Ascertain the efficient machine learning approach to detect different ARP attacks. (April 2022)

• Record Type: Journal Article
• Authors: Ahuja, Nisha; Singal, Gaurav; Mukhopadhyay, Debajyoti; Nehra, Ajay
• Is Part Of: Computers & electrical engineering. Volume 99(2022)
• Publication Date: 2022-04
• Subjects: ARP Poison attack -- ARP Flooding attack -- SDN -- MITM -- Eavesdropping -- SDN dataset -- Machine learning; Computer engineering -- Periodicals; Electrical engineering -- Periodicals; Electrical engineering -- Data processing -- Periodicals; Ordinateurs -- Conception et construction -- Périodiques; Électrotechnique -- Périodiques; Électrotechnique -- Informatique -- Périodiques; Computer engineering; Electrical engineering; Electrical engineering -- Data processing; Periodicals; Electronic journals; 621.302854
• DOI: 10.1016/j.compeleceng.2022.107757
• Languages: English
• ISSNs: 0045-7906

Abstract

Abstract: Software-Defined Networking (SDN) is a programmable network architecture that allows network devices to be controlled remotely, but it is still highly susceptible to traditional attacks such as Address Resolution Protocol (ARP) Poisoning, ARP Flooding, and others. The classification of benign network traffic from ARP Poison and ARP Flooding attacks is presented in this paper employing machine learning (ML) techniques. A python application is developed at the SDN controller using Mininet that collects and logs the features required to detect the attack into a file known as a traffic dataset. This dataset is used to train the ML model and detect the attacks. The hybrid model of Convolution Neural Network-Long Short Term Memory (CNN-LSTM) model out-performs the other ML models with an accuracy score of 99.73%. During the attack, a high CPU utilization of more than 97% and a high memory usage serve as experimental evidence. The attack detection time of 63000 microseconds also demonstrates the efficiency of attack detection. Graphical abstract: Highlights: The author proposed an SDN-specific ARP attack dataset that can be used by the research community. Using various features and promising deep learning algorithms are employed in order to detect the ARP Poison and Flood attacks. Attack traffic is distinguished from benign traffic by employing various deep learning algorithms trained on the aforementioned SDN Dataset.