E2BaSeP: Efficient Bayes Based Security Protocol Against ARP Spoofing Attacks in SDN Architectures
- PDF / 4,922,208 Bytes
- 17 Pages / 595.224 x 790.955 pts Page_size
- 29 Downloads / 178 Views
E2BaSeP: Efficient Bayes Based Security Protocol Against ARP Spoofing Attacks in SDN Architectures Vianney Kengne Tchendji1
´ · Fabrice Mvah1 · Clementin Tayou Djamegni1,2 · Yannick Florian Yankam1
Received: 18 February 2020 / Accepted: 12 September 2020 © Springer Nature Switzerland AG 2020
Abstract Virtual networks, just like classical IP networks, usually face many external threats such as ARP spoofing attacks. These attacks come from Address Resolution Protocol (ARP) vulnerabilities. Indeed, the ARP protocol can allow a virtual machine to be identified by one or more IP-MAC pairs, thus facilitating users’ impersonation and forged IP-MAC pair insertion into the victims’ ARP caches. This type of attack is the beginning of more dangerous attacks such as man-in-the-middle and denial-of-service. Several solutions based on SDN (Software-Defined Network) technology, known for their suitable adaptation to large-scale networks, have been proposed. These solutions use a global ARP cache built into the controller which contains the virtual machines’ IP-MAC pairs, as attacker detection knowledge. The main drawbacks of these methods are the collection and unsecured storage of IP-MAC pairs into the global ARP cache and failure to consider IP address reallocation cases, as well as users’ connection and reconnection scenarios in the attacker detection process. To remedy these shortcomings, we propose an Efficient Bayes Based Security Protocol (E2BaSeP) which detects attackers using a Bayesbased algorithm. This solution works in both dynamically and statically addressing networks. Simulation results show that the E2BaSeP protocol provides effective protection for ARP caches and performs better than those observed in the literature. Keywords ARP spoofing · Software-defined network · Global ARP cache · Bayes probabilities · Virtual networks · Dynamic addressing
1 Introduction The growth of computer systems has made the classic model of associating a physical machine to each user increasingly obsolete. Today, through network virtualization
Vianney Kengne Tchendji
[email protected] Fabrice Mvah [email protected] Cl´ementin Tayou Djamegni [email protected] Yannick Florian Yankam [email protected] 1
Department of Mathematics and Computer Science, University of Dschang, PO Box 67, Dschang, Cameroon
2
Department of Computer Engineering, University of Dschang, PO Box 134, Bandjoun, Cameroon
paradigm, computer resources can be distributed and daily workstations are no longer systematically physical machines. The possibility offered by network virtualization to distribute network resources as needed makes it possible to solve the needs in terms of CPU and storage resources that arise today in most systems connected to the Internet. These systems, which increasingly handle very sensitive data, impose strict security guarantees. Today’s security concerns are high-priority issues in financial services networks, database protection, and management of IPMAC addresses resulting from ARP execution [1]. The management of IP-MAC ad
Data Loading...
