XGBoost meets Explainable AI: A Scalable Approach for Detection of ARP Spoofing

Abstract— ARP is a critical component of network communication, yet its lack of inherent security measures makes it vulnerable to ARP spoofing attacks. These attacks exploit ARP's trust-based design, enabling adversaries to intercept, modify, or block network traffic, leading to severe consequences such as data exfiltration, denial of service, and MITM attacks. Traditional ARP spoofing detection methods often fall short due to their reliance on static rules and limited adaptability to dynamic network environments. ARP XGBoost Shield model presents an advanced methodology for detecting ARP spoofing attacks using a combination of ML and explainable AI techniques. The method combines PCA for dimensionality reduction, SHAP for feature interpretability, and the XGBoost classifier for robust anomaly detection. The system achieves high accuracy while minimizing false positive by balancing the dataset through preprocessing steps such as feature extraction, normalization, and oversampling. The proposed model is tested on a large IoT network intrusion dataset, has testing accuracy of 93%.