In-Band ARP-based Man-in-the-Middle Attack Detection Using P4 Programmable Switches

Recently, P4-based Programmable Data Planes (PDP) have attracted significant interest in providing more fine-grained and customized packet processing, particularly for network security functions, including attack detection. This paper introduces a novel approach to detect Man-in-the-Middle (MitM) attacks by performing in-band processing of the Address Resolution Protocol (ARP) using Programming Protocol-independent Packet Processor (P4) programmable switches. To this end, we designed and developed an effective detection system for MitM based on real-time statistical data by measuring, in the data plane, the ARP messages for each connected host to the programmable switch that raise alarms according to configurable burst sizes. We conducted experiments to validate our approach and evaluated its effectiveness in attack detection times (DT) and false positive (FP) rates. The results show that at high rates our detection system achieves mean DT of 1.7 seconds for Network Discovery (ND) attack and 3.13 seconds for Spoofing-Poisoning (SP) attack. Also, at high rates, we obtained reduced FP alarms, 0.69% and 2.59% for ND and SP attacks, respectively. The results are consistent compared with a SDN existing approach.