Agent‐based ARP cache poisoning detection in switched LAN environments. Issue 1 (1st January 2019)

• Record Type: Journal Article
• Authors: Sakhawat, Daniyal; Khan, Abdul Nasir; Aslam, Mudassar; Chronopoulos, Anthony T.
• Is Part Of: IET networks. Volume 8:Issue 1(2019)
• Page Start: 67
• Page End: 73
• Publication Date: 2019-01-01
• Subjects: local area networks -- authorisation -- protocols -- firewalls; switched LAN environments -- address resolution protocol cache poisoning -- sniffing network services disruption -- switch LAN networks -- network user -- latter attack -- huge damage -- security solutions -- damaging attacks -- universities database servers -- Denial of Service attacks -- network performance -- attackers -- real‐time environment -- similar existing schemes -- switch LAN environment -- AACPD -- agent‐based ARP cache poisoning detection scheme -- insider malicious users; Computer network architectures -- Periodicals; Computer network protocols -- Periodicals; Information networks -- Periodicals; Telecommunication systems -- Periodicals; 004.605
• DOI: 10.1049/iet-net.2018.5084
• Languages: English
• ISSNs: 2047-4954

Abstract

Abstract : Address resolution protocol (ARP) cache poisoning is mostly used to perform man‐in‐the‐middle (MITM) and denial of service (DoS) attacks for sniffing and network services disruption, respectively, in switch LAN networks. The former attack affects the privacy of a network user, whereas the latter attack causes huge damage to networks in terms of unavailability of services. There are many security solutions that provide protection against such type of attacks at firewall level with the assumption that an insider attack does not exist. However, the most damaging and severe attacks on universities database servers to well‐known banking system have been caused by insider malicious users. In this study, the authors propose an agent‐based ARP cache poisoning detection (AACPD) scheme that detects the MITM and DoS attacks in a switch LAN environment. The objective of this scheme is to provide protection from insider malicious users. The proposed AACPD is compared with similar existing schemes in a real‐time environment. The experimental results show that AACPD efficiently and accurately detects attackers with minimum effect on network performance as compared to similar existing schemes.