A Decentralized Security Strategy to Counter ARP Cache Poisoning Attacks

Abstract

The Address Resolution Protocol (ARP) plays a vital role in the Internet protocol suite, but it lacks built-in security features, particularly in verifying the legitimacy of ARP replies. This vulnerability allows attackers to inject fake ARP messages into a Local Area Network (LAN), thereby corrupting the ARP cache of targeted devices. Successful ARP spoofing can enable attackers to carry out man-in-the-middle (MITM) attacks— intercepting or altering data—or even launch denial-of-service (DoS) attacks. Therefore, identifying and preventing ARP cache poisoning is essential. While several studies have proposed methods to address this threat, our review of the existing literature indicates that most of these solutions are not sufficiently effective at detecting and mitigating the problem. In response, this paper introduces a distributed algorithm designed to quickly detect ARP cache poisoning, identify the compromised hosts involved in the attack, and neutralize the threat using the collected data. We developed a prototype implementation of this algorithm, referred to as an "agent," which is deployed on every host in the network. These agents work collaboratively to form a distributed security framework capable of detecting and countering ARP cache poisoning attacks in real time.