Authors: Zouheir Trabelsi, Wassim El-Hajj
Addresses: Information Security Department, College of Information Technology, UAE University, P.O. Box 17551, Al-Ain, UAE. ' Information Security Department, College of Information Technology, UAE University, P.O. Box 17551, Al-Ain, UAE
Abstract: The address resolution protocol (ARP) has proven to work well under regular circumstances, but it was not designed to cope with malicious hosts. By performing ARP spoofing attacks, a malicious host can either impersonate another host [man-in-the-middle attack (MiM) ] and gain access to sensitive information, or perform denial of service attack (DoS) on target hosts. Several security solutions, such as high-cost LAN switches and intrusion detection or prevention systems (IDS/IPS), are currently used to detect and prevent these attacks. In this paper, we evaluate, through extensive practical experiments, how effective these security solutions are in detecting ARP spoofing. We clearly show that ARP spoofing has not been given enough attention by most common security solutions which lack efficient detection and prevention mechanisms. We then propose an optimal algorithm that is capable of detecting all various ARP spoofing attacks; especially those not detected using the current mechanisms. The suggested algorithm can be easily integrated in any available security solution with very minimal overhead.
Keywords: intrusion detection systems; ARP spoofing attacks; man-in-the-middle attacks; MiM; denial of service; DoS attacks; address resolution protocol; network security.
International Journal of Internet Protocol Technology, 2010 Vol.5 No.1/2, pp.92 - 100
Published online: 09 Apr 2010 *Full-text access for editors Access for subscribers Purchase this article Comment on this article