Address resolution protocol spoofing detection with machine learning

The Address Resolution Protocol (ARP) is a fundamental network protocol used to translate IP addresses into MAC addresses for devices on a network. However, the inherent security weaknesses of this protocol make it susceptible to manipulation by malicious actors, leading to attacks such as ARP spoofing. ARP spoofing is a critical attack that poses significant risks to network security, potentially resulting in the theft of sensitive data, redirection of network traffic, and compromise of data integrity. This thesis presents a study on the use of various machine learning and deep neural network (DNN) algorithms for detecting ARP spoofing. Specifically, this study implements the ARP Probe system, which uses a DNN model recently proposed by Alani et al. and independently compares our performance results with those found in the referenced study. Although the referenced study indicates that the Internet of Things Network Intrusion Dataset (IoT-ID) was used in the design of the DNN model, our study observed that the entire dataset was not utilized in their approach. By employing the complete dataset, our findings revealed that the performance metrics were lower when the entire dataset was used. Additionally, machine learning methods such as Decision Tree, Random Forest, K-Nearest Neighbors, and Logistic Regression were also applied and compared with DNN. As a result, Random Forest and Decision Tree algorithms achieved the highest accuracy (95.82% and 95.94%, respectively) and precision (93.24% and 93.77%, respectively), demonstrating the best performance. DNN applications, on the other hand, yielded the highest sensitivity result, with 99.72%.