Implementing an intrusion detection and prevention system using Software-Defined Networking: Defending against ARP spoofing attacks and Blacklisted MAC Addresses

Abstract This work focuses on infiltration methods, such as Address Resolution Protocol (ARP) spoofing, where adversaries sends fabricated ARP messages, linking their Media Access Control (MAC) address to a genuine device’s Internet (IP) address. We developed Software-Defined Networking (SDN)-based Intrusion Detection and Prevention System (IDPS), which defends against spoofing Blacklisted MAC Addresses. is done by dynamically adjusting SDN’s operating parameters detect malicious network traffic. Bespoke software was written conduct the attack tests customise IDPS; this coupled specifically library validate user input. Improvements were made SDN in areas of detection, firewall, intrusion prevention, packet dropping, shorter timeouts. Our extensive experimental results show that solution effective quickly responds attempts. In considered test scenarios, our measured detection mitigation times are sufficiently low (in order few seconds).