In-Band ARP-based Man-in-the-Middle Attack Detection Using P4 Programmable Switches - Department of Networks, Systems and Services
Communication Dans Un Congrès Année : 2024

In-Band ARP-based Man-in-the-Middle Attack Detection Using P4 Programmable Switches

Résumé

Recently, P4-based Programmable Data Planes (PDP) have attracted significant interest in providing more fine-grained and customized packet processing, particularly for network security functions, including attack detection. This paper introduces a novel approach to detect Man-in-the-Middle (MitM) attacks by performing in-band processing of the Address Resolution Protocol (ARP) using Programming Protocol-independent Packet Processor (P4) programmable switches. To this end, we designed and developed an effective detection system for MitM based on real-time statistical data by measuring, in the data plane, the ARP messages for each connected host to the programmable switch that raise alarms according to configurable burst sizes. We conducted experiments to validate our approach and evaluated its effectiveness in attack detection times (DT) and false positive (FP) rates. The results show that at high rates our detection system achieves mean DT of 1.7 seconds for Network Discovery (ND) attack and 3.13 seconds for Spoofing-Poisoning (SP) attack. Also, at high rates, we obtained reduced FP alarms, 0.69% and 2.59% for ND and SP attacks, respectively. The results are consistent compared with a SDN existing approach.
Fichier principal
Vignette du fichier
latincom24.pdf (681.95 Ko) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-04878851 , version 1 (10-01-2025)

Licence

Identifiants

Citer

Christian Garzón, Abdelkader Lahmadi, Jaime Vergara, Alexánder Leal, Juan Felipe Botero. In-Band ARP-based Man-in-the-Middle Attack Detection Using P4 Programmable Switches. 2024 IEEE Latin-American Conference on Communications (LATINCOM), Nov 2024, Medellin, Colombia. pp.1-6, ⟨10.1109/LATINCOM62985.2024.10770688⟩. ⟨hal-04878851⟩
0 Consultations
0 Téléchargements

Altmetric

Partager

More