Detection of neighbor discovery protocol based attacks in IPv6 network

Detecting Neighbor Discovery Protocol-Based Flooding Attack Using Machine Learning Techniques

“…On the other hand, active mechanisms [26,27] use probe packets for additional observations. Bansal [28] uses Multicast Listener Discovery (MLD) probing to reduce the traffic, while Kumar [29] proposed a host-based IDPS which verified any changes made on its neighbor cache by sending NS probes.…”

Integrated Framework to Detect and Mitigate Denial of Service (DoS) Attacks on Duplicate Address Detection Process in IPv6 Link Local Communication

“…This mechanism detects the anomalies based on behavioral changes in the hosts (IP and MAC addresses). However, the drawback with behavior based detection mechanism is that if genuine changes takes places in the network it still considers them anomalies [12]. Since, this mechanism is unable to distinguish between the normal and abnormal traffic changes in IPv6 network.…”

“…In recent attempts, an Active detection mechanism [12] was proposed to detect the attacks against NDP Protocol. This proposed mechanism is probing based (IDS).…”

“…In addition to that, it claimed to be interoperable with major Operating Systems. Nevertheless, due to its probing nature increases CPU utilization and require larger bandwidth [12]. Thus, can raise the complexity issues during DAD process in IPv6 LLC.…”

“…WinSeND has same security issue like SeND mechanism. Apart from being platform dependent, it also requires regular patching [12]. Thus, due to these limitations WinSeND mechanism is not appropriate for securing DAD process in IPv6 LLC.…”