## 2 Theoretical Background
### Communication Layer
#### 2.5.3 Man-in-the-Middle Attack Simulation  
MITM attack is a type of attack during which malicious third parties position themselves between the communication of two other parties, or between a user and an application. The attack can be passive where the adversary eavesdrops and extract sensitive information. In this instance, communication confidentiality is compromised, and the adversary can remain undetected if a special network penetration test or analysis is not performed on a regular basis. The attack can also be active where the attackers hijack the router to which the victims are connected, or advertise false information using Address Resolution Protocol(ARP) messages. In doing so, they can gain access to the information being shared, and manipulate the data [30].  
Our simulation considers only the active type of MITM attack because our code detects the difference in the number of packets transmitted and received between the victims. During an active MITM attack, the adversary flood the network with ARP messages to mislead the victims into thinking he is one of them. By doing so, there is a substantial increase in the number of packets transmitted that can be easily detected during the analysis of network statistics data. Moreover, active MITM attacks can also be detected with the analysis of network latency. Since the adversary is a pass-through between the two trusting parties, a delay is observed when the forwarding happens. We will only develop the  
Figure 4: The 690 th measurement for 21,600 samples with normal traffic. (**a**) Transmission delay for normal traffic. (**b**) Inter-arrival time for normal traffic.  
Figure 5: The 690 th measurement for 21,600 samples with malicious traffic. (**a**) Transmission delay for malicious traffic. (**b**) Inter-arrival time for malicious traffic.  
concept of an increase in packet count in the following lines because this is the method used by our machine learning model to predict the behavior of the 118 bus system.  
Algorithm 3 demonstrates how the principal purpose of a MITM cyber attack may be recognized and data collected. As we aforementioned, the traffic volume is affected by MITM attacks. This is why the method of detection is implemented by generating and testing packet counts. In this simulation, we alter the network traffic of randomly selected bus samples and as indicated in the algorithm and in the simulation result of Figure 6, we get alerts with the bus number and sample number for every bus that has an error.  
```
1:Create benchmark arrays from arPoisson.txt
2:Create array of sample data from matlab file
3:for the length of the victim list do
4:if An attacked sample is detected then
5: Set error equal to 1
6: Extend Attacked Bus List with attack Bus number
7: Alert of error with error number and bus number
8:else
9: Set error equal to 0
10:endif
11:for the length of victim list do:
12:if error = 0 then
13: Append packet count values to array from firsth
14:else
15:if a from bus is in the attack bus list at this index then
16: Append packet count values to array from secondh
17:else
18:endif
19:endif
20:endif
21: Create packet count CSV File
22:endfor
23:endfor
```  
**Algorithm 3** Man-in-the-Middle Attack Detection  
Figure 6: Simulation result showing buses under attack in each sample.  
In conclusion, MITM attacks typically have a low impact or no impact at all on network performance but they are the first steps to achieve to jeopardize a cyber security system. During MITM attacks and depending on the type of MITM attack, a flux of packets could increase the network traffic. These kinds of attacks are amongst the most dangerous ones because they are very hard to detect and can easily open doors to other types of attacks like DoS or FDI.