking the Boundary of DNS Caching Protection

Anti-Attacking Modeling and Analysis of Cyberspace Mimic DNS

DepenDNS: Dependable Mechanism against DNS Cache Poisoning

Unilateral Antidotes to DNS Cache Poisoning

A wrinkle in time: A case study in DNS poisoning

Poison Over Troubled Forwarders: A Cache Poisoning Attack Targeting DNS Forwarding Devices

Countering DNS Amplification Attacks Based on Analysis of Outgoing Traffic

A Method Based on AMHI for DDoS Attacks Detection and Defense

Detection and Defence of DNS Spoofing Attack

Security of Patched DNS

Take up DNSSEC When Needed

DNSGuard: In-network Defense Against DNS Attacks

DNSBomb: A New Practical-and-Powerful Pulsing DoS Attack Exploiting DNS Queries-and-Responses

Detection of Domain Name System Cache Attack Based on Cumulative Sum Algorithm

IP Spoofing DDoS Defense Using Active IP Record and ICMP Message

Countering ARP Spoofing Attacks in Software-Defined Networks using a Game-Theoretic Approach