Abstract:Nowadays, cyber-attack is a severe criminal violation, and it is one of the most active fields of research. Man-in-the-middle attack (MITM) is a type of cyber-attack in which an unauthorized third party secretly accesses the communication between two hosts in the same network to read=modify the transferred data between them. ARP spoofing-based MITM attack exploits ARP protocol weakness where the attacker associates its MAC address with the IP address of an intended legitimate host. Although there are many defense approaches for ARP spoofing based-MITM attacks, these methods are uncompleted or have a performance overhead since they modify the original ARP protocol. Also, some of these approaches depend on the centralized server which leads to a single point of failure. This paper presents a detection scheme for ARP spoofing-based MITM attack called D-ARP which is compatible with the original ARP protocol. The main idea of D-ARP is to send an ARP packet signed with a key in parallel with the original ARP packets to make a correlation between requests and replies. Each host records the signed ARP packets whether it is a request or a reply in a log file. Based on this correlation, D-ARP matches the injected key to detect ARP spoofing if there is a duplicate or conflict in the MAC address. For more reliability, D-ARP uses the DHCP server and the Nmap feature to detect the MAC addresses of MITM attackers. Moreover, this scheme also offers a module for Admin to create a trusted list of hosts. The experimental results show that D-ARP is very effective to detect and prevent ARP spoofing with zero false positives and zero false negative probabilities without any modifications in the original ARP protocol.

A Method of ARP Spoofing of Trojan Horse Virus Auto-Orientation Based on Protocol Analysis

Stars Can Tell: A Robust Method to Defend Against GPS Spoofing Attacks Using Off-the-shelf Chipset.

A Practical GPS Location Spoofing Attack in Road Navigation Scenario.

Research of the ARP Spoofing Principle and a Defensive Algorithm

ARP Spoofing Detection and Guarding Algorithm

ARP Virus Attacks Simulation and Preventive Measures

Study on ARP Spoofing Attack Detection and Defense Technology

Research on ARP Spoof Detection Strategies in Unreliable LAN.

Overview of ARP Spoofing Detection and Prevention Techniques

Cooperation System of Worm Detection and Quarantine in Real Time

Multi-variant Network Address Hopping to Defend Stealthy Crossfire Attack

DESIGNING AND IMPLEMENTING ARP SPOOFING DETECTING SYSTEM BASED ON SNMP PROTOCOL

Principle analysis and prevention of ARP attack based on local area network

The Study on Protocol Spoofing in Active Sniffing

REVERSE AUTOMATED ANALYSIS OF APT TROJAN NETWORK PROTOCOL

Reaching on Redirection Technology Based on ARP and DNS Spoofing

D-ARP: An Efficient Scheme to Detect and Prevent ARP Spoofing

Detection of Trojan Covert Communication Based on Client Honeypot

Preventing ARP Spoofing Attacks Through Gratuitous Decision Packet

A Client/Server Based Mechanism to Prevent ARP Spoofing Attacks

A Distributed IP Spoof Detection System in Intranet