SADetection: Security Mechanisms to Detect SLAAC Attack in IPv6 Link-Local Network

Abstract

Neighbour Discovery Protocol (NDP) attacks are a serious security concern for IPv6. Attackers utilize the Stateless Address Auto-configuration (SLAAC) NDP attack type of targeting the SLAAC process. SLAAC attacks can compromise an IPv6 link-local network and expose private data. Attack detection mechanisms, including RA-Guard, Snort IPv6 Plugin, SLAAC detection method by Buenaventura et al., and SLAAC Security Method by Massamba et al. have been proposed by researchers to address this issue. However, the detection algorithms have a number of shortcomings, including a complete reliance on preconfigured router databases. Additionally, fragment packets and packets with Hop-by-Hop Options and Destination Options extension headers are not detectable by the detection techniques for hidden RA messages. In this study, a rule-based detection method called SADetection is proposed for use in IPv6 link-local networks to identify SLAAC attacks. Both an illegal Router Advertisement (RA) message and a concealed RA message in a packet with an extension header have been found by SADetection. SADetection has demonstrated a detection accuracy of 98% percent and the capacity to defend an IPv6 link-local network from SLAAC attacks. Povzetek: Opisana je nova metoda SADetection za detekcijo SLAAC napadov v IPv6 omrežjih.

IPv6 addressing with hidden duplicate address detection to mitigate denial of service attacks in the internet of drone

“…Mitigation strategies include RA-Guard, SEND, network segmentation, and regular updates to prevent these security risks in IPv6 networks. 18 In an IPv6-based IoD network, the DAD protocol plays a critical role in ensuring the uniqueness of drone addresses. When a new drone joins the network, a provisional IPv6 address is generated.…”

“…SLAAC attacks exploit vulnerabilities in IPv6 autoconfiguration, enabling malicious activities like spoofing, rogue router advertisements, and neighbor discovery protocol manipulation. Mitigation strategies include RA‐Guard, SEND, network segmentation, and regular updates to prevent these security risks in IPv6 networks 18 …”

An Analysis of Neighbor Discovery Protocol Attacks

“…In addition, rules-based detection techniques are used to detect any violation of the network configuration or the fragmentation of RA messages and extension headers [17][18][19]. The main drawback of passive monitoring is that the training phase must be free of any compromised nodes; otherwise, the detection process will fail [20,21]. For that, [22,23] suggest dynamically updating the rules whenever a legitimate change on the network appears.…”

Leveraging a Two-Level Attention Mechanism for Deep Face Recognition with Siamese One-Shot Learning

“…Their proposal discards the misleading and confounding frames and generates a compact, refined feature for face recognition in face videos. For channel attention, the current channel attention mechanisms used in face recognition [34]- [37] employ a scalar to represent each channel through Global Average Pooling (GAP). However, GAP struggles to capture complex information for various inputs because of its simplicity.…”