An detection algorithm for ARP man-in-the-middle attack based on data packet forwarding behavior characteristics

The ARP protocol is located at the data link layer. Because the ARP protocol itself lacks an authentication mechanism, an attacker can easily masquerade as a gateway or a target server to intercept user data packets to achieve malicious purposes. This article first analyzes the behavior characteristics of ARP spoofing on the access switch, and then proposes an algorithm for detecting man-in-the-middle attacks based on ARP spoofing. Experiments show that the algorithm can detect ARP spoofing attacks effectively and locate the attacker quickly.