System and method for detecting address resolution protocol (ARP) spoofing

An Address Resolution Protocol (ARP) spoofing attack detection method which is performable by using an ARP spoofing attack detection system, comprising:

• receiving a first ARP packet, and determining whether the received first ARP packet is an unsolicited ARP packet;
• creating, in response to the received first ARP packet being determined as an unsolicited ARP packet, a first ARP pending entry which corresponds to the unsolicited ARP packet and including the created first ARP pending entry in an ARP transaction table, and including unsolicited ARP packet information which includes information relating to the input port of the unsolicited ARP packet in the first ARP pending entry, prior to the creating an ARP request packet;
• creating, in response to the received first ARP packet being determined as an unsolicited ARP packet, the ARP request packet which corresponds to the unsolicited ARP packet, and broadcasting the created ARP request packet;
• receiving an ARP response packet which corresponds to the broadcasted ARP request packet;
• and
• determining whether an input port of the received ARP response packet is identical to an input port of the unsolicited ARP packet, and determining that an ARP spoofing attack has occurred in response to the input port of the ARP response packet being determined as not identical to the input port of the unsolicited ARP packet,
• wherein the determining whether an input port of the received ARP response packet is identical to an input port of the unsolicited ARP packet and determining that an ARP spoofing attack has occurred further comprises:
• searching in the ARP transaction table for a fourth ARP pending entry which corresponds to the received ARP response packet;
• determining whether unsolicited ARP packet information exists in the fourth ARP pending entry which is found as a result of the searching;
• and
• determining whether the input port of the received ARP response packet is identical to the input port of the unsolicited ARP packet, in response to information relating to the input port of the unsolicited ARP packet existing in the fourth ARP pending entry.

A non-transitory computer readable medium having recorded thereon a program executable by a computer for performing an Address Resolution Protocol (ARP) spoofing attack detection method by using an ARP spoofing attack detection system, the method comprising:

• causing the system to receive a first ARP packet, and causing the system to determine whether the received first ARP packet is an unsolicited ARP packet;
• causing the system to create, in response to the received first ARP packet being determined as an unsolicited ARP packet, a first ARP pending entry which corresponds to the unsolicited ARP packet and causing the system to include the created first ARP pending entry in an ARP transaction table, and causing the system to include unsolicited ARP packet information which includes information relating to the input port of the unsolicited ARP packet in the first ARP pending entry, prior to causing the system to create an ARP request packet;
• causing the system to create, in response to the received first ARP packet being determined as an unsolicited ARP packet, the ARP request packet which corresponds to the unsolicited ARP packet, and causing the system to broadcast the created ARP request packet;
• causing the system to receive an ARP response packet which corresponds to the broadcasted ARP request packet;
• and
• causing the system to determine whether an input port of the received ARP response packet is identical to an input port of the unsolicited ARP packet, and causing the system to determine that an ARP spoofing attack has occurred in response to the input port of the ARP response packet being determined as not identical to the input port of the unsolicited ARP packet,
• wherein the causing the system to determine whether an input port of the received ARP response packet is identical to an input port of the unsolicited ARP packet and causing the system to determine that an ARP spoofing attack has occurred further comprises:
• causing the system to search in the ARP transaction table for a fourth ARP pending entry which corresponds to the received ARP response packet;
• causing the system to determine whether unsolicited ARP packet information exists in the fourth ARP pending entry which is found as a result of the search;
• and
• causing the system to determine whether the input port of the received ARP response packet is identical to the input port of the unsolicited ARP packet, in response to information relating to the input port of the unsolicited ARP packet existing in the fourth ARP pending entry.