IDS for ARP spoofing using LTL based discrete event system framework

Mitra, Mahasweta; Banerjee, Prithu; Barbhuiya, Ferdous Ahmed; Biswas, Santosh; Nandi, Sukumar

doi:10.1007/s13119-013-0019-1

Cited by 6 publications

(3 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The critical problem with the DES-based system is that it begins with designing the model from the English language specification of the protocol under normal and attack conditions [20]. The state-transition model is built manually, which may lead to an inaccurate design.…”

Section: Des Based Ids Techniquesmentioning

confidence: 99%

“…DES is a discrete automata model with event-driven dynamics [20][21][22] that has been used for the development of the IDS [23,8], to resolve the issues of change in protocol, augmentation in hardware, etc. The DES model is built for both normal and attack (referred to as failure) conditions on the network.…”

Section: Introductionmentioning

confidence: 99%

“…The LDES framework [24,20] is a user-friendly environment as it can capture the standard language specifications. This paper focuses on the LDES to construct an IDS that detects DODAG Version Number attacks.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

LDES: detector design for version number attack detection using linear temporal logic based on discrete event system

Seth

Biswas

Dhar

2023

Int. J. Inf. Secur.

Self Cite

View full text Add to dashboard Cite

The Internet Engineering Task Force (IETF) has defined routing protocols for Low Power and Lossy Networks (RPL) for constrained devices. RPL constructs DODAGs (Destination Oriented Directed Acyclic Graphs), to optimize routing. RPL ensures acyclic topology with the DODAG version number. However, the control message's DODAG version number is not authenticated. So, RPL is vulnerable to topological inconsistency attack known as DODAG Version Number (DVN) attack. DVN attack creates a packet delay, packet loss, cyclic topology, etc., in the network. This paper proposes a method for detecting DODAG version number attacks. Several existing schemes to defend against the DVN, such as cryptographic techniques, trust-based, thresholdbased and mitigation are computationally intensive or require protocol modification. DVN does not change the packet format or sequence of packets, but can still perform attacks and hence fall under the category of stealthy attacks, which are difficult to detect using traditional Intrusion Detection System s (IDS). Discrete-Event System (DES) based IDS have been applied in the literature for stealthy attacks that achieve low overhead, low false alarm rate, etc. However, the construction of DES-based IDS for network protocol may lead to errors, as modelling is manual. The resulting IDS, therefore, is unable to guarantee its correctness. This

show abstract

Section: Des Based Ids Techniquesmentioning

confidence: 99%