Patent ID: 9083716
Filing Date: 2015-07-14
Classification: H04L

Abstract:
1. An Address Resolution Protocol (ARP) spoofing attack detection system, comprising: a receiver which receives a first ARP packet, and which determines whether the received first ARP packet is an unsolicited ARP packet; a transmitter which creates, in response to the received first ARP packet being determined as an unsolicited ARP packet, an ARP request packet which corresponds to the unsolicited ARP packet, and which broadcasts the created ARP request packet; a detector which determines, in response to an ARP response packet which corresponds to the broadcasted ARP request packet being received, whether an input port of the received ARP response packet is identical to an input port of the unsolicited ARP packet, and which determines that an ARP spoofing attack has occurred in response to the input port of the received ARP response packet being determined as not identical to the input port of the unsolicited ARP packet; and a packet information storage device which stores, in response to the received first ARP packet being determined as an unsolicited ARP packet, information relating to an input port of the received first ARP packet, in an ARP transaction table, wherein the detector searches, in response to an ARP response packet which corresponds to the broadcasted ARP request packet being received, the ARP transaction table for the information, to determine, in response to the information having been included in the ARP transaction table, whether an input port of the received ARP response packet is identical to the input port of the received first ARP packet, and determines, in response to the input port of the received ARP response packet being determined as not identical to the input port of the received first ARP packet, that an ARP spoofing attack has occurred.