Abstract:The Address Resolution Protocol (ARP) spoofing is a form of attack typically used by attackers to cause a denial of service or man-in-the-middle attacks. This attack comes from ARP weaknesses and aims to compromise victims' ARP caches by sending ARP packets containing fake IP-MAC pairs. To overcome ARP spoofing attacks, several approaches leverage the advantages of software-defined networking (SDN) to detect malicious users in the network. To achieve their goal, the SDN controller consecutively checks the characteristics of each ARP packet to ensure its correctness. However, this verification method can lead to latency and congestion at the controller level or render the system unusable for large-scale networks. To address this drawback, we propose a game-theoretic approach to provide an optimal verification method that considers the intelligent attackers' decision-making process during an ARP cache poisoning attempt. This approach is a zero-sum game between the attacker who wants to poison the victims' ARP caches and the defender who must avoid this poisoning. The game model results in mixed-strategy Nash equilibria that identify optimal verification methods to prevent control plane latency and congestion during attacker detection. The results show that an intelligent attacker will refrain from poisoning ARP caches with a high-impact strategy because the defender frequently checks such a strategy. In addition, the attacker's penalty value can deter both rational and irrational attackers from poisoning ARP caches. Simulations in the Mininet simulator have shown that the proposed approach can significantly mitigate control plane latency and congestion during the attacker's characteristic checking.

Address Protection-as-a-Service An inter-AS Framework for IP Spoofing Resilience

Revisiting Inter-As IP Spoofing Let the Protection Drive Source Address Validation.

A Two-Level Source Address Spoofing Prevention Based on Automatic Signature and Verification Mechanism

Asidps: Auto-Scaling Intrusion Detection And Prevention System For Cloud

MASK:An Efficient Mechanism to Extend Inter-Domain IP Spoofing Preventions

On the Deployability of Inter-As Spoofing Defenses

Multi-variant Network Address Hopping to Defend Stealthy Crossfire Attack

Aigis: Full-Coverage and Low-Overhead Mitigating Against Amplified Reflection DDoS Attacks

Hiding and Trapping: A Deceptive Approach for Defending against Network Reconnaissance with Software-Defined Network

Towards a Cooperative Mechanism Based Distributed Source Address Filtering

Umbrella: A Routing Choice Feedback Based Distributed Inter-Domain Anti-Spoofing Solution

RISP: an RPKI-based Inter-As Source Protection Mechanism

Preventing IP Source Address Spoofing: A Two-Level, State Machine-Based Method

An Authentication Based Source Address Spoofing Prevention Method Deployed in IPv6 Edge Network

A Multi-fence Countermeasure Based Inter-domain Source Address Validation Method

<i>pSAV</i>: A Practical and Decentralized Inter-AS Source Address Validation Service Framework

Enable a Trustworthy Network by Source Address Spoofing Prevention Routers: A Formal Description

Toward Incentivizing Anti-Spoofing Deployment

Toward Practical Inter-Domain Source Address Validation

Countering ARP Spoofing Attacks in Software-Defined Networks using a Game-Theoretic Approach

The Automatic Peer-To-Peer Signature For Source Address Validation