A method and system for detecting Address Resolution Protocol (ARP) attacks

Abstract

This disclosure provides an Address Resolution Protocol (ARP) attack detection method and system, comprising: sending probe data packets to key network nodes from a host and calculating the round-trip time; determining whether network behavior is abnormal based on the round-trip time; if so, extracting the mapping relationship; obtaining a legitimate mapping benchmark; determining whether the MAC addresses corresponding to the IP addresses are consistent; if so, continuing periodic probing; otherwise, marking cached entries as suspicious infected entries; constructing and sending ARP request data packets to the network based on the IP addresses corresponding to the suspicious infected entries; receiving the ARP request data packets and performing consistency verification; determining whether the consistency verification result contains ARP spoofing attack behavior; if so, performing overwrite repair and converting the repaired entries into static entries; otherwise, continuing periodic probing; otherwise, sending the probe data packets to the key network nodes.

Description

Technical Field

[0001] This disclosure relates to the field of telecommunications technology, and in particular to a method and system for detecting address resolution protocol attacks. Background Technology

[0002] Address Resolution Protocol (ARP) is the fundamental protocol for mapping IP addresses to MAC addresses in a local area network (LAN). Its working mechanism relies on broadcast requests and unicast responses to dynamically establish communication relationships between network nodes. In a typical Ethernet environment, hosts maintain the mapping between IP addresses and MAC addresses through an ARP cache table to support subsequent data link layer communication.

[0003] With the expansion of network scale and the continuous evolution of attack methods, ARP spoofing (ARP spoofing / ARPPoisoning) has become one of the most common and highly dangerous man-in-the-middle attacks in local area networks (LANs). Attackers forge ARP responses to bind their own MAC address to a legitimate IP address, thereby hijacking data traffic, eavesdropping on sessions, and even tampering with data, seriously threatening the confidentiality and integrity of network communications. Therefore, developing a detection method that can accurately identify abnormal ARP behavior and promptly detect and block ARP attacks is of great significance for improving overall network security capabilities, ensuring the trustworthiness of communication links, and achieving proactive defense.

[0004] Existing ARP attack detection methods mainly include static binding-based protection, single-comparison-based detection mechanisms, and traffic feature analysis-based intrusion detection methods. However, these methods generally have certain limitations, leading to false positives or false negatives. They are also difficult to deal with short-term, sudden, or intermittent ARP poisoning attacks and cannot effectively verify the authenticity of suspicious ARP responses. Therefore, the accuracy and stability of detection in complex network environments still need to be improved. Summary of the Invention

[0005] This disclosure provides a method and system for detecting Address Resolution Protocol (ARP) attacks, which at least solves the above-mentioned technical problems existing in the prior art.

[0006] According to a first aspect of this disclosure, a method for detecting address resolution protocol attacks is provided, comprising: S1: Send probe packets to key network nodes from the host and calculate the round-trip time of the probe packets; S2: Based on the round-trip time, determine whether there is any abnormality in network behavior; if so, proceed to step S3; otherwise, send probe data packets to key network nodes according to the preset cycle and update the round-trip time. S3: Extract the mapping relationship between dynamic IP addresses and MAC addresses from the Local Address Resolution Protocol cache table; S4: Obtain a valid mapping baseline; S5: Based on the mapping relationship and the legal mapping benchmark, determine whether the dynamic IP address and the MAC address are consistent; if yes, return to step S1 to continue periodic detection; otherwise, mark the cache entry corresponding to the dynamic IP address as a suspected infected entry. S6: Based on the dynamic IP address corresponding to the suspected infected entry, construct and send an Address Resolution Protocol (ARP) request data packet with a unique signature to the network; S7: Receive Address Resolution Protocol (ARP) request packets and perform consistency verification on the response packets returned by the target IP address; S8: Based on the consistency verification results, determine whether there is an address resolution protocol spoofing attack; if so, overwrite and repair the suspicious infected entries using the corresponding MAC address in the legitimate mapping benchmark, and convert the repaired entries into static entries; otherwise, return to step S1 to continue periodic probing.

[0007] According to a second aspect of this disclosure, an address resolution protocol attack detection system is provided, comprising: Processor and memory; The memory stores programs or instructions that can run on the processor, and when the program or instructions are executed by the processor, they implement the steps of the address resolution protocol attack detection method as described in the first aspect.

[0008] Compared with existing technologies, the address resolution protocol attack detection method and system disclosed herein have the following beneficial effects: This solution introduces a network behavior anomaly detection mechanism based on the round-trip time of probe packets on the host side to pre-screen abnormal communication paths, thereby avoiding full inspection of all ARP entries and reducing system overhead. Furthermore, it compares the dynamic mapping relationships in the local ARP cache with the legitimate mapping benchmark provided by the DHCP server to achieve a preliminary consistency determination of IP-MAC binding relationships, and focuses on potential risk targets by marking suspicious poisoned entries. Based on this, it constructs extended ARP request packets with unique signatures and establishes request-response state binding relationships to achieve proactive verification of target nodes, thus overcoming the stateless and easily forged defects of the traditional ARP protocol. Simultaneously, it performs consistency verification on the MAC address and identification parameters in the response packet to achieve multi-dimensional verification of the response's authenticity. Finally, it determines whether an ARP spoofing attack exists by comprehensively verifying the consistency verification results. When an attack is detected, it uses the legitimate mapping benchmark to overwrite and repair poisoned entries and solidify them as static entries, thereby achieving a closed-loop protection effect from anomaly detection, attack confirmation to automatic repair, significantly improving the accuracy, real-time performance, and system robustness of ARP attack detection.

[0009] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0010] The above and other objects, features, and advantages of this disclosure will become readily apparent from the following detailed description of exemplary embodiments, taken in conjunction with the accompanying drawings. Several embodiments of this disclosure are illustrated in the drawings by way of example and not limitation, in which: In the accompanying drawings, the same or corresponding reference numerals indicate the same or corresponding parts.

[0011] Figure 1 A schematic diagram illustrating the implementation flow of an address resolution protocol attack detection method according to an embodiment of this disclosure is shown. Figure 2 A schematic diagram of the composition structure of an address resolution protocol attack detection system according to an embodiment of the present disclosure is shown. Detailed Implementation

[0012] To make the objectives, features, and advantages of this disclosure more apparent and understandable, the technical solutions in the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this disclosure, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this disclosure without creative effort are within the scope of protection of this disclosure.

[0013] Reference manual attached Figure 1 The diagram illustrates the implementation flow of the address resolution protocol attack detection method provided in this embodiment of the invention.

[0014] This invention provides a method for detecting Address Resolution Protocol (ARP) attacks, including: S1: Send probe packets to key network nodes from the host and calculate the round-trip time of the probe packets.

[0015] In this context, "host" refers to the terminal device that initiates network communication and detection activities. "Critical network node" typically refers to the core forwarding or control node in the network, generally the default gateway or routing device. "Probe packet" refers to a test message (such as ICMP or a custom message) actively constructed and sent by the host to detect network status. "Round Trip Time" (RTT) refers to the total time it takes for the probe packet to travel from the host to the critical network node and back to the host, reflecting the latency characteristics and stability of the current communication path.

[0016] It should be noted that by actively sending probe data packets and calculating round-trip time in real time, a lightweight perception of the network communication path status can be achieved. This allows for the rapid acquisition of preliminary signals of abnormal network fluctuations without relying on complex traffic analysis. It has the advantages of simple implementation, low overhead, and fast response speed. At the same time, it provides a reliable triggering basis for subsequent ARP attack detection, effectively avoiding the waste of resources caused by indiscriminate detection.

[0017] S2: Based on the round-trip time, determine if there are any anomalies in network behavior. If so, proceed to step S3. Otherwise, send probe packets to key network nodes at a preset period and update the round-trip time.

[0018] Among these, abnormal network behavior refers to a significant deviation in the latency characteristics of the current communication path compared to historical normal conditions, such as sudden increases or abnormal fluctuations in latency. The preset period refers to a fixed time interval pre-set by the system for periodically sending probe data packets to continuously monitor the network status.

[0019] Specifically, those skilled in the art can set the size of the preset cycle according to actual needs, and the present invention does not limit this.

[0020] In one possible implementation, S2 specifically includes: S201: Calculate the historical time distribution by combining historical round-trip time data.

[0021] Historical round-trip time data refers to the set of round-trip times of probe data packets recorded within multiple historical sampling periods.

[0022] Specifically, the historical time distribution includes the maximum and expected values ​​of historical round-trip times.

[0023] S202: Calculate the communication path offset intensity based on the round-trip time and historical time distribution.

[0024] Among them, the communication path offset intensity is a dimensionless indicator used to quantify the degree of deviation of the current round-trip time from the historical normal level. Its essence is the normalized time delay deviation.

[0025] Specifically, the path offset intensity is calculated as follows: the difference between the round-trip time and the average of the historical round-trip times is taken as the path offset, and the maximum historical round-trip time is taken as the normalization benchmark. The offset is then standardized to obtain a dimensionless index that reflects the degree of offset of the current communication path relative to the normal path.

[0026] S203: Determine the cumulative path offset over multiple sampling periods based on the communication path offset strength.

[0027] Among them, the cumulative path offset refers to the time-dimensional statistics obtained by superimposing the offset intensity over multiple consecutive sampling periods, which is used to reflect the persistence of the anomaly.

[0028] Specifically, the current path offset intensity value is first obtained in each sampling period. Then, within a preset cumulative window length, the offset intensity of each period within that time window is summed or weighted summed to obtain the cumulative path offset at the corresponding time. This cumulative amount not only reflects the magnitude of a single offset but also comprehensively reflects the duration and evolution trend of the anomaly, providing a temporally continuous quantitative basis for subsequent anomaly determination.

[0029] S204: Construct an adaptive anomaly detection function based on the cumulative path offset.

[0030] Specifically, firstly, statistical analysis is performed on the cumulative path offset over multiple historical sampling periods to obtain the historical mean, historical extreme values, and fluctuation ranges. Then, based on the historical mean, historical extreme values, and the cumulative path offset corresponding to the current sampling period, a dynamic anomaly threshold is generated. Finally, using the dynamic anomaly threshold as the judgment boundary, a piecewise anomaly judgment function is constructed regarding the cumulative path offset, such that when the cumulative path offset is lower than the dynamic anomaly threshold, a normal state is output, and when the cumulative path offset is consistently higher than the dynamic anomaly threshold, an anomaly state is output.

[0031] S205: Using the adaptive anomaly detection function, determine if there are any anomalies in network behavior. If so, proceed to step S3. Otherwise, send probe packets to critical network nodes according to a preset period and update the round-trip time.

[0032] Specifically, the cumulative path offset is compared with a dynamic threshold calculated based on the historical round-trip time distribution. When the cumulative path offset continuously exceeds the dynamic threshold, it is determined that the current communication path is abnormal; otherwise, it is determined to be in a normal state, thereby achieving adaptive identification of abnormal network behavior.

[0033] It should be noted that by introducing historical statistical distribution, offset intensity normalization, and multi-period accumulation mechanisms, the discrete judgment based on a single round-trip time is transformed into a continuous judgment process based on time series, thereby effectively improving the stability and robustness of anomaly identification. At the same time, by constructing an adaptive anomaly judgment function and dynamic threshold, the system can automatically adjust the judgment criteria according to changes in the network environment, avoiding the misjudgment problem caused by fixed thresholds, further enhancing the ability to distinguish between short-term fluctuations and continuous anomalies. While ensuring detection sensitivity, the false alarm rate is significantly reduced, improving the overall accuracy and engineering applicability of network anomaly detection.

[0034] S3: Extract the mapping relationship between dynamic IP addresses and MAC addresses from the Local Address Resolution Protocol (Local Address Resolution Protocol) cache table.

[0035] The Local Address Resolution Protocol (ARP) cache table is a temporary table in the host operating system used to store the mapping between IP addresses and MAC addresses. The mapping relationship refers to the time-sensitive IP-MAC binding relationship automatically learned and generated by the ARP protocol; these entries are typically updated or expire automatically over time or due to network changes.

[0036] Specifically, an IP address is a logical address in the network layer, used to uniquely identify the location of a device across different networks, essentially acting as a "communication ID" for the device within the network. It is assigned and resolved by network devices such as routers based on the network topology, primarily used for addressing and forwarding data between different networks, such as the common IPv4 address "192.168.1.1". IP addresses are variable and may change under different network environments. A MAC address is a physical address in the data link layer, fixed at the factory by the network interface card (NIC). It is generally a globally unique hardware identifier used to uniquely identify a device within the same local area network (LAN), acting as a "hardware ID card" for the device. MAC addresses are typically represented as 6 bytes of hexadecimal numbers, such as "00:1A:2B:3C:4D:5E", and are used in LAN communication to pinpoint the actual transmission location of data frames.

[0037] It should be noted that by directly utilizing the dynamic mapping data in the host's local ARP cache, the actual communication relationships in the current network can be quickly obtained without additional network scanning or complex data collection. This has the advantages of low overhead and strong real-time performance. At the same time, since it focuses on dynamic entries, which are more susceptible to attacks, the subsequent detection process is more targeted, effectively improving the efficiency and accuracy of ARP attack identification.

[0038] S4: Obtain a valid mapping baseline.

[0039] Among them, the legitimate mapping benchmark refers to the authoritative reference data set used to determine whether an IP address and a MAC address match.

[0040] In one possible implementation, S4 specifically refers to: Send a query request to the DHCP server in the network to obtain the currently valid address lease records, and use the address lease records as the legal mapping basis for binding legitimate IP addresses and MAC addresses in the network.

[0041] The DHCP server is a network service node responsible for dynamically assigning IP addresses to devices in the network and maintaining IP-MAC binding relationships. Address lease records are the allocation records of currently valid IP addresses and their corresponding MAC addresses stored in the DHCP server; these records reflect the legitimate identity binding relationships of devices in the network.

[0042] It should be noted that by obtaining real and valid address lease records from the DHCP server, an authoritative IP-MAC legitimate mapping benchmark is constructed, thereby providing a reliable reference for subsequent ARP cache consistency determination. This avoids the inaccuracies that may result from relying solely on local cache, significantly improving the reliability and accuracy of detection. At the same time, this method can dynamically reflect the real-time changes of devices in the network, making the detection mechanism highly adaptable and valuable for practical engineering applications.

[0043] S5: Combining the mapping relationship and the valid mapping benchmark, determine whether the dynamic IP address and the MAC address are consistent. If yes, return to step S1 to continue periodic probing. Otherwise, mark the cache entry corresponding to the dynamic IP address as a suspected infected entry.

[0044] Here, a cached entry refers to a specific record in the ARP cache table. A suspected poisoned entry refers to a cached record found to have inconsistent IP-MAC mappings during the comparison process, indicating a risk of tampering.

[0045] In one possible implementation, S5 specifically includes: S501: Extract dynamic entries from the Local Address Resolution Protocol cache table.

[0046] Dynamic entries refer to IP-MAC mapping records in the ARP cache table that are automatically learned and generated by network communication, have timeliness, and can be updated or replaced.

[0047] S502: Based on the dynamic entries, establish a candidate set of local dynamic mappings to be determined.

[0048] The local dynamic mapping candidate set is a set of data to be detected formed by structuring all dynamic entries according to IP address, MAC address and additional attributes.

[0049] Specifically, firstly, all entries of dynamic types are extracted from the local address resolution protocol cache table. Then, for each dynamic entry, its corresponding IP address, the currently mapped MAC address, and associated additional attribute information are extracted. Finally, each dynamic entry is represented as an element consisting of an IP address, a MAC address, and its additional attributes, and all such elements are organized into a set to construct a candidate set of local dynamic mappings to be judged, which is used for subsequent consistency analysis and poisoning determination.

[0050] S503: Construct a valid mapping reference set based on the address lease records returned by the DHCP server.

[0051] Among them, the legitimate mapping reference set is an authoritative IP-MAC mapping set extracted and organized from valid lease records.

[0052] Specifically, the system first obtains currently valid address lease records from the DHCP server, and then extracts the corresponding IP address and MAC address from each valid lease record. Next, the lease records are filtered for validity, retaining only those records that meet the validity criteria. Finally, each filtered pair of IP addresses and MAC addresses is combined according to their correspondence and organized into a set to construct a valid mapping reference set, which serves as the benchmark for subsequent mapping consistency determination.

[0053] S504: Calculate the consistency coefficient of a single mapping by combining the local dynamic mapping candidate set and the legal mapping reference set.

[0054] in, Indicates the first t In the sampling period, the first i The consistency coefficient of a single mapping of an IP address. Indicates the first t The sampling period, the first local address resolution protocol cache table i Each IP address corresponds to a MAC address; ARP stands for Address Resolution Protocol. This indicates the first record of the DHCP server.i The MAC address corresponding to each IP address.

[0055] Specifically, the consistency coefficient is used to quantify the degree of matching between local ARP mappings and legitimate DHCP mappings. A consistency coefficient of 1 indicates complete consistency, while a consistency coefficient of 0 indicates complete inconsistency, thus providing a quantitative basis for subsequent mapping mismatch accumulation and attack judgment.

[0056] S505: Over multiple sampling periods, the mapping inconsistencies of the same IP address are accumulated by combining the single mapping consistency coefficient to obtain the cumulative mapping mismatch.

[0057] Among them, the cumulative mapping mismatch refers to the time-dimensional statistic obtained by summing the degree of mapping inconsistency over multiple sampling periods.

[0058] Specifically, the cumulative mapping mismatch is calculated as follows: For the same IP address within multiple consecutive sampling periods, firstly, the consistency coefficient between its current mapping relationship and the valid mapping benchmark is calculated in each sampling period. Then, the result of "subtracting the consistency coefficient from one" is taken as the mapping mismatch degree for that sampling period. Finally, the mapping mismatch degrees in all sampling periods are summed to obtain the overall cumulative mapping mismatch of the IP address across multiple sampling periods.

[0059] S506: Calculate the suspected poisoning determination factor based on the cumulative amount of mapping mismatch and the attributes of dynamic entries.

[0060] Among them, the suspected poisoning judgment factor is a comprehensive risk index calculated by combining the degree of mapping mismatch and the item attributes, which is used to measure the possibility that a certain IP address is attacked by ARP.

[0061] Specifically, the calculation method for the suspected poisoning determination factor is as follows: First, obtain the cumulative mapping mismatch of the target IP address over multiple sampling periods, and normalize this cumulative amount by dividing it by the total number of sampling periods to obtain the average mapping mismatch degree. Then, combine the attribute identifier of the cache entry corresponding to the IP address. If the entry is a dynamic entry, the corresponding identifier value is used in the calculation; otherwise, it is not used. Finally, multiply the dynamic attribute identifier by the normalized average mapping mismatch degree to obtain the suspected poisoning determination factor corresponding to the IP address.

[0062] S507: Based on the suspected infection determination factor, determine whether the dynamic IP address and MAC address are consistent. If yes, return to step S1 to continue periodic probing. Otherwise, mark the cache entry corresponding to the dynamic IP address as a suspected infection entry.

[0063] Specifically, unlike the traditional approach that relies solely on a single comparison of IP and MAC addresses in the ARP cache, this method first constructs a dual-source data model of local dynamic mapping and DHCP legitimate mapping. Based on this, a consistency coefficient is introduced to quantify the mapping relationship. Furthermore, the accumulated mismatches over multiple sampling periods are used to statistically fuse mapping anomalies over a time dimension, transforming the original "single hard judgment" into a "multi-dimensional continuous judgment." This approach effectively suppresses false positives caused by network jitter, cache refresh, or legitimate lease changes, improving the stability and accuracy of detection. Simultaneously, by targeting dynamic entries, the detection process focuses more intently on vulnerable targets, making it more suitable for network security scenarios like Address Resolution Protocol (ARP) attacks, which are characterized by short-term bursts and persistent concealment.

[0064] It should be noted that this sub-step represents a significant structural improvement over the traditional approach of simply comparing ARP cache entries with IP-MAC mappings in a single instance. First, by constructing a dual-source data model of "local dynamic ARP mapping + DHCP legitimate mapping" and introducing an authoritative benchmark, the judgment basis is upgraded from a single source to multi-source cross-validation, enhancing reliability. Second, by defining a mapping consistency coefficient and accumulating mismatches over multiple sampling periods, the original "instantaneous hard judgment" is transformed into "continuous statistical judgment over time," effectively avoiding misjudgments caused by network jitter, ARP cache refresh, or changes in legitimate leases. Third, by introducing a suspicious poisoning judgment factor, the degree of mapping anomaly is integrated with entry attributes, enabling quantitative risk assessment and upgrading the detection results from simple consistency / inconsistency to measurable risk assessment. Finally, by screening only dynamic entries, the detection process focuses more on objects vulnerable to ARP attacks, thereby reducing computational overhead while maintaining detection accuracy. Overall, this significantly improves detection accuracy, stability, and engineering usability.

[0065] S6: Based on the dynamic IP address corresponding to the suspected infected entry, construct and send an Address Resolution Protocol (ARP) request packet with a unique signature to the network.

[0066] The unique signature refers to an encrypted or hashed identifier with unique characteristics generated based on the target IP address, a valid MAC address, and relevant status parameters, used to ensure a one-to-one correspondence between the request and the response. The Address Resolution Protocol (ARP) request packet is used to query the MAC address corresponding to the target IP address.

[0067] It should be noted that by introducing a unique signature mechanism into ARP requests, the traditional stateless ARP communication process is transformed into an active verification process with state binding capabilities. This enables each request to be accurately associated with the corresponding response, thereby effectively preventing attackers from forging responses or inserting interfering data and improving the ability to identify ARP spoofing behavior.

[0068] In one possible implementation, S6 specifically includes: S601: Combine the IP address corresponding to the suspected poisoning entry, the suspected poisoning judgment factor, and the cumulative path offset to construct the state coupling parameter set of the target to be verified.

[0069] Among them, the state coupling parameter set refers to the parameter set formed by uniformly organizing the multi-dimensional state information of the target IP address (including path offset accumulation, suspected poisoning judgment factor, etc.).

[0070] Specifically, for the target IP address that has been marked as suspiciously infected in the previous steps, the key status information corresponding to the IP address is first extracted, including its current IP address identifier, the suspicious infection judgment factor obtained based on multi-cycle consistency analysis, and the cumulative path offset obtained from network behavior analysis. Then, the above parameters are integrated and encoded according to a unified data structure to form a multi-dimensional status description set containing "address information, mapping anomaly degree, and path anomaly degree", that is, the status coupling parameter set.

[0071] S602: Define the basic unique signature seed of the target to be verified.

[0072] The basic unique signature seed refers to the initial random or basic identifier value used to generate the final signature.

[0073] S603: Based on the fundamental unique signature seed, key parameters from the state coupling parameter set are integrated into the signature construction process to form a state-coupled unique signature.

[0074] in, K i Indicates the first i A unique signature is generated for each IP address, with SHA256 representing the hash function. This indicates the target IP address to be verified. Indicates the communication path offset strength weighting coefficient. Indicates the first i Communication path offset strength corresponding to each IP address This represents the weighting coefficient of the suspected poisoning determination factor. Indicates the first iSuspicious poisoning detection factors for each IP address Indicates that for the first i An initial signature generated from an IP address (based solely on an initial signature generated from a random number or a basic algorithm). Symbols indicating splicing.

[0075] Specifically, this formula constructs a unique signature with state awareness by fusing and encoding the target IP address, legitimate MAC mapping, communication path anomaly level, and ARP mapping anomaly level. This enables dynamic binding and authenticity verification between ARP requests and responses, significantly improving the detection capability of ARP spoofing attacks.

[0076] S604: Combining state-coupled unique signatures to construct Extended Address Resolution Protocol (ARP) request packets:

[0077] in, Indicates the first i Each IP address corresponds to an Extended Address Resolution Protocol (EIP) request packet. Indicates the IP address of the source host. Indicates the MAC address of the source host. This represents the security verification value after the signature is encrypted or signed.

[0078] The Extended Address Resolution Protocol Request (ARP) packet is an enhanced message that adds a signature field and a checksum field to the standard ARP request.

[0079] The Extended Address Resolution Protocol (ARP) request packet establishes a one-to-one mapping between requests and responses, thereby transforming traditional stateless ARP communication into a verifiable stateful communication process. Compared to traditional ARP requests, this ARP request packet adds a state-coupled unique signature field and a signature verification field, enabling subsequent responses to be verified not only for "whether there was a reply" but also for "whether the reply corresponds to the current exception context."

[0080] S605: Based on the path anomaly level of the target entry and the suspected poisoning judgment factor, adaptively determine the sending strength of the Extended Address Resolution Protocol (ARP) request data packet.

[0081] Sending strength refers to the number of times an ARP request is sent to the same target IP address.

[0082] Specifically, the adaptive determination method for transmission strength is as follows: Given a base transmission count of 1, the path offset strength of the target entry and the suspected poisoning judgment factor are multiplied by their respective weighting coefficients, then weighted and summed. The weighted result is rounded down, and finally, 1 is added to it to obtain the transmission count of the Extended Address Resolution Protocol (ARP) request data packet. Here, the path offset strength reflects the degree of communication path anomaly, and the suspected poisoning judgment factor reflects the degree of ARP mapping anomaly. The adaptive adjustment of transmission strength is achieved through the weighted fusion of these two factors, ensuring that a higher degree of anomaly corresponds to a greater transmission strength.

[0083] S606: Determine the transmission interval between adjacent Extended Address Resolution Protocol (EPRP) request packets based on the transmission strength.

[0084] The sending interval refers to the time interval between adjacent request data packets.

[0085] Specifically, the transmission rhythm can be dynamically adjusted based on the transmission intensity. When the transmission intensity is high, the time interval between adjacent data packets is appropriately shortened to increase the verification density, while when the transmission intensity is low, a longer interval is used to reduce network load. Simultaneously, by combining a fixed time window or a maximum transmission period constraint, the transmission times of each request can be evenly or weighted to generate an ordered transmission time sequence. Extended ARP request data packets are then sent sequentially according to this time sequence, achieving adaptive transmission control that satisfies both detection accuracy requirements and network resource consumption.

[0086] S607: Based on the transmission strength and transmission interval, construct a corresponding number of Extended Address Resolution Protocol (ERP) request packets with state-coupled unique signatures, and send the ERP request packets to the network according to the transmission interval.

[0087] Specifically, S607 differs from the traditional single ARP request sending method. Instead of "one request, one wait," it adaptively repeats active verification based on the degree of anomaly, thereby improving the ability to identify short-term forged responses and intermittent poisoning behavior.

[0088] It's worth noting that this step significantly improves the proactiveness and anti-attack capability of detection compared to the traditional method of sending only one ARP request and passively waiting for a response. First, by introducing a state-coupled unique signature, the anomaly level of the communication path and the anomaly level of the ARP mapping are embedded in the request, achieving a strong binding relationship between the request and response, making it difficult for attackers to forge matching response data. Second, by constructing extended ARP packets, detection goes beyond simply checking for a response; it verifies whether the response is genuine and consistent with the current anomalous context, thereby improving identification accuracy. Third, by adaptively adjusting the sending strength and interval based on the anomaly level, it shifts from single-probing to multiple dynamic verifications, effectively improving the detection capability for short-term forged responses and intermittent ARP poisoning. Overall, this method transforms passive detection into active verification, and upgrades from single-dimensional judgment to multi-dimensional state fusion judgment, outperforming traditional methods in terms of accuracy, robustness, and adaptability to complex attack scenarios.

[0089] In one possible implementation, the process after S6 and before S7 includes: Record the correspondence between Address Resolution Protocol (ARP) request packets and unique signatures to establish a request-response state binding relationship.

[0090] The request-response state binding relationship refers to the fact that through this correspondence, subsequent received ARP response packets can be matched with a specific request, thereby forming a traceable and verifiable communication association.

[0091] It should be noted that by establishing a binding relationship between the request data packet and the unique signature during the request sending phase, subsequent response verification has a clear reference basis, thereby realizing stateful management of the ARP communication process. Compared with the traditional stateless ARP interaction method, it can effectively prevent attackers from forging or inserting irrelevant responses, improve the accuracy and reliability of response matching, and provide basic support for conflict analysis and authenticity determination in multi-response environments, significantly enhancing the rigor and anti-interference capability of the overall detection process.

[0092] S7: Receive Address Resolution Protocol (ARP) request packets and perform consistency verification on the response packets returned by the target IP address.

[0093] The target IP address refers to the IP address corresponding to the suspected infected entry that requires further verification. The response packet refers to the ARP response message returned by a node in the network in response to the ARP request, which contains the MAC address information of the corresponding IP address. Consistency verification involves comparing and analyzing key fields (such as MAC address and signature identifier) ​​in the response packet to determine whether the response matches the request and conforms to a legitimate mapping relationship, thereby assessing its authenticity and reliability.

[0094] In one possible implementation, consistency checks are performed on the MAC address and on the identifier parameters.

[0095] It's important to note that by simultaneously verifying the consistency of both the MAC address and the identifier parameter, the traditional detection mechanism, which relies solely on MAC address comparison, is expanded into a multi-dimensional joint verification. This not only determines whether the response data "appears correct" but also verifies whether it matches a specific request context, effectively preventing attackers from spoofing legitimate MAC addresses. Furthermore, the introduction of the identifier parameter strengthens the binding relationship between the request and response, giving the detection process stronger anti-spoofing and anti-interference capabilities, significantly improving the accuracy and reliability of ARP attack identification.

[0096] In one possible implementation, S7 specifically includes: S701: Receives Address Resolution Protocol (ARP) request packets and builds a response observation window for the target IP address, starting from the time of transmission.

[0097] The response observation window refers to the time interval used to receive relevant ARP response data packets within a certain time range, starting from the time the ARP request is sent.

[0098] Specifically, after the host completes the transmission of the Extended Address Resolution Protocol (ARP) request data packet, the transmission time of the request data packet is recorded. Using this time as a time reference point, a time window of a preset duration is initialized for the corresponding target IP address. Subsequently, within this time window, ARP response data packets returned in the network are continuously monitored. All responses within this time range that are related to the target IP address are included in the observation range, thereby forming a response collection interval corresponding to this request, providing a time boundary and data foundation for subsequent multi-response analysis and consistency verification.

[0099] S702: Within the response observation window, receive multiple ARP response packets returned for the target IP address.

[0100] S703: Determine the candidate response set based on each ARP response packet and the request-response state binding relationship.

[0101] The candidate response set refers to the set of ARP response packets received within the time window that satisfy the request-response state binding relationship.

[0102] Specifically, after receiving multiple ARP response packets in the response observation window, the identification information (such as unique signatures or associated identifiers) carried in each response packet is first parsed one by one. Then, based on the request-response state binding relationship established in the previous steps, these response packets are matched and filtered. Specifically, only those response packets that correspond to the current request packet in terms of identification parameters and satisfy the binding relationship constraints are retained and uniformly collected into a candidate response set. Response packets that cannot be matched or do not satisfy the binding relationship are removed, thereby ensuring that subsequent analysis is based only on valid response data that is truly associated with the current request.

[0103] S704: Perform two-layer field parsing on each ARP response packet in the candidate response set.

[0104] Two-layer field parsing refers to parsing the ARP response from multiple layers, including the Ethernet frame layer (MAC header), the ARP payload layer (protocol fields), the identification layer (unique signature), and the time layer (response timing).

[0105] Specifically, this sub-step expands the traditional method of extracting only the "MAC value in the ARP response" into a four-dimensional parsing method involving the frame layer, payload layer, identifier layer, and time layer.

[0106] S705: Calculate the single-response structural consistency coefficient by combining the results of the two-level field parsing:

[0107] in, Indicates the first i The target IP address is in the... j Consistency coefficient of single response structure under a single ARP response packet Indicates an indicator function, Indicates the first i The first target IP address j A unique identifier carried in each ARP response packet. Indicates that for the first i The target IP address, in the... j The first ARP response packet j ARP response data packet, Indicates that for the first i The target IP address, in the... j The sender's MAC address extracted from the ARP payload of an ARP response packet. Indicates that for the first i The target IP address, in the... j The destination MAC address extracted from the Ethernet frame header of an ARP response packet. Indicates that for the first i The target IP address, in the... j The target MAC address extracted from the ARP payload of an ARP response packet. This indicates that the results of the four consistency checks have been averaged.

[0108] in, K i In other words, the state-coupled unique signature is a unique signature corresponding to the target IP address obtained through the request-response state binding relationship.

[0109] Specifically, this formula constructs a response consistency coefficient by comprehensively quantifying ARP response identifier matching, frame-layer and payload-layer MAC consistency, and DHCP legitimate mapping consistency, thereby achieving a multi-dimensional determination of the authenticity of ARP responses. This step is significantly different from the traditional approach that only performs a single quantification. Instead of comparing methods, it combines state binding verification, frame structure verification, and legal mapping verification into a single response-level metric.

[0110] S706: Based on response interference, compare all ARP response packets within the response observation window to determine the number of multi-response collisions.

[0111] in, Indicates the first i Multiple response collisions targeting a single IP address n This indicates that within the current testing cycle, for the [number]th [item / item]... i The total number of ARP responses received by the target IP. Indicates the first i The first target IP address k A unique identifier carried in each ARP response packet. Indicates that for the first i The target IP address, in the... k The sender's MAC address extracted from the ARP payload of an ARP response packet.

[0112] Specifically, when counting multiple response conflicts, only response packets that satisfy the request-response state binding relationship are compared.

[0113] This formula compares multiple response packets corresponding to the same request pairwise, counts the conflicts between different MAC addresses under the condition of matching identifiers, and thus quantifies the degree of ARP response conflict of the target IP address, which is used to identify Address Resolution Protocol spoofing attacks.

[0114] S707: Calculate the response timing effectiveness factor for each ARP response packet.

[0115] Among them, the response timing effectiveness factor is a weighted parameter that reflects the rationality of the response arrival time relative to the request sending time.

[0116] Specifically, firstly, the sending time of the Extended Address Resolution Protocol (ARP) request packet and the receiving time of the corresponding ARP response packet are obtained, and the time difference between the two is calculated. Then, this time difference is normalized with a preset time scale parameter. Finally, the negative value of the normalized result is taken and substituted into an exponential function for decay calculation, thereby obtaining the effective response timing factor of the ARP response packet. The closer the response time is to the request sending time, the closer the factor is to 1; the greater the response delay, the closer the factor is to 0.

[0117] S708: Combining the single-response structural consistency coefficient, multi-response conflict quantity, and response timing effective factor, determine the response consistency judgment quantity:

[0118] in, Indicates the first i Consistency determination of responses to a target IP address Indicates the first i The target IP address corresponding to the first j The response timing validity factor of each ARP response packet. This represents the conflict penalty coefficient.

[0119] The formula selects the response with the best structural consistency and timing validity from all response packets and applies penalties based on the degree of response conflict, thereby constructing a comprehensive consistency metric for the target IP address, which is used to accurately identify Address Resolution Protocol (ARP) attacks.

[0120] S709: Verify the consistency of the response data packets returned by the target IP address based on the response consistency determination quantity.

[0121] Specifically, when the response consistency determination value is within a preset grayscale range, the response is marked as an uncertain response, and repeated probing or increased transmission strength of Extended Address Resolution Protocol (ARP) request packets is triggered for secondary verification. When the response consistency determination value is lower than the determination threshold for multiple consecutive detection periods, the target IP address is determined to be in a continuous abnormal state, and this state is used as an input condition for subsequent attack determination. When the response packet does not satisfy the request-response state binding relationship, it is marked as an abnormal response and removed.

[0122] It's important to note that this step represents a significant upgrade from "single-dimensional static judgment" to "multi-dimensional dynamic comprehensive judgment" compared to the traditional method of simply comparing MAC addresses in ARP responses. First, by constructing a response observation window and receiving multiple response packets, detection no longer relies on a single response, thus enhancing adaptability to complex network environments. Second, by introducing a multi-dimensional parsing mechanism at the frame, payload, identifier, and temporal layers, comprehensive verification of the ARP response structure and context consistency is achieved. Third, by defining a single-response structure consistency coefficient, multi-response conflict quantity, and effective response timing factor, and performing fusion calculations, a unified response consistency judgment metric is constructed, making the detection results more refined and quantifiable. Furthermore, by explicitly modeling multi-response conflicts, the common "multi-source forgery" behavior in ARP spoofing is effectively identified. Finally, through grayscale intervals and multi-period judgment mechanisms, robust handling of boundary conditions is achieved, avoiding misjudgments. Overall, this method transforms passive reception and simple comparison into active analysis and multi-dimensional fusion judgment, significantly outperforming traditional methods in terms of detection accuracy, robustness, and ability to identify complex attack scenarios.

[0123] S8: Based on the consistency verification results, determine whether there is an address resolution protocol spoofing attack. If so, overwrite and repair the suspicious infected entries using the corresponding MAC address in the legitimate mapping benchmark, and convert the repaired entries into static entries; otherwise, return to step S1 to continue periodic probing.

[0124] Address Resolution Protocol (ARP) spoofing attacks refer to network attacks where attackers forge ARP responses to tamper with the mapping between IP addresses and MAC addresses. Static entries are mapping records that are manually or automatically written to the ARP cache and are not updated automatically.

[0125] It should be noted that by introducing an automatic repair and state recovery mechanism after the detection is completed, a closed-loop process from "attack identification" to "proactive protection" is realized. Compared with the traditional method of only alarming or passively recording, it can immediately use authoritative mapping to repair the poisoned entries when an ARP spoofing attack is detected, and prevent them from being tampered with again by converting them into static entries, thereby significantly improving the security and stability of the network.

[0126] In one possible implementation, S8 specifically includes: S801: Combine the response consistency judgment quantity to define the poisoning repair priority index.

[0127] Among them, the poisoning repair priority index is a risk quantification index calculated from the degree of insufficient fusion consistency, the amount of response conflict, and the suspected poisoning judgment factor. It is used to measure the severity of poisoning and the urgency of repair of the target item.

[0128] Specifically, the poisoning repair priority index is constructed as follows: First, obtain the response consistency judgment quantity, response conflict quantity, and suspected poisoning judgment factor corresponding to the target IP address. Then, reverse the response consistency judgment quantity by subtracting it from 1 to represent the degree of inconsistency. Next, add the response conflict quantity and the suspected poisoning judgment factor to 1 respectively to represent the degree of conflict enhancement and poisoning enhancement. Finally, multiply the above three results to obtain the poisoning repair priority index. The lower the consistency, the more conflicts, and the higher the degree of poisoning, the larger the index, which is used to represent the repair priority of the target entry.

[0129] S802: Determine attack judgment conditions based on the poisoning repair priority index.

[0130] The attack determination criteria are specifically based on the attack / non-attack determination rules obtained by comparing the poisoning repair priority index with a threshold.

[0131] S803: Determine the attack determination result based on the attack determination conditions.

[0132] Specifically, the priority index is compared with a preset infection detection threshold. When the infection repair priority index is greater than or equal to the threshold, it is determined that the network behavior corresponding to the current target IP address is subject to an address resolution protocol spoofing attack. When the infection repair priority index is less than the threshold, it is determined that no address resolution protocol spoofing attack has been detected, thus completing the attack determination based on the degree of infection risk.

[0133] S804: When the attack determination result indicates the existence of an address resolution protocol spoofing attack, a controlled static repair mapping is constructed using the corresponding MAC address in the legitimate mapping benchmark.

[0134] Among them, controlled static repair mapping refers to a trusted IP-MAC binding relationship built on a legitimate mapping benchmark and used to replace abnormal entries.

[0135] Specifically, after determining that the target IP address is under ARP spoofing attack, the correct MAC address corresponding to the target IP address is first extracted from a legitimate mapping reference (such as a DHCP address lease record). Then, based on this legitimate IP-MAC binding relationship, a controlled static mapping record is constructed. During the generation process, the mapping source is verified and confirmed to ensure its trustworthiness and consistency. According to system rules, the mapping is marked as "static," so that it will not be overwritten by dynamic ARP responses during subsequent ARP cache updates, thus providing a reliable foundation for subsequent cache repair and security hardening.

[0136] S805: Based on controlled static repair mapping, perform overwrite repair on suspicious poisoned entries and convert the repaired entries into static entries.

[0137] Specifically, based on the established controlled static repair mapping, the first step is to locate the suspicious poisoned entry in the ARP cache table corresponding to the target IP address. Then, the abnormal MAC address in this entry is replaced with the correct MAC address obtained from the legitimate mapping benchmark, thus overwriting and repairing the poisoned data. Subsequently, the repaired entry is marked as static, preventing it from changing with the dynamic update mechanism of the ARP protocol. This prevents it from being tampered with by forged ARP responses again, ultimately achieving a complete repair and long-term stable fixation of the abnormal mapping.

[0138] S806: When the attack determination result does not indicate the existence of an address resolution protocol spoofing attack, perform a state reclamation operation on the request-response state binding relationship.

[0139] Specifically, this step differs from the traditional approach of "discarding the state directly if there is no attack." It requires that the current binding state be released only when the response consistency is high enough and there are no significant conflicts, thereby avoiding verification interruption caused by premature release under boundary conditions.

[0140] It should be noted that this step represents a significant improvement over traditional methods that rely solely on a single condition for attack detection or simple repair, moving from "coarse-grained judgment" to "multi-factor fusion decision-making." Furthermore, instead of immediately releasing the state when no attack is detected, the state is cautiously reclaimed based on consistency and conflict conditions, avoiding verification interruptions in boundary situations and thus improving the continuity and stability of the overall detection process. Overall, this method transforms from single-judgment and passive processing to multi-dimensional evaluation and closed-loop control, outperforming traditional methods in terms of accuracy, robustness, and engineering reliability.

[0141] Reference manual attached Figure 2 The diagram illustrates the structural composition of the address resolution protocol attack detection system provided in this embodiment of the invention.

[0142] This invention provides an address resolution protocol attack detection system 20, comprising: a processor 201 and a memory 202; The memory 202 stores programs or instructions that can run on the processor 201. When the program or instructions are executed by the processor 201, they implement the steps of the address resolution protocol attack detection method described above and achieve the same technical effect. To avoid repetition, the present invention will not elaborate further.

[0143] It should be understood that the processor 201 in this embodiment of the invention may be a central processing unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

[0144] It should also be understood that the memory 202 in the embodiments of the present invention can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of random access memory are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct memory bus RAM (DR RAM).

[0145] The above embodiments can be implemented, in whole or in part, by software, hardware (such as circuits), firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the flow or function according to the embodiments of the present invention is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., infrared, wireless, microwave, etc.) means. A computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. Available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media. Semiconductor media can be solid-state drives.

[0146] It should be understood that, in various embodiments of the present invention, the order of the above-mentioned process numbers does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0147] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0148] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the devices, apparatuses, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0149] In the embodiments provided by this invention, it should be understood that the disclosed devices, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0150] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0151] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0152] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0153] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present invention, and are not intended to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the protection scope of the present invention.

Claims

1. A method for detecting Address Resolution Protocol (ARP) attacks, characterized in that, The method includes: S1: Send probe packets to key network nodes from the host and calculate the round-trip time of the probe packets; S2: Based on the round-trip time, determine whether there is any abnormality in network behavior; if so, proceed to step S3; otherwise, send the probe data packet to the key network node according to a preset period and update the round-trip time. S3: Extract the mapping relationship between dynamic IP addresses and MAC addresses from the Local Address Resolution Protocol cache table; S4: Obtain a valid mapping baseline; S5: Based on the mapping relationship and the legal mapping benchmark, determine whether the dynamic IP address and the MAC address are consistent; if yes, return to step S1 to continue periodic detection; otherwise, mark the cache entry corresponding to the dynamic IP address as a suspected infected entry. S6: Based on the dynamic IP address corresponding to the suspected poisoning entry, construct and send an Address Resolution Protocol (ARP) request data packet with a unique signature to the network; S7: Receive the Address Resolution Protocol request data packet and perform consistency verification on the response data packet returned by the target IP address; S8: Based on the consistency verification results, determine whether there is an address resolution protocol spoofing attack; if so, overwrite and repair the suspicious infected entry using the MAC address corresponding to the legitimate mapping benchmark, and convert the repaired entry into a static entry; otherwise, return to step S1 to continue periodic probing.

2. The method according to claim 1, characterized in that, S2 specifically includes: S201: Calculate the historical time distribution by combining historical round-trip time data; S202: Calculate the communication path offset intensity based on the round-trip time and the historical time distribution; S203: Based on the communication path offset intensity, determine the cumulative path offset of multiple sampling periods; S204: Construct an adaptive anomaly detection function based on the accumulated path offset; S205: Based on the adaptive anomaly determination function, determine whether the network behavior is abnormal; if so, proceed to step S3; otherwise, send the probe data packet to the critical network node according to the preset period and update the round-trip time.

3. The method according to claim 1, characterized in that, Specifically, S4 is: A query request is sent to the DHCP server in the network to obtain currently valid address lease records, and the address lease records are used as a legal mapping reference for binding legitimate IP addresses and MAC addresses in the network.

4. The method according to claim 1, characterized in that, S5 specifically includes: S501: Extract the dynamic entries from the Local Address Resolution Protocol cache table; S502: Based on the dynamic entries, establish a candidate set of local dynamic mappings to be determined; S503: Construct a set of valid mapping references based on the address lease records returned by the DHCP server; S504: Calculate the single mapping consistency coefficient by combining the local dynamic mapping candidate set and the legal mapping reference set; S505: In multiple sampling periods, the mapping inconsistencies of the same IP address are accumulated by combining the single mapping consistency coefficient to obtain the cumulative mapping mismatch amount. S506: Calculate the suspected poisoning determination factor based on the cumulative amount of the mapping mismatch and the attributes of the dynamic entry; S507: Based on the suspected infection determination factor, determine whether the dynamic IP address and the MAC address are consistent; if yes, return to step S1 to continue periodic detection; otherwise, mark the cache entry corresponding to the dynamic IP address as a suspected infection entry.

5. The method according to claim 4, characterized in that, S6 specifically includes: S601: Combine the dynamic IP address corresponding to the suspected poisoning entry, the suspected poisoning judgment factor, and the cumulative path offset to construct a state coupling parameter set for the target to be verified. S602: Define the basic unique signature seed of the target to be verified; S603: Based on the aforementioned basic unique signature seed, the key parameters in the state coupling parameter set are integrated into the signature construction process to form a state coupling unique signature; S604: Combine the state-coupled unique signature to construct an Extended Address Resolution Protocol (ARP) request packet; S605: Based on the path anomaly degree of the target entry and the suspected poisoning judgment factor, adaptively determine the sending strength of the extended address resolution protocol request data packet; S606: Determine the transmission interval between adjacent Extended Address Resolution Protocol (EPRP) request packets based on the transmission strength; S607: Based on the transmission strength and the transmission interval, construct a corresponding number of Extended Address Resolution Protocol (ARP) request packets with the state coupling unique signature, and send the ARP request packets to the network according to the transmission interval.

6. The method according to claim 1, characterized in that, The process includes the following steps after S6 and before S7: Record the correspondence between the Address Resolution Protocol request data packet and the unique signature to establish a request-response state binding relationship.

7. The method according to claim 1, characterized in that, The consistency verification includes: performing consistency verification on the MAC address and consistency verification on the identifier parameters.

8. The method according to claim 6, characterized in that, Specifically, S7 includes: S701: Receive the Address Resolution Protocol request data packet, and construct a response observation window for the target IP address starting from the time of sending; S702: Within the response observation window, receive multiple ARP response packets returned for the target IP address; S703: Determine a candidate response set based on each of the ARP response packets and the request-response state binding relationship; S704: Perform two-layer field parsing on each ARP response packet in the candidate response set; S705: Calculate the single-response structure consistency coefficient by combining the results of the two-layer field parsing; S706: Based on response interference, compare all ARP response packets within the response observation window to determine the amount of multi-response collisions; S707: Calculate the response timing effectiveness factor for each of the aforementioned ARP response data packets; S708: Combine the single-response structure consistency coefficient, the multi-response conflict amount, and the response timing effective factor to determine the response consistency judgment amount; S709: Based on the response consistency determination quantity, perform consistency verification on the response data packet returned by the target IP address.

9. The method according to claim 8, wherein step S8 specifically includes: S801: Define the poisoning repair priority index based on the aforementioned response consistency judgment quantity; S802: Determine the attack judgment conditions based on the poisoning repair priority index; S803: Determine the attack determination result based on the attack determination conditions; S804: When the attack determination result indicates the existence of the address resolution protocol spoofing attack, a controlled static repair mapping is constructed using the MAC address corresponding to the legitimate mapping benchmark. S805: Based on the controlled static repair mapping, the suspected poisoned entries are overwritten and repaired, and the repaired entries are converted into the static entries; S806: When the attack determination result does not indicate the existence of the address resolution protocol spoofing attack, perform a state reclamation operation on the request-response state binding relationship.

10. An Address Resolution Protocol (ARP) attack detection system, characterized in that, include: Processor and memory; The memory stores programs or instructions that can run on the processor, and when the processor executes the programs or instructions, it implements the steps of the address resolution protocol attack detection method as described in any one of claims 1 to 9.

Images