ARP Request Trend Fitting for Detecting Malicious Activity inLANKai MatsufujiSatoru Kobayashi

The University of Tokyo
mattun@hongo.wide.ad.jp

National Institute of Informatics
sat@nii.ac.jp

Hiroshi Esaki

Hideya Ochiai

The University of Tokyo
hiroshi@wide.ad.jp

The University of Tokyo
ochiai@elab.ic.i.u-tokyo.ac.jp

ABSTRACT
Security of local area networks (LANs) attract enormous attention
these days. LANs are not safe even under a well-configured firewall, because malware can be easily delivered through network
applications. Thus we need to take counter measures against malicious activities by focusing on each device itself. However, wecannot adopt many of existing methods to the devices which have
limited resource capacity like IoT. Accordingly, we consider thatthe request pattern of address resolution protocol (ARP) may provide some indicators for finding such malicious activities without
putting a burden on each device. In this paper, We propose a method
to detect malicious network activity by ARP monitoring. The detection method is based on a fitting model of ARP request trend.
We especially focus on the destination devices of ARP request inoutlier detection with the model. We made an experiment with adata of monitored ARP requests in laboratory network. We also
discuss parameter tuning and validity of the model based on threenotable requirements.

CCS CONCEPTS• Security and privacy → Network security; Intrusion/anomaly
detection and malware mitigation; • Networks → Local area networks;

KEYWORDS
Address Resolution Protocol, Local Area Network, Security
ACM Reference Format:
Kai Matsufuji, Satoru Kobayashi, Hiroshi Esaki, and Hideya Ochiai. 2018.
ARP Request Trend Fitting for Detecting Malicious Activity in LAN. In
Proceedings of IMCOM ’19: (IMCOM ’19). ACM, New York, NY, USA, 4 pages.
https://doi.org/10.1145/nnnnnnn.nnnnnnn

1

INTRODUCTION

Security of local area networks (LANs) is getting more and more
serious these days. Malware makes some suspicious activities forPermission to make digital or hard copies of all or part of this work for personal orclassroom use is granted without fee provided that copies are not made or distributedfor profit or commercial advantage and that copies bear this notice and the full citationon the first page. Copyrights for components of this work owned by others than ACM
must be honored. Abstracting with credit is permitted. To copy otherwise, or republish,
to post on servers or to redistribute to lists, requires prior specific permission and/or afee. Request permissions from permissions@acm.org.
IMCOM ’19, January 4–6, 2019, Phuket, Thailand© 2018 Association for Computing Machinery.
ACM ISBN 978-x-xxxx-xxxx-x/YY/MM. . . $15.00
https://doi.org/10.1145/nnnnnnn.nnnnnnn

expanding the malware itself, for searching sensitive data, or foroverriding IoT application-layer protocols. Even if there is a firewall
at the entrance of the network, malware can be easily delivered
into LANs via phishing emails or malware infected smartphones
through Wi-Fi. Thus we need to take counter measures against
malicious activities in those cases by focusing on each device itself.
However, it places a large load on the end-node devices to measure
the network activity of them. It is difficult to make counter measuresagainst malware, which works in the end-node devices, due totheir resource capacity limitation. Some existing techniques [3]are proposed in recent days, but most of them are not reasonablein such as IoT networks. We propose based on address resolution
protocol (ARP) to solve such problem. Because ARP request packet
is broadcast for finding target MAC address in most cases, we canobserve the packet in the other devices connected to the LAN.
Therefore, we can observe the ARP request packets by adding amonitor machine to the LAN. This does not place an additional loadto the end-node devices. Moreover, there is another advantage thatwe can introduce the ARP monitoring method without changing
existing devices.
We can judge whether malware invades into a LAN or not byobserving the trend of ARP request. When malware invades intoa device, it tries the scanning attack to invade into other devices
in the LAN or interrupts particular connections. When we observe
ARP request of that time, the number of destination hosts in certain
period increases or decreases exponentially unlike that in usual.
Therefore, by observing the change of the number of destination
hosts about ARP request, we can judge whether malware invades
into LAN or not in the period.
In this paper, we propose a fitting model which predicts the next
situation of the number of destination hosts about ARP requests byusing the number so far and judge whether the connection in theLAN is normal or not based on it.

2RELATED WORKLAN security is paid more and more attention nowadays because
many kinds of malware such as ransomware become a big threat in
the modern society. However, we need to choose which method isthe best when we adopt it to devices which have capacity limitation.
Kolbitsch et al. [3] propose a malware detection approach whichlearns a program of malware and judges whether the malware
invades or not. Their approach is implemented at the end host andmakes the host free up some resources for the approach. However,IMCOM ’19, January 4–6, 2019, Phuket, Thailand

Kai Matsufuji, Satoru Kobayashi, Hiroshi Esaki, and Hideya Ochiai

we should not adopt such methods to the devices which have limited
resource capacity like IoT.
In studies featuring LAN security, some of the studies focus onARP just like our study.
Whyte et al. [5] record active systems within the network celland devices they are trying to connect with by using ARP request
and use them as an indicator for anomaly detection by counting
ARP request which don’t correspond to them. The study is related
to ours in terms of anomaly detection using ARP request. However,
it is difficult for their approach to deal with configuration changes
because their method don’t rewrite the record. Thus we need amethod considering time variation and rewriting records.
Pandey [4], Jinhua et al. [2] and Hou et al. [1] study about LAN
security focusing on ARP. However, these studies attach importanceto taking measures against ARP spoofing, and it is difficult for us
to adopt these studies to malware detection.

3

ARP REQUESTS CLASSIFICATION METHOD

As mentioned in Section 1, we take measures against malicious
activities by observing ARP request packets. We propose a fitting
model to ARP request trend patterns. The fitting model predicts
the trend of ARP request in the next day by using that in one ormore days before.

3.1

Figure 1: Estimation the future trends of the degree of destination. The connection graphs are generated from the observations of broadcasted ARP requests.

Requirements of Fitting Models

We list the requirements for fitting models in our study as follows:
Learn Automatically
The model shouldn’t require knowledge such as the list ofmalwares manually, otherwise we would update the list manually forever.
Follow Time Variation
The model should expect the situation of the next day bylearning the past trend. Because the system configuration
in a LAN changes frequently, the model should be always
updated.
Correspond to Amplitude
The model should memorize drastic change experienced recently. It shouldn’t be too sensitive to the trends. Otherwise,
we can’t adopt the model to the shaking trends.

3.2

The Extraction of the Degree of Destination

Our approach first makes a connection graph for a certain time
duration of a network, i.e., device-to-device connections based on
ARP request. We focus on the number of connected hosts in ARP(hereinafter, this is called the degree of destination). Fitting model
estimates the future trends learning from the past trends (Figure 1).
We consider ARP request packets which a device (S) sends. The
frame of ARP requests is broadcast, and we define them which isobserved by another device of the same segment in a day(D s ) as:
D s = (IP 1 , IP2 , ...IPk )(1)

Thus the degree of destination about S in a day (X s (n)) can beshowed as follows:
X s (n) = k(2)

Figure 2: An Example of Fitting Model
Here, n represents the date.

3.3

Definitional Formulae of Fitting Model

The fitting model, we propose in this paper, gives an upper limit anda lower limit. It expects that in the next time duration the degree ofdestination will be within those limits. We admit that, to actuallyshow the fitness, we must introduce some fitness evaluation models,such that the gap between the upper and lower limits should beappropriate. However, this kind of evaluation model is dependent
on the network operation, so we left this discussion open, in thispaper.
In Section 3.1, we defined As (n) and Bs (n) considering threerequirements. Further, we define an upper limit and a lower limitof fitting model as As (n) ± γ Bs (n). By defining the two limits inthis way, fitting model performs more efficiently meeting threerequirements.
Fig 2 shows the example of fitting Model. As (n) − γ Bs (n) andAs (n)+γ Bs (n) is the lower limit and the upper limit of fitting modelARP Request Trend Fitting for Detecting Malicious Activity in LAN

IMCOM ’19, January 4–6, 2019, Phuket, Thailand

Figure 3: The Transitions of X s (n), As (n), l 1 and l 2 Changing α and β to Various Values about three IP addresses in May,2018.
and when X s (n) doesn’t lie between the boundaries, X s (n) is judged
to be abnormal.
Now, when considering about definitional formulae of fitting
model, we shouldn’t define all cases in only one formula. This isbecause devices which always connect to somewhere every day
are different from what occasionally connect to somewhere. In theformer, the value of 0 in X s (n) is should be judged as abnormal
because as long as devices connected to somewhere, they keep on
sending ARP request every certain period. In the latter, on the other
hand, 0 in X s (n) is should be normal because they don’t always
need to send ARP request. Thus, we define formulae of fitting model
distinguishing between the two cases.
3.3.1 Fitting Model about Permanently-Connecting Device. Manyof the devices which always connect to somewhere (PermanentlyConnecting devices) connect some application servers(e.g., DNS,syslog, DHCP, Nagios and DB) during normal times, and it is assumed that the degree of destination approaches a constant value.
Now we define the moving average about X s (n) (As (n)) as:As (n + 1) = αAs (n) + (1 − α)X s (n), As (0) = 0(6)and we perform anomaly detection about S based on the inequality.
3.3.2 Fitting Model about Occasionally-Connecting Device. It is
assumed that the degree of destination about devices which occasionally connect to somewhere basically exhibits the same behavior
as mentioned in Section 3.3. However, we need to consider separately about when devices don’t connect to anywhere, and thedegree of destination evaluates to 0. In the above case, we redefine
As (n) and Bs (n) as mentioned before as:αAs (n) + (1 − α)X s (n) (X s (n) > 0)
As (n + 1) =(7)As (n)(X s (n) = 0)
2

Bs (n + 1) =βBs (n)2 + (1 − β)Bs (n)2
Bs (n)2(X s (n) > 0)
(X s (n) = 0)

(8)

and C as:C : X s (n) = 0 ∨ As (n) − γ Bs (n) < X s (n) < As (n) + γ Bs (n)(4)

and the moving average about Ys (n) (Bs (n)) as:
Bs (n + 1)2 = βBs (n)2 + (1 − β)Ys (n)2 , B x (0) = 0

C : As (n) − γ Bs (n) < X s (n) < As (n) + γ Bs (n)(3)

and the variance (Ys (n)) as:Ys (n) = {X s (n) − As (n)}2Further, we define the determination condition to decide whether
devices fit the model or not (C) as:

(5)

(9)

4 EVALUATION
4.1 Experiment Settings
To validate our approach, we collected ARP request packets fromthe network in lab from April 17 to June 16,2018. We investigatedIMCOM ’19, January 4–6, 2019, Phuket, Thailand

Kai Matsufuji, Satoru Kobayashi, Hiroshi Esaki, and Hideya Ochiai

the degree of destination per day by source IP address. Hereinafter,
we call the upper and lower limit of fitting model as mentioned inSection 3 as l 1 and l 2 . In this experiment, we define γ as 2 (l 1 , l 2 :As (n) ± 2Bs (n)). Also, if over 1/4 of measurement period about adevice is 0, we call the device as Occasionally-Connecting device.
Under these conditions, we describe l 1 and l 2 changing α and β andvalidate which parameter(α and β) fits the behavior of X s (n) thebest.
We use first seven-days time-series (except days without observed communications) as a learning-period, which makes As (n)stable enough for outlier detection.

model memorizes drastic change experienced before for several days. Therefore, we can see that in IPA , large shakes
occurring immediately after first shake is not detected asabnormal value, and in IP B and IPC , oscillation occurringsome time after first oscillation is judged to be abnormal.
From the above, we derive the result that fitting model we proposed functions meeting the three requirements when we choose
the parameter properly.

4.2Parameter Tuning

In this section, we discuss parameter tuning in the formulae of thefitting model. In other words, we consider how the fitting modelworks if the parameters are not tuned properly.
Figure 3 shows the transitions of X s (n), As (n), l 1 and l 2 changing
α and β to various values about three IP addresses in May,2018.
Now, IPA and IP B are Permanently-Connecting devices,and IPC is
Occasionally-Connecting device (not including the learning period).
In the case that both α and β is 0.99, As (n) is almost constant inall three IP addresses in spite of the large change of X s (n). This isbecause As (n) is fixed to data memorized in transient state becauseof too large α. Further, we can see that although X s (n) experienced
large oscillations, the oscillations are not reflected in l 1 and l 2 . Thisis because the amplitude memorized in transient state is reflected
too strongly because of too large β.
On the other hand, we also evaluate the case which both α and β
are 0.5. In As (n), we can see that the value changes drastically compared with graphs as mentioned so far in all three IP addresses. Thisis because the value of last X s (n) is reflected too strongly becauseof too small α, and As (n) doesn’t memorize previous data. Further,
we can see that unlike in 0.99, l 1 and l 2 change very intensely afterX s (n) experienced drastic changes. This shows that the two value
are too sensitive to last change because of too small β, and they
can’t predict correctly.

4.3

Evaluation of Requirements

As mentioned in Section 3, As (n) and Bs (n) in the formulae about
fitting model meet the three requirements. Now, we list an example
which had a good behavior as fitting model as a result of experiment(i.e., when both α and β is 0.9) and confirm that the fitting modelin that case surely meets the three requirements(Figure 3).
Learn AutomaticallyThis condition is met obviously because the fitting model
doesn’t require any information like the lists of malwares.
Follow Time Variation
It can be said that this condition is met because l 1 and l 2change in response to changes of X s (n).
Correspond to Amplitude
To judge whether this requirement is met or not, we needto confirm drastic changes in Figure 3. In all three IP addresses, when we observe drastic change of X s (n) for the
first time, the day’s data is judged to be abnormal because
fitting model doesn’t expect this change. On the other hand,when we observe them for the second time or later, fitting5DISCUSSION

In this paper, we have experimented targeting a network in lab. As afuture work, we need to discuss other networks for confirming thereliability in our study. Also, we focused on the degree of destinationin ARP request. In the future, we consider the different features
such as the locality or frequency. Thanks to these future works, theachievement in this study will be more successful.

6CONCLUSION

In this paper,we have proposed a fitting model of ARP request trend
patterns. Firstly, we proposed three requirements which composed
the fitting model. Secondly, we showed the formulae in accordancewith the three requirements and defined an upper limit and a lowerlimit. Finally, we investigated and evaluated the transition of thefitting model changing parameters in the formula to various values.
As a result, we concluded that the fitting model functioned meetingthe three requirements when we choose the parameter properly.
As a future work, we need to discuss other networks or consider
the different features of the degree of destination.

REFERENCES[1] Xiangning Hou, Zhiping Jiang, and Xinli Tian. 2010. The detection and prevention
for ARP Spoofing based on Snort. In Computer Application and System Modeling(ICCASM), 2010 International Conference on, Vol. 5. IEEE, V5–137.
[2] Gao Jinhua and Xia Kejian. 2013. ARP spoofing detection algorithm using ICMPprotocol. In Computer Communication and Informatics (ICCCI), 2013 International
Conference on. IEEE, 1–6.
[3] Clemens Kolbitsch, Paolo Milani Comparetti, Christopher Kruegel, Engin Kirda,
Xiao-yong Zhou, and XiaoFeng Wang. 2009. Effective and Efficient Malware
Detection at the End Host. In USENIX security symposium, Vol. 4. 351–366.
[4] Poonam Pandey. 2013. Prevention of ARP spoofing: A probe packet based technique. In Advance Computing Conference (IACC), 2013 IEEE 3rd International. IEEE,
147–153.
[5] David Whyte, EVANGELOS Kranakis, and P Van Oorschot. 2005. ARP-based
detection of scanning worms within an enterprise network. In Proceedings of theAnnual Computer Security Applications Conference (ACSAC).