Mitigating ARP Cache Poisoning Attack in Software-Defined Networking (SDN): A Survey

Abstract

Address Resolution Protocol (ARP) is a widely used protocol that provides a mapping of Internet Protocol (IP) addresses to Media Access Control (MAC) addresses in local area networks. This protocol suffers from many spoofing attacks because of its stateless nature and lack of authentication. One such spoofing attack is the ARP Cache Poisoning attack, in which attackers poison the cache of hosts on the network by sending spoofed ARP requests and replies. Detection and mitigation of ARP Cache Poisoning attack is important as this attack can be used by attackers to further launch Denial of Service (DoS) and Man-In-The Middle (MITM) attacks. As with traditional networks, an ARP Cache Poisoning attack is also a serious concern in Software Defined Networking (SDN) and consequently, many solutions are proposed in the literature to mitigate this attack. In this paper, a detailed survey on various solutions to mitigate ARP Cache Poisoning attack in SDN is carried out. In this survey, various solutions are classified into three categories: Flow Graph based solutions; Traffic Patterns based solutions; IP-MAC Address Bindings based solutions. All these solutions are critically evaluated in terms of their working principles, advantages and shortcomings. Another important feature of this survey is to compare various solutions with respect to different performance metrics, e.g., attack detection time, ARP response time, calculation of delay at the Controller etc. In addition, future research directions are also presented in this survey that can be explored by other researchers to propose better solutions to mitigate the ARP Cache Poisoning attack in SDN.

Blockchain Based Solutions to Mitigate Distributed Denial of Service (DDoS) Attacks in the Internet of Things (IoT): A Survey

“…However, all these solutions did not calculate that delay. In addition, traffic monitoring follows certain flow rules, and it is possible that unwanted traffic can comply with the established rules but carry out malicious behavior [ 119 ]. Moreover, SDN infrastructure is itself vulnerable to many attacks [ 119 ] which are not considered by authors in [ 112 , 113 , 114 , 115 , 116 ].…”

Implementing an intrusion detection and prevention system using Software-Defined Networking: Defending against ARP spoofing attacks and Blacklisted MAC Addresses

“…A recent survey by Shah et al [15] found that most proposed solutions to mitigate ARP spoofing in SDN utilise IP-MAC address bindings held by the controller; either by listening to DHCP server data or ARP requests. The researchers state that these may be subject to DHCP spoofing attacks, or the initial ARP packets themselves could be spoofed.…”

BMC-SDN: Blockchain-Based Multicontroller Architecture for Secure Software-Defined Networks

“…Security of SDN has attracted much attention from researchers [6,8]. Tayfour and Marsono [9] proposed a collaborative technique to detect and mitigate distributed denial-of-service (DDoS) flooding attacks on softwaredefined network (SDN) across multicontroller domains, using sflow-RT [10] and Snort rules.…”

“…The main concern for the network administrator and network programmer is to keep the SDN controllers synchronized and having similar network topology information to make the correct routing decisions. However, multicontroller SDN could be targeted by several attacks [4][5][6], including false data injection, where a compromised controller sends fraudulent flow information to other controllers. This could cause routing malfunctions, routing loops, and incorrect functionality of firewalls.…”