A DES approach to intrusion detection system for ARP spoofing attacks

Local Area Network (LAN) based attacks are caused by compromised hosts in the LAN and mainly involve spoofing with falsified IP-MAC pairs. Since Address Resolution Protocol (ARP) is a stateless protocol such attacks are possible. Several schemes have been proposed in the literature to circumvent these attacks, however, these techniques either make IP-MAC pairing static, modify the existing ARP, patch operating systems of all the hosts etc. In this paper we propose a Discrete Event System (DES) approach for detecting ARP spoofing attacks. This approach does not require any extra constraint like static IP-MAC or changing the ARP.