ARP Spoofing Attack Detection Model in IoT Network using Machine Learning: Complexity vs. Accuracy

Spoofing attacks targeting the address resolution protocol, or the so-called ARP, are common cyber-attacks in IoT environments. In such an attack, the attacker sends a fake message over a local area network to spoof the users and interfere with the communication transferred from and into these users. As such, to detect such attacks, there is a need to check the network gateways and routers continuously to capture and analyze the transmitted traffic. However, there are three major problems with such traffic data: 1) there are substantial irrelevant data to the ARP attacks, 2) there are massive patterns in the way by which the spoof can be implemented, and 3) there is a need for fast processing of such data to reduce any delay resulting from the processing stage. Accordingly, this paper proposes a detection approach using supervised machine learning algorithms. The focus of this paper is to show the tradeoff between speed and accuracy to offer various solutions based on the demanded quality. Various algorithms were tested to find a solution that balanced time requirements and accuracy. As such, the results using all features and with various feature selection techniques were reported. Besides, the results using simple classifiers and ensemble learning algorithms were also reported. The proposed approach is evaluated on an IoT network intrusion dataset (IoTID20) collected from different IoT devices. The results showed that the highest accuracy is obtained using the RF classifier with a subset of features produced by the wrapper technique. In such a case, the accuracy obtained was 99.74%, with running time equal to 305 milliseconds. However, If time is more critical for a given application, then DT can be used with the whole feature set. In such a case, the accuracy was 99.41%, with running time equal to 11 milliseconds.