Sage Journals: Discover world-class research

Abstract

The increased adoption of the Internet Protocol (IP) in ICSs has made these systems vulnerable to the same security risks that are present in traditional IT environments. The legacy nature of ICSs and their unique operational requirements make them vulnerable to security threats that are different from those in IT environments. In this paper, we describe a protocol, named ArpON, which is able to wipe out in quasi real time any ARP cache poisoning attempt, thus making it ineffective. Contrarily to solutions presented in the literature for contrasting ARP cache poisoning, ArpON incurs in low operational costs, is backward compatible, transparent to the ARP protocol and does not use any HW feature nor cryptography functionality. We also model and validate ArpON in the OMNET $+ +$ network simulator. The simulation results show that ArpON is effective in avoiding ARP poisoning, and its communication overhead is negligible with respect to classical ARP protocol.

Keywords

Industry 4.0 ARP ARP poisoning Man-in-the-Middle attacks secure ARP

Get full access to this article

View all access options for this article.

References

A.M.

Abdel Salam,

W.S.

Elkilani and

K.M.

Amin, An automated approach for preventing ARP spoofing attack using static ARP entries, International Journal of Advanced Computer Science and Applications(IJACSA) 5(1) (2014).

A.M.

AbdelSalam,

A.B.

El-Sisi and

Reddy, Mitigating ARP spoofing attacks in software-defined networks, in: 2015 25th International Conference on Computer Theory and Applications (ICCTA), IEEE, 2015, pp. 126–131. doi:10.1109/ICCTA37466.2015.9513433.

Ahuja,

Singal,

Mukhopadhyay and

Nehra, Ascertain the efficient machine learning approach to detect different ARP attacks, Computers and Electrical Engineering 99 (2022), 107757, https://www.sciencedirect.com/science/article/pii/S0045790622000647 . doi:10.1016/j.compeleceng.2022.107757.

Ainsworth,

Brake,

Gonzalez,

Toma and

A.F.

Browne, A comprehensive survey of industry 4.0, IIoT and areas of implementation, in: Proc. SoutheastCon, 2021, pp. 1–6, https://ieeexplore.ieee.org/abstract/document/9401860 . doi:10.1109/SoutheastCon45413.2021.9401860.

M.M.

Alani, Guide to OSI and TCP/IP Models, Springer, 2014. doi:10.1007/978-3-319-05152-9.

Arote and

K.V.

Arya, Detection and prevention against ARP poisoning attack using modified ICMP and voting, in: 2015 International Conference on Computational Intelligence and Networks, IEEE, 2015, pp. 136–141. doi:10.1109/CINE.2015.34.

Arpalert, ARP spoofing detector, www.arpalert.org.

D.J.

Atul,

Kamalraj,

Ramesh,

Sakthidasan Sankaran,

Sharma and

Khasim, A machine learning based IoT for providing an intrusion detection system for security, Microprocessors and Microsystems 82 (2021), 103741, https://www.sciencedirect.com/science/article/pii/S0141933120308863 . doi:10.1016/j.micpro.2020.103741.

Barnaba , Anticap, 2003, http://cvs.antifork.org/cvsweb.cgi/anticap.

10.

Bruschi,

Di Pasquale,

Ghilardi,

Lanzi and

Pagani, Formal verification of ARP (address resolution protocol) through SMT-based model checking-a case study, in: International Conference on Integrated Formal Methods, Springer, 2017, pp. 391–406. doi:10.1007/978-3-319-66845-1_26.

11.

Bruschi,

Di Pasquale,

Ghilardi,

Lanzi and

Pagani, A formal verification of ARPON – a tool for avoiding Man-in-the-Middle attacks in ethernet networks, IEEE Transactions on Dependable and Secure Computing (2022). doi:10.1109/TDSC.2021.3118448.

12.

Bruschi,

Ornaghi and

Rosti, S-ARP: A secure address resolution protocol, in: Computer Security Applications Conference, 2003. Proceedings. 19th Annual, IEEE, 2003, pp. 66–74. doi:10.1109/CSAC.2003.1254311.

13.

Chaudhary and

Prasad, IoT in healthcare sector – a comprehensive analysis of threats and privacy issues, 2022. doi:10.1063/5.0110596.

14.

Cheshire, IPv4 address conflict detection, RFC 5227, IETF, 2008, Internet Engineering Task Force, http://www.ietf.org/rfc/rfc5227.txt.

15.

Cheshire,

Aboba and

Guttman, Dynamic configuration of IPv4 link-local addresses, RFC 3927, RFC Editor, 2005, https://rfc-editor.org/rfc/rfc3927.txt. doi:10.17487/rfc3927.

16.

CISCO, Cisco systems. “Configuring Dynamic Arp Inspection”. Catalyst 6500 Series Switch Cisco IOS Software Configuration guide, release 12.2SX. Chapter 39, 2003, http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/dynarp.html.

17.

Danielis,

Skodzik,

Altmann,

E.B.

Schweissguth,

Golatowski,

Timmermann and

Schacht, Survey on real-time communication via ethernet in industrial automation environments, in: Proceedings of the 2014 IEEE Emerging Technology and Factory Automation (ETFA), 2014, pp. 1–8. doi:10.1109/ETFA.2014.7005074.

18.

Deb,

S.R.

Chakraborty,

Lagineni and

Singh, Security analysis of MITM attack on SCADA network, in: Machine Learning, Image Processing, Network Security and Data Sciences, Springer, 2020, pp. 501–512. ISBN 978-981-15-6318-8.

19.

Djiev, Industrial network for communication and control (Ch. 5), Academia, last visited: 7 May 2022, https://www.academia.edu/8865431/Industrial_Networks.

20.

Emerson Electric Co., PACSystems RSTi-EP quick start guide, 2021, Last visited: 12 Sep., 2023, https://emerson-mas.my.site.com/communities/en_US/Documentation/PACSystems-RSTi-EP-EPSCPE115-CPU-Quick-Start-Guide-GFK-3039.

21.

Erdődi,

Kaliyar,

S.H.

Houmb,

Akbarzadeh and

A.J.

Waltoft-Olsen, Attacking power grid substations: An experiment demonstrating how to attack the SCADA protocol IEC 60870-5-104, in: Proc. 17th Int. Conf. Availability, Reliability and Security (AReS), ACM, 2022. ISBN 9781450396707. doi:10.1145/3538969.3544475.

22.

Fuchs,

H.-P.

Schmidt and

Witte, Test and on-line monitoring of real-time ethernet with mixed pysical layer for industry 4.0, in: 2016 IEEE 21st International Conference on Emerging Technologies and Factory Automation (ETFA), IEEE, 2016, pp. 1–4.

23.

Ghaleb,

Zhioua and

Almulhem, On PLC network security, International Journal of Critical Infrastructure Protection 22 (2018), 62–69. doi:10.1016/j.ijcip.2018.05.004.

24.

Ghilardi and

Ranise, MCMT: A model checker modulo theories, in: Proc. Int. Joint Conf. Automat. Reasoning, 2010, pp. 22–29. doi:10.1007/978-3-642-14203-1_3.

25.

Girdler and

V.G.

Vassilakis, Implementing an intrusion detection and prevention system using software-defined networking: Defending against ARP spoofing attacks and blacklisted MAC addresses, Computers and Electrical Engineering J. 90 (2021).

26.

H.Y.

Ibrahim,

P.M.

Ismael,

A.A.

Albabawat and

A.B.

Al-Khalil, A secure mechanism to prevent ARP spoofing and ARP broadcasting in SDN, in: 2020 International Conference on Computer Science and Software Engineering (CSASE), IEEE, 2020, pp. 13–19. doi:10.1109/CSASE48920.2020.9142092.

27.

Jasperneite,

Imtiaz,

Schumacher and

Weber, A proposal for a generic real-time ethernet system, IEEE Transactions on Industrial Informatics 5(2) (2009), 75–85. doi:10.1109/TII.2009.2017259.

28.

Kang,

Maynard,

McLaughlin,

Sezer,

Andrén,

Seitl,

Kupzog and

Strasser, Investigating cyber-physical attacks against IEC 61850 photovoltaic inverter installations, in: 2015 IEEE 20th Conference on Emerging Technologies & Factory Automation (ETFA), IEEE, 2015, pp. 1–8.

29.

N.M.

Karie,

N.M.

Sahri and

Haskell-Dowland, IoT threat detection advances, challenges and future directions, in: 2020 Workshop on Emerging Technologies for Security in IoT (ETSecIoT), 2020, pp. 22–29. doi:10.1109/ETSecIoT50046.2020.00009.

30.

Kaur, Wired LAN and wireless LAN attack detection using signature based and machine learning tools, in: Networking Communication and Data Knowledge Engineering, Springer, Singapore, 2018, pp. 15–24. ISBN 978-981-10-4585-1. doi:10.1007/978-981-10-4585-1_2.

31.

Kaur,

E.G.

Singh and

Khurana, A security approach to prevent ARP poisoning and defensive tools, International Journal of Computer and Communication System Engineering (IJCCSE) 2(3) (2015), 431–437.

32.

Kharitonov and

Zimmermann, WiP: Distributed intrusion detection system for TCP/IP-based connections in industrial environments using self-organizing maps, in: Applied Cryptography and Network Security Workshops, Springer International Publishing, 2021, pp. 231–251. ISBN 978-3-030-81645-2. doi:10.1007/978-3-030-81645-2_14.

33.

K.V.V.N.L.S.

Kiran,

R.N.K.

Devisetty,

N.P.

Kalyan,

Mukundini and

Karthi, Building a intrusion detection system for IoT environment using machine learning techniques, Procedia Computer Science 171 (2020), 2372–2379, https://www.sciencedirect.com/science/article/pii/S1877050920312497 . doi:10.1016/j.procs.2020.04.257.

34.

Kushner, The real story of Stuxnet, IEEE Spectrum (2013), https://spectrum.ieee.org/the-real-story-of-stuxnet.

35.

Lawrence Berkeley National Laboratory, ARPWATCH: ARP spoofing detector, ftp://ftp.ee.lbl.gov/ARPwatch.tar.gz.

36.

Lee,

Kim,

Kim and

P.D.

Yoo, Simulated attack on dnp3 protocol in scada system, in: Proceedings of the 31th Symposium on Cryptography and Information Security, Kagoshima, Japan, 2014, pp. 21–24.

37.

Lootah,

Enck and

McDaniel, TARP: Ticket-based address resolution protocol, Computer Networks 51(15) (2007), 4322–4337. doi:10.1016/j.comnet.2007.05.007.

38.

S.M.

Morsy and

Nashat, D-ARP: An efficient scheme to detect and prevent ARP spoofing, IEEE Access 10 (2022), 49142–49153. doi:10.1109/ACCESS.2022.3172329.

39.

S.Y.

Nam,

Djuraev and

Park, Collaborative approach to mitigating ARP poisoning-based man-in-the-middle attacks, Comput. Netw. 57(18) (2013), 3866–3884. doi:10.1016/j.comnet.2013.09.011.

40.

Neminath,

Biswas,

Roopa,

Ratti,

Nandi,

F.A.

Barbhuiya,

Sur and

Ramachandran, A DES approach to intrusion detection system for ARP spoofing attacks, in: Proc. 18th Mediterranean Conference on Control and Automation, 2010, pp. 695–700. doi:10.1109/MED.2010.5547790.

41.

Niedermaier,

Striegel,

Sauer,

Merli and

Sigl, Efficient intrusion detection on low-performance industrial IoT edge node devices, 2019. doi:10.48550/ARXIV.1908.03964.

42.

OpenPLC, OpenPLC documentation, 2022, Last visited: 5 July 2022, https://openplcproject.com/docs/openplc-overview/.

43.

A.P.

Ortega,

X.E.

Marcos,

L.D.

Chiang and

C.L.

Abad, Preventing ARP cache poisoning attacks: A proof of concept using OpenWrt, in: Network Operations and Management Symposium, 2009. LANOMS 2009. Latin American, IEEE, 2009, pp. 1–9.

44.

R.P.

Parameswarath,

C.Y.

Eugene,

N.V.

Abhishek,

T.J.

Lim and

Sikdar, Detecting selective forwarding using sentinels in clustered IoT networks, in: GLOBECOM 2020 – 2020 IEEE Global Communications Conference, 2020, pp. 1–6. doi:10.1109/GLOBECOM42002.2020.9322295.

45.

D.C.

Plummer, Ethernet address resolution protocol: Or converting network protocol addresses to 48.bit ethernet address for transmission on ethernet hardware, RFC 826, RFC Editor, 1982, https://rfc-editor.org/rfc/rfc826.txt. doi:10.17487/rfc826.

46.

Radoglou-Grammatikis,

Siniosoglou,

Liatifis,

Kourouniadis,

Rompolos and

Sarigiannidis, Implementation and detection of Modbus cyberattacks, in: 2020 9th International Conference on Modern Circuits and Systems Technologies (MOCAST), 2020, pp. 1–4. doi:10.1109/MOCAST49295.2020.9200287.

47.

Rajendran,

R.S.

Ragul Nivash,

P.P.

Parthy and

Balamurugan, Modern security threats in the Internet of Things (IoT): Attacks and countermeasures, in: 2019 International Carnahan Conference on Security Technology (ICCST), 2019, pp. 1–6. doi:10.1109/CCST.2019.8888399.

48.

Rash, Linux Firewalls: Attack Detection and Response with iptables, psad, and fwsnort, No Starch Press, 2007.

49.

N.R.

Rodofile,

Radke and

Foo, Extending the cyber-attack landscape for SCADA-based critical infrastructure, International Journal of Critical Infrastructure Protection 25 (2019), 14–35. doi:10.1016/j.ijcip.2019.01.002.

50.

Schluting, Configure your Catalyst for a more secure layer 2, 2005, Last accessed: Nov. 9, 2022, https://www.enterprisenetworkingplanet.com/security/configure-your-catalyst-for-a-more-secure-layer-2/.

51.

Sharma,

Shamkuwar and

Ramdasi, Digital dimensions of industry 4.0: Opportunities for autonomic computing and applications, in: Autonomic Computing in Cloud Resource Management in Industry 4.0,

Choudhury,

B.K.

Dewangan,

Tomar,

B.K.

Singh,

T.T.

Toe and

N.G.

Nhu, eds, Springer International Publishing, 2021, pp. 347–383. ISBN 978-3-030-71756-8. doi:10.1007/978-3-030-71756-8_19.

52.

P.K.

Sharma and

Tyagi, Improving security through software defined networking (SDN): An SDN based model, IJRTE 8 (2019), 295–300. doi:10.35940/ijrte.D6814.118419.

53.

C.N.

Shivayogimath and

Uma Reddy, Performance analysis of a software defined network using mininet, in: Artificial Intelligence and Evolutionary Computations in Engineering Systems: Proceedings of ICAIECES 2015, Springer, 2016, pp. 391–398. doi:10.1007/978-81-322-2656-7_35.

54.

Siemens, IWLAN – the wireless LAN for demanding industrial applications, Last visited: 5 Sep. 2023, https://www.siemens.com/global/en/products/automation/industrial-communication/industrial-wireless-lan.html.

55.

Song, 2003, http://www.monkey.org/~dugsong/dsniff.

56.

StackExchange, Is there any point of arp spoofing on a wifi network?, Last visited: 5 Sep. 2023, https://security.stackexchange.com/questions/225985/is-there-any-point-of-arp-spoofing-on-a-wifi-network.

57.

StackExchange, ARP spoofing over WLAN, Last visited: 5 Sep. 2023, https://networkengineering.stackexchange.com/questions/60697/arp-spoofing-over-wlan.

58.

StackExchange, ARP poisoning between a wired and wireless network, Last visited: 5 Sep. 2023, https://security.stackexchange.com/questions/41961/arp-poisoning-between-a-wired-and-wireless-network.

59.

Stranahan,

Soni,

Carpenter and

Heydari, SCADA testbed implementation, attacks, and security solutions, in: Advances in Information and Communication, Springer, 2021, pp. 736–755. ISBN 978-3-030-73100-7. doi:10.1007/978-3-030-73100-7_53.

60.

Tetrin, Antidote, 2003, http://online.securityfocus.com/archive/1/299929.

61.

J.D.

Tian,

K.R.B.

Butler,

P.D.

McDaniel and

Krishnaswamy, Securing ARP from the ground up, in: Proceedings of the 5th ACM Conference on Data and Application Security and Privacy, CODASPY ’15, ACM, New York, NY, USA, 2015, pp. 305–312. ISBN 978-1-4503-3191-3. doi:10.1145/2699026.2699123.

62.

Tidrea,

Korodi and

Silea, Cryptographic considerations for automation and SCADA systems using trusted platform modules, MDPI Sensors 19(19) (2019). doi:10.3390/s19194191.

63.

Tramarin and

Vitturi, Strategies and services for energy efficiency in real-time ethernet networks, IEEE Transactions on Industrial Informatics 11(3) (2015), 841–852. doi:10.1109/TII.2015.2426953.

64.

M.V.

Tripunitara and

Dutta, Middle approach to asynchronous and backward-compatible detection and prevention of ARP cache poisoning, Google Patents, 2004, Patent 6,771,649.

65.

Varga and

Hornig, An overview of the OMNET++ simulation environment, in: Proc. 1st Intl. ICST Conf. SIMUTOOLS, 2010. doi:10.4108/ICST.SIMUTOOLS2008.3027.

66.

Voss, Industrial ethernet guide – network topologies, in: A Comprehensible Guide to Industrial Ethernet, Copperhill Technologies, 2019, Online book, last visited: 7 Sep. 2023, https://copperhilltech.com/blog/industrial-ethernet-guide-network-topologies/.

67.

Voss, Industrial ethernet guide – topology and communication features, in: A Comprehensible Guide to Industrial Ethernet, Copperhill Technologies, 2019, Online book, last visited: 7 Sep. 2023, https://copperhilltech.com/blog/industrial-ethernet-guide-topology-and-communication-features/.

68.

Xarp, Advanced ARP spoofing detection, 2011, http://www.xarp.net.

Ensuring cybersecurity for industrial networks: A solution for ARP-based MITM attacks

Abstract

Keywords

Get full access to this article

References