A survey on ARP cache poisoning and techniques for detection and mitigation

Meghana, Jitta Sai; Subashri, T.; Vimal, K. R.

doi:10.1109/icscn.2017.8085417

Cited by 18 publications

(16 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Some studies [7,[14][15][16][17][18][19][20] in the current literature have carried out a survey to classify and analyze various solutions to mitigate the ARP Cache Poisoning Attack in traditional networks. In [7], authors carry out a survey on MITM attacks in traditional networks.…”

Section: Related Workmentioning

confidence: 99%

“…These future research directions include minimal usage of cryptographic techniques by solutions so that the ARP process is not slowed down; new solutions should be practical with minimal changes in the way traditional ARP works and more preventive techniques should be used instead of just detection, as detection increases the workload of network administrators because of the generation of many alarms. The authors in [15][16][17][18] also discussed many MITM attacks including the ARP Cache Poisoning Attack. A critical evaluation of few solutions to mitigate ARP Cache Poisoning attack is presented in [15][16][17][18], but the solutions are not divided into various categories.…”

Section: Related Workmentioning

confidence: 99%

“…However, surveys carried out in [7,[14][15][16] are focused on non-SDN based solutions for ARP Cache Poisoning attack and do not discuss SDN based solutions. In [17], the authors have carried out a survey of SDN based solutions for ARP Cache Poisoning attack; however, this study is limited to explanation of few solutions with no critical evaluation. Moreover, classification of solutions into various categories and future research directions are also missing from [17].…”

Section: Introductionmentioning

confidence: 99%

“…In [17], the authors have carried out a survey of SDN based solutions for ARP Cache Poisoning attack; however, this study is limited to explanation of few solutions with no critical evaluation. Moreover, classification of solutions into various categories and future research directions are also missing from [17]. To the best of our knowledge, there are limited studies available in the existing literature that classify and critically evaluate various SDN based solutions to the ARP Cache Poisoning attack.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Mitigating ARP Cache Poisoning Attack in Software-Defined Networking (SDN): A Survey

Shah

Cosgrove

2019

Electronics

View full text Add to dashboard Cite

Address Resolution Protocol (ARP) is a widely used protocol that provides a mapping of Internet Protocol (IP) addresses to Media Access Control (MAC) addresses in local area networks. This protocol suffers from many spoofing attacks because of its stateless nature and lack of authentication. One such spoofing attack is the ARP Cache Poisoning attack, in which attackers poison the cache of hosts on the network by sending spoofed ARP requests and replies. Detection and mitigation of ARP Cache Poisoning attack is important as this attack can be used by attackers to further launch Denial of Service (DoS) and Man-In-The Middle (MITM) attacks. As with traditional networks, an ARP Cache Poisoning attack is also a serious concern in Software Defined Networking (SDN) and consequently, many solutions are proposed in the literature to mitigate this attack. In this paper, a detailed survey on various solutions to mitigate ARP Cache Poisoning attack in SDN is carried out. In this survey, various solutions are classified into three categories: Flow Graph based solutions; Traffic Patterns based solutions; IP-MAC Address Bindings based solutions. All these solutions are critically evaluated in terms of their working principles, advantages and shortcomings. Another important feature of this survey is to compare various solutions with respect to different performance metrics, e.g., attack detection time, ARP response time, calculation of delay at the Controller etc. In addition, future research directions are also presented in this survey that can be explored by other researchers to propose better solutions to mitigate the ARP Cache Poisoning attack in SDN.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Mitigating ARP Cache Poisoning Attack in Software-Defined Networking (SDN): A Survey

Shah

Cosgrove

2019

Electronics

View full text Add to dashboard Cite

show abstract

“…We note that the previous works [16][17][18][19][20][21][22][23][24] did not consider NSM application within these protocols. Moreover, none [25][26][27][28][29][30][31][32][33][34][35][36][37][38][39][40][41][42] focused on NSM use cases and integration with field devices. In this paper, we tested the lab substation equipment and programs implemented to utilize NSM use cases.…”

mentioning

confidence: 99%

Behavior Analysis and Anomaly Detection for a Digital Substation on Cyber-Physical System

et al. 2019

View full text Add to dashboard Cite

The electric power system infrastructure has begun to adopt digital information technologies such as transmission control protocol/internet protocol (TCP/IP) and Ethernet infrastructures. With this adoption, information technology-centric network and system management (NSM) tools are used to manage the intermediate communication systems and electric devices in digital substations. However, the technology to monitor the cyber–physical System (CPS) statistics for the intelligent electronic devices (IEDs) and serial communication for a digital substation does not exist yet. In this paper, we aim to propose cyber-physical analysis methodologies of a digital substation system, concerning issues of (1) International Electrotechnical Commission (IEC) 62351-7 based network and system management, (2) behavior analysis of the CPS, (3) cyber–physical anomaly detection systems, and (4) a testbed for a digital substation. By collaborating with Electric Power Research Institute (EPRI), a cyber security testbed for the digital substation has been developed to implement the use cases and analyze potential security threats. Newly integrated methodologies for information handling are expected to lead to improved safety and reliability for the CPS of electric power grid systems.

show abstract