The Experts below are selected from a list of 282 Experts worldwide ranked by ideXlab platform

Sukumar Nandi - One of the best experts on this subject based on the ideXlab platform.

  • LAN attack detection using Discrete Event Systems
    ISA Transactions, 2011
    Co-Authors: Neminath Hubballi, S. Roopa, Ritesh Ratti, Santosh Biswas, Sukumar Nandi
    Abstract:

    Address Resolution Protocol (ARP) is used for determining the link Layer or Medium Access Control (MAC) address of a network host, given its Internet Layer (IP) or Network Layer address. ARP is a stateless protocol and any IPMAC pairing sent by a host is accepted without verification. This weakness in the ARP may be exploited by malicious hosts in a Local Area Network (LAN) by spoofing IPMAC pairs. Several schemes have been proposed in the literature to circumvent these attacks; however, these techniques either make IPMAC pairing static, modify the existing ARP, patch operating systems of all the hosts etc. In this paper we propose a Discrete Event System (DES) approach for Intrusion Detection System (IDS) for LAN specific attacks which do not require any extra constraint like static IPMAC, changing the ARP etc. A DES model is built for the LAN under both a normal and compromised (i.e., spoofed request/response) situation based on the sequences of ARP related packets. Sequences of ARP events in normal and spoofed scenarios are similar thereby rendering the same DES models for both the cases. To create different ARP events under normal and spoofed conditions the proposed technique uses active ARP probing. However, this probing adds extra ARP traffic in the LAN. Following that a DES detector is built to determine from observed ARP related events, whether the LAN is operating under a normal or compromised situation. The scheme also minimizes extra ARP traffic by probing the source IPMAC pair of only those ARP packets which are yet to be determined as genuine/spoofed by the detector. Also, spoofed IPMAC pairs determined by the detector are stored in tables to detect other LAN attacks triggered by spoofing namely, man-in-the-middle (MiTM), denial of service etc. The scheme is successfully validated in a test bed. ?? 2010 ISA. Published by Elsevier Ltd. All rights reserved.

  • LAN attack detection using Discrete Event Systems
    Isa Transactions, 2011
    Co-Authors: Neminath Hubballi, S. Roopa, Ritesh Ratti, Santosh Biswas, Sukumar Nandi
    Abstract:

    Abstract Address Resolution Protocol (ARP) is used for determining the link Layer or Medium Access Control (MAC) address of a network host, given its Internet Layer (IP) or Network Layer address. ARP is a stateless protocol and any IP–MAC pairing sent by a host is accepted without verification. This weakness in the ARP may be exploited by malicious hosts in a Local Area Network (LAN) by spoofing IP–MAC pairs. Several schemes have been proposed in the literature to circumvent these attacks; however, these techniques either make IP–MAC pairing static, modify the existing ARP, patch operating systems of all the hosts etc. In this paper we propose a Discrete Event System (DES) approach for Intrusion Detection System (IDS) for LAN specific attacks which do not require any extra constraint like static IP–MAC, changing the ARP etc. A DES model is built for the LAN under both a normal and compromised (i.e., spoofed request/response) situation based on the sequences of ARP related packets. Sequences of ARP events in normal and spoofed scenarios are similar thereby rendering the same DES models for both the cases. To create different ARP events under normal and spoofed conditions the proposed technique uses active ARP probing. However, this probing adds extra ARP traffic in the LAN. Following that a DES detector is built to determine from observed ARP related events, whether the LAN is operating under a normal or compromised situation. The scheme also minimizes extra ARP traffic by probing the source IP–MAC pair of only those ARP packets which are yet to be determined as genuine/spoofed by the detector. Also, spoofed IP–MAC pairs determined by the detector are stored in tables to detect other LAN attacks triggered by spoofing namely, man-in-the-middle (MiTM), denial of service etc. The scheme is successfully validated in a test bed.

Neminath Hubballi - One of the best experts on this subject based on the ideXlab platform.

  • LAN attack detection using Discrete Event Systems
    ISA Transactions, 2011
    Co-Authors: Neminath Hubballi, S. Roopa, Ritesh Ratti, Santosh Biswas, Sukumar Nandi
    Abstract:

    Address Resolution Protocol (ARP) is used for determining the link Layer or Medium Access Control (MAC) address of a network host, given its Internet Layer (IP) or Network Layer address. ARP is a stateless protocol and any IPMAC pairing sent by a host is accepted without verification. This weakness in the ARP may be exploited by malicious hosts in a Local Area Network (LAN) by spoofing IPMAC pairs. Several schemes have been proposed in the literature to circumvent these attacks; however, these techniques either make IPMAC pairing static, modify the existing ARP, patch operating systems of all the hosts etc. In this paper we propose a Discrete Event System (DES) approach for Intrusion Detection System (IDS) for LAN specific attacks which do not require any extra constraint like static IPMAC, changing the ARP etc. A DES model is built for the LAN under both a normal and compromised (i.e., spoofed request/response) situation based on the sequences of ARP related packets. Sequences of ARP events in normal and spoofed scenarios are similar thereby rendering the same DES models for both the cases. To create different ARP events under normal and spoofed conditions the proposed technique uses active ARP probing. However, this probing adds extra ARP traffic in the LAN. Following that a DES detector is built to determine from observed ARP related events, whether the LAN is operating under a normal or compromised situation. The scheme also minimizes extra ARP traffic by probing the source IPMAC pair of only those ARP packets which are yet to be determined as genuine/spoofed by the detector. Also, spoofed IPMAC pairs determined by the detector are stored in tables to detect other LAN attacks triggered by spoofing namely, man-in-the-middle (MiTM), denial of service etc. The scheme is successfully validated in a test bed. ?? 2010 ISA. Published by Elsevier Ltd. All rights reserved.

  • LAN attack detection using Discrete Event Systems
    Isa Transactions, 2011
    Co-Authors: Neminath Hubballi, S. Roopa, Ritesh Ratti, Santosh Biswas, Sukumar Nandi
    Abstract:

    Abstract Address Resolution Protocol (ARP) is used for determining the link Layer or Medium Access Control (MAC) address of a network host, given its Internet Layer (IP) or Network Layer address. ARP is a stateless protocol and any IP–MAC pairing sent by a host is accepted without verification. This weakness in the ARP may be exploited by malicious hosts in a Local Area Network (LAN) by spoofing IP–MAC pairs. Several schemes have been proposed in the literature to circumvent these attacks; however, these techniques either make IP–MAC pairing static, modify the existing ARP, patch operating systems of all the hosts etc. In this paper we propose a Discrete Event System (DES) approach for Intrusion Detection System (IDS) for LAN specific attacks which do not require any extra constraint like static IP–MAC, changing the ARP etc. A DES model is built for the LAN under both a normal and compromised (i.e., spoofed request/response) situation based on the sequences of ARP related packets. Sequences of ARP events in normal and spoofed scenarios are similar thereby rendering the same DES models for both the cases. To create different ARP events under normal and spoofed conditions the proposed technique uses active ARP probing. However, this probing adds extra ARP traffic in the LAN. Following that a DES detector is built to determine from observed ARP related events, whether the LAN is operating under a normal or compromised situation. The scheme also minimizes extra ARP traffic by probing the source IP–MAC pair of only those ARP packets which are yet to be determined as genuine/spoofed by the detector. Also, spoofed IP–MAC pairs determined by the detector are stored in tables to detect other LAN attacks triggered by spoofing namely, man-in-the-middle (MiTM), denial of service etc. The scheme is successfully validated in a test bed.

S. Roopa - One of the best experts on this subject based on the ideXlab platform.

  • LAN attack detection using Discrete Event Systems
    ISA Transactions, 2011
    Co-Authors: Neminath Hubballi, S. Roopa, Ritesh Ratti, Santosh Biswas, Sukumar Nandi
    Abstract:

    Address Resolution Protocol (ARP) is used for determining the link Layer or Medium Access Control (MAC) address of a network host, given its Internet Layer (IP) or Network Layer address. ARP is a stateless protocol and any IPMAC pairing sent by a host is accepted without verification. This weakness in the ARP may be exploited by malicious hosts in a Local Area Network (LAN) by spoofing IPMAC pairs. Several schemes have been proposed in the literature to circumvent these attacks; however, these techniques either make IPMAC pairing static, modify the existing ARP, patch operating systems of all the hosts etc. In this paper we propose a Discrete Event System (DES) approach for Intrusion Detection System (IDS) for LAN specific attacks which do not require any extra constraint like static IPMAC, changing the ARP etc. A DES model is built for the LAN under both a normal and compromised (i.e., spoofed request/response) situation based on the sequences of ARP related packets. Sequences of ARP events in normal and spoofed scenarios are similar thereby rendering the same DES models for both the cases. To create different ARP events under normal and spoofed conditions the proposed technique uses active ARP probing. However, this probing adds extra ARP traffic in the LAN. Following that a DES detector is built to determine from observed ARP related events, whether the LAN is operating under a normal or compromised situation. The scheme also minimizes extra ARP traffic by probing the source IPMAC pair of only those ARP packets which are yet to be determined as genuine/spoofed by the detector. Also, spoofed IPMAC pairs determined by the detector are stored in tables to detect other LAN attacks triggered by spoofing namely, man-in-the-middle (MiTM), denial of service etc. The scheme is successfully validated in a test bed. ?? 2010 ISA. Published by Elsevier Ltd. All rights reserved.

  • LAN attack detection using Discrete Event Systems
    Isa Transactions, 2011
    Co-Authors: Neminath Hubballi, S. Roopa, Ritesh Ratti, Santosh Biswas, Sukumar Nandi
    Abstract:

    Abstract Address Resolution Protocol (ARP) is used for determining the link Layer or Medium Access Control (MAC) address of a network host, given its Internet Layer (IP) or Network Layer address. ARP is a stateless protocol and any IP–MAC pairing sent by a host is accepted without verification. This weakness in the ARP may be exploited by malicious hosts in a Local Area Network (LAN) by spoofing IP–MAC pairs. Several schemes have been proposed in the literature to circumvent these attacks; however, these techniques either make IP–MAC pairing static, modify the existing ARP, patch operating systems of all the hosts etc. In this paper we propose a Discrete Event System (DES) approach for Intrusion Detection System (IDS) for LAN specific attacks which do not require any extra constraint like static IP–MAC, changing the ARP etc. A DES model is built for the LAN under both a normal and compromised (i.e., spoofed request/response) situation based on the sequences of ARP related packets. Sequences of ARP events in normal and spoofed scenarios are similar thereby rendering the same DES models for both the cases. To create different ARP events under normal and spoofed conditions the proposed technique uses active ARP probing. However, this probing adds extra ARP traffic in the LAN. Following that a DES detector is built to determine from observed ARP related events, whether the LAN is operating under a normal or compromised situation. The scheme also minimizes extra ARP traffic by probing the source IP–MAC pair of only those ARP packets which are yet to be determined as genuine/spoofed by the detector. Also, spoofed IP–MAC pairs determined by the detector are stored in tables to detect other LAN attacks triggered by spoofing namely, man-in-the-middle (MiTM), denial of service etc. The scheme is successfully validated in a test bed.

Ritesh Ratti - One of the best experts on this subject based on the ideXlab platform.

  • LAN attack detection using Discrete Event Systems
    ISA Transactions, 2011
    Co-Authors: Neminath Hubballi, S. Roopa, Ritesh Ratti, Santosh Biswas, Sukumar Nandi
    Abstract:

    Address Resolution Protocol (ARP) is used for determining the link Layer or Medium Access Control (MAC) address of a network host, given its Internet Layer (IP) or Network Layer address. ARP is a stateless protocol and any IPMAC pairing sent by a host is accepted without verification. This weakness in the ARP may be exploited by malicious hosts in a Local Area Network (LAN) by spoofing IPMAC pairs. Several schemes have been proposed in the literature to circumvent these attacks; however, these techniques either make IPMAC pairing static, modify the existing ARP, patch operating systems of all the hosts etc. In this paper we propose a Discrete Event System (DES) approach for Intrusion Detection System (IDS) for LAN specific attacks which do not require any extra constraint like static IPMAC, changing the ARP etc. A DES model is built for the LAN under both a normal and compromised (i.e., spoofed request/response) situation based on the sequences of ARP related packets. Sequences of ARP events in normal and spoofed scenarios are similar thereby rendering the same DES models for both the cases. To create different ARP events under normal and spoofed conditions the proposed technique uses active ARP probing. However, this probing adds extra ARP traffic in the LAN. Following that a DES detector is built to determine from observed ARP related events, whether the LAN is operating under a normal or compromised situation. The scheme also minimizes extra ARP traffic by probing the source IPMAC pair of only those ARP packets which are yet to be determined as genuine/spoofed by the detector. Also, spoofed IPMAC pairs determined by the detector are stored in tables to detect other LAN attacks triggered by spoofing namely, man-in-the-middle (MiTM), denial of service etc. The scheme is successfully validated in a test bed. ?? 2010 ISA. Published by Elsevier Ltd. All rights reserved.

  • LAN attack detection using Discrete Event Systems
    Isa Transactions, 2011
    Co-Authors: Neminath Hubballi, S. Roopa, Ritesh Ratti, Santosh Biswas, Sukumar Nandi
    Abstract:

    Abstract Address Resolution Protocol (ARP) is used for determining the link Layer or Medium Access Control (MAC) address of a network host, given its Internet Layer (IP) or Network Layer address. ARP is a stateless protocol and any IP–MAC pairing sent by a host is accepted without verification. This weakness in the ARP may be exploited by malicious hosts in a Local Area Network (LAN) by spoofing IP–MAC pairs. Several schemes have been proposed in the literature to circumvent these attacks; however, these techniques either make IP–MAC pairing static, modify the existing ARP, patch operating systems of all the hosts etc. In this paper we propose a Discrete Event System (DES) approach for Intrusion Detection System (IDS) for LAN specific attacks which do not require any extra constraint like static IP–MAC, changing the ARP etc. A DES model is built for the LAN under both a normal and compromised (i.e., spoofed request/response) situation based on the sequences of ARP related packets. Sequences of ARP events in normal and spoofed scenarios are similar thereby rendering the same DES models for both the cases. To create different ARP events under normal and spoofed conditions the proposed technique uses active ARP probing. However, this probing adds extra ARP traffic in the LAN. Following that a DES detector is built to determine from observed ARP related events, whether the LAN is operating under a normal or compromised situation. The scheme also minimizes extra ARP traffic by probing the source IP–MAC pair of only those ARP packets which are yet to be determined as genuine/spoofed by the detector. Also, spoofed IP–MAC pairs determined by the detector are stored in tables to detect other LAN attacks triggered by spoofing namely, man-in-the-middle (MiTM), denial of service etc. The scheme is successfully validated in a test bed.

Santosh Biswas - One of the best experts on this subject based on the ideXlab platform.

  • LAN attack detection using Discrete Event Systems
    ISA Transactions, 2011
    Co-Authors: Neminath Hubballi, S. Roopa, Ritesh Ratti, Santosh Biswas, Sukumar Nandi
    Abstract:

    Address Resolution Protocol (ARP) is used for determining the link Layer or Medium Access Control (MAC) address of a network host, given its Internet Layer (IP) or Network Layer address. ARP is a stateless protocol and any IPMAC pairing sent by a host is accepted without verification. This weakness in the ARP may be exploited by malicious hosts in a Local Area Network (LAN) by spoofing IPMAC pairs. Several schemes have been proposed in the literature to circumvent these attacks; however, these techniques either make IPMAC pairing static, modify the existing ARP, patch operating systems of all the hosts etc. In this paper we propose a Discrete Event System (DES) approach for Intrusion Detection System (IDS) for LAN specific attacks which do not require any extra constraint like static IPMAC, changing the ARP etc. A DES model is built for the LAN under both a normal and compromised (i.e., spoofed request/response) situation based on the sequences of ARP related packets. Sequences of ARP events in normal and spoofed scenarios are similar thereby rendering the same DES models for both the cases. To create different ARP events under normal and spoofed conditions the proposed technique uses active ARP probing. However, this probing adds extra ARP traffic in the LAN. Following that a DES detector is built to determine from observed ARP related events, whether the LAN is operating under a normal or compromised situation. The scheme also minimizes extra ARP traffic by probing the source IPMAC pair of only those ARP packets which are yet to be determined as genuine/spoofed by the detector. Also, spoofed IPMAC pairs determined by the detector are stored in tables to detect other LAN attacks triggered by spoofing namely, man-in-the-middle (MiTM), denial of service etc. The scheme is successfully validated in a test bed. ?? 2010 ISA. Published by Elsevier Ltd. All rights reserved.

  • LAN attack detection using Discrete Event Systems
    Isa Transactions, 2011
    Co-Authors: Neminath Hubballi, S. Roopa, Ritesh Ratti, Santosh Biswas, Sukumar Nandi
    Abstract:

    Abstract Address Resolution Protocol (ARP) is used for determining the link Layer or Medium Access Control (MAC) address of a network host, given its Internet Layer (IP) or Network Layer address. ARP is a stateless protocol and any IP–MAC pairing sent by a host is accepted without verification. This weakness in the ARP may be exploited by malicious hosts in a Local Area Network (LAN) by spoofing IP–MAC pairs. Several schemes have been proposed in the literature to circumvent these attacks; however, these techniques either make IP–MAC pairing static, modify the existing ARP, patch operating systems of all the hosts etc. In this paper we propose a Discrete Event System (DES) approach for Intrusion Detection System (IDS) for LAN specific attacks which do not require any extra constraint like static IP–MAC, changing the ARP etc. A DES model is built for the LAN under both a normal and compromised (i.e., spoofed request/response) situation based on the sequences of ARP related packets. Sequences of ARP events in normal and spoofed scenarios are similar thereby rendering the same DES models for both the cases. To create different ARP events under normal and spoofed conditions the proposed technique uses active ARP probing. However, this probing adds extra ARP traffic in the LAN. Following that a DES detector is built to determine from observed ARP related events, whether the LAN is operating under a normal or compromised situation. The scheme also minimizes extra ARP traffic by probing the source IP–MAC pair of only those ARP packets which are yet to be determined as genuine/spoofed by the detector. Also, spoofed IP–MAC pairs determined by the detector are stored in tables to detect other LAN attacks triggered by spoofing namely, man-in-the-middle (MiTM), denial of service etc. The scheme is successfully validated in a test bed.