ARP spoofing attack detection method and device, computer equipment and storage medium

Abstract

The invention relates to an ARP spoofing detection method and device, computer equipment and a storage medium. The method comprises the steps of obtaining mirror image traffic of each host in a to-be-analyzed local area network; extracting an ARP reply message from the mirror image flow, according to the MAC address and the IP address carried by the ARP reply message, constructing a mapping table of the MAC address and the IP address, and carrying out preliminary detection on the ARP reply message; when the preliminary detection result is abnormal, generating a target feature vector corresponding to the host according to the ARP reply message information; and based on a preset benchmark reference library, performing secondary detection on the target feature vector, and determining whether an ARP spoofing attack exists or not. By adopting the method, the ARP spoofing attack can be accurately captured, ARP spoofing detection of each host in the local area network is achieved, and accurate and comprehensive ARP spoofing detection is achieved.

Description

technical field [0001] The present application relates to the technical field of power monitoring, in particular to an ARP spoofing attack detection method, device, computer equipment and storage medium. Background technique [0002] In the industrial control system of power monitoring, when the hosts in the local area network (or between the host and the gateway) need to communicate, they will use the ARP (Address Resolution Protocol, ARP) protocol to obtain the MAC address corresponding to the target IP address. ARP spoof (ARP spoofing) attacks will occur during the process. ARP spoof attacks send malicious ARP reply (ARP reply) packets to the target host in the LAN, causing the ARP cache entry of the ARP target to be maliciously replaced. In the local area network of the system, ARP spoof attacks will cause abnormal communication between industrial control system equipment, resulting in the failure of the industrial control system to work normally and serious power failur...

AI Technical Summary

Problems solved by technology

[0004] However, the current detection methods and detection tools can only detect the local host being attacked by ARP spoof, and cannot detect the ARP spoof behavior between other hosts in the LAN. Detection methods and detection tools usually only use whether the ARP cache table has been modified as the only judgment logic. Lack of benchmark reference, many misjudgments, and the analysis traffic is small, it does not support one system to detect and monitor multiple LANs, it is impossible to analyze and monitor in a unified way, and there is a problem of detection limitations

Images