A New Approach for ARP Poisoning Attack Detection Based on Network Traffic Analysis

Atmojo, Yohanes Priyo; Susila, I Made Darma; Suradarma, Ida Bagus; Yuningsih, Lilis; Rini, Erma Sulistyo; Hostiadi, Dandy Pramana

doi:10.1109/isriti54043.2021.9702860

Cited by 2 publications

(10 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Research on ARP poisoning attack detection has been conducted by previous researchers. Some of them applied the concept of mining-based analysis [1]- [3], [8], [9], anomaly behavior analysis [10]- [13] and used supporting applications [4], [14], [15]. ARP poisoning activities often used analysis on network traffic data obtained from recording results [15] or used public datasets that had been processed in the form of network traffic flows (netflows) [8], [10].…”

Section: Methodsmentioning

confidence: 99%

“…The ARP poisoning model often uses analysis of network traffic data obtained from recordings [15] or uses public datasets that have been processed in the form of netflows [8], [10]. Besides, the Netflows are commonly used to detect attacks or malicious activity anomalies [17], including ARP Poisoning attacks.…”

Section: Lontar Komputermentioning

confidence: 99%

“…Besides, the Netflows are commonly used to detect attacks or malicious activity anomalies [17], including ARP Poisoning attacks. ARP poisoning is often misused to cause computer network deadlocks by illegally forging computer addresses to obtain confidential and credential information [8]. Thus, the proper ARP poisoning attack detection technique is required to accurately detect the attack in a computer network.…”

Section: Lontar Komputermentioning

confidence: 99%

“…This paper proposed a new approach for ARP poisoning attack detection using a similarity analysis based on NetFlow analysis. This research is a development in [8], where the detection model used a classification approach in previous studies. The results of ARP poisoning attack detection using classification have a high detection accuracy but a high detection error value.…”

Section: Lontar Komputermentioning

confidence: 99%

“…ARP is a communications protocol that maps the addressing of each computing device in the computer network as a Media Access Control (MAC) address. Research on ARP attack detection has been introduced in previous research, such as detection models by applying the concept of mining-based analysis [1]- [3], [8], [9], anomaly behavior analysis [10]- [13] and used supporting applications [4], [14], [15]. In [16], an ARP poisoning detection model is introduced by separating ARP service access and using a listing technique in the form of static MAC address addressing.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

The Optimization of the ARP Poisoning Attack Detection Model Using a Similar Approach Based on NetFlow Analysis

Atmojo,

Hostiadi,

Susila

et al. 2023

LKJITI

View full text Add to dashboard Cite

Information security and threats are a concern in the cyber era. Attacks can be malicious activities. One of them is known as ARP poisoning attack activity, which attacks by falsifying a computer's identity through illegal access to retrieve confidential information in a target computer. Besides, it has also caused service deadlocks in the network. Previous studies have been introduced for the ARP Attack Detection model using rule-based and mining-based. Still, they cannot show optimal detection performance and obtain high false positive results. This paper proposed a detection model for ARP poisoning attacks using a similarity measurement approach adopting cosine similarity. The goal is to obtain measurements of host activities similar to ARP poisoning attacks. The experiment results showed that the model got an accuracy of 97.25%, recall of 96.43%, and precision of 81% with a similarity threshold value of 0.488. Comparison results with previous studies showed higher detection accuracy than previous studies and some classification methods. It shows that the model can improve intrusion detection performance and facilitate network administrators to analyze ARP poisoning attacks in computer networks.

show abstract

Section: Methodsmentioning

confidence: 99%

Section: Lontar Komputermentioning

confidence: 99%

Section: Lontar Komputermentioning

confidence: 99%

Section: Lontar Komputermentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

The Optimization of the ARP Poisoning Attack Detection Model Using a Similar Approach Based on NetFlow Analysis

Atmojo,

Hostiadi,

Susila

et al. 2023

LKJITI

View full text Add to dashboard Cite

show abstract

A Lightweight Log-Monitoring-Based Mitigation Tool Against WLAN Attacks

Saifan,

Radi,

Al-Dabbagh

et al. 2023

Preprint

View full text Add to dashboard Cite

Wireless network attacks are some of the most common network security threats dealt with on a daily basis. Their ease of execution and effectiveness make them commonplace within most public networks. The goal of this paper is to develop a tool which provides defenses against these attacks, one which can also generate the attacks to test its own effectiveness in defending against them. The research involved the design, testing, and implementation of an attack/defense tool, one which benefits from a user-friendly user interface that greatly simplifies the testing process. The attacks were generated using existing tools, linked to one central interface. The defense methodology was script-based and created entirely from scratch. It was also linked to a single interface which continuously monitored logs. The results showed that the proposed defenses to the studied wireless attacks were effective at mitigation, or outright prevention. They were also more lightweight than existing solutions, making them more appealing for less powerful hardware.

show abstract

A New Approach for ARP Poisoning Attack Detection Based on Network Traffic Analysis

Cited by 2 publications

References 8 publications

The Optimization of the ARP Poisoning Attack Detection Model Using a Similar Approach Based on NetFlow Analysis

The Optimization of the ARP Poisoning Attack Detection Model Using a Similar Approach Based on NetFlow Analysis

A Lightweight Log-Monitoring-Based Mitigation Tool Against WLAN Attacks

Contact Info

Product

Resources

About