Vesper: Using Echo Analysis to Detect Man-in-the-Middle Attacks in LANs

Abstract

The Man-in-the-Middle (MitM) attack is a cyberattack in which an attacker intercepts traffic, thus harming the confidentiality, integrity, and availability of the network. It remains a popular attack vector due to its simplicity. However, existing solutions are either not portable, suffer from a high false positive rate, or are simply not generic.In this paper, we propose Vesper: a novel plug-and-play MitM detector for local area networks. Vesper uses a technique inspired from impulse response analysis used in the domain of acoustic signal processing. Analogous to how echoes in a cave capture the shape and construction of the environment, so to can a short and intense pulse of ICMP echo requests model the link between two network hosts. Vesper uses neural networks called autoencoders to model the normal patterns of the echoed pulses, and detect when the environment changes. Using this technique, Vesper is able to detect MitM attacks with high accuracy while incurring minimal network overhead.We evaluate Vesper on LANs consisting of video surveillance cameras, servers, and PC workstations. We also investigate several possible adversarial attacks against Vesper, and demonstrate how Vesper mitigates these attacks.Index Terms-Man in the middle, anomaly detection, echoanalysis, LAN security.

An Overview of Recent Advances of Resilient Consensus for Multiagent Systems under Attacks

“…Researchers can study the following literature for their research interest of MITM attack [71][72][73].…”

Realtime Robust Malicious Traffic Detection via Frequency Domain Analysis

“…We analyze information loss in the feature extraction of traditional flow-level methods. We consider three types of widely used statistical features in the traditional flow-level methods [5,25,38,44,74]: (i) min-max features, the feature extraction function f outputs the maximum or minimum value of ì 𝑠 to extract flow-level features of traffic and produces the output for machine learning algorithms. (ii) average features, f calculates the average number of ì 𝑠 to obtain the flow-level features.…”

“…As far as we know, there is no flow-level malicious traffic detection method that achieves task agnostic detection. Thus, we establish 22 flow-level statistics according to the existing studies [4,5,32,38,44,74] including the maximum, minimum, variance, mean, range of the three per-packet features in Whisper, flow duration, and flow byte count. We perform normalization for the flow-level statistics.…”

“…Unfortunately, due to the processing overhead of machine learning algorithms, existing detection methods achieve low detection accuracy and are unable to process high rate traffic. As a result, most of these methods can only be deployed offline [2,4,5,15,30,49] that cannot realize realtime detection, particularly in high performance networks (e.g., in 10 Gigabit networks) [28,38,43,44,74,75].…”

Detecting IKEv1 Man-in-the-Middle Attack with Message-RTT Analysis

“…Man-in-the-middle attacks are impossible to protect against with firewalls and intrusion detection systems. Mirsky et al [7] designed a man-in-the-middle attack detection algorithm named Vesper, which can identify man-inthe-middle attacks in LAN networks by measuring the RTT of echo packets. However, this method cannot detect attacks against specific application protocols and is difficult to apply to the WAN environment.…”