Ensuring cybersecurity for industrial networks: A solution for ARP-based MITM attacks

• Published in: Journal of computer security Vol. 32; no. 5; pp. 447 - 475
• Main Authors: Bruschi, Danilo, Di Pasquale, Andrea, Lanzi, Andrea, Pagani, Elena
• Format: Journal Article
• Language: English
• Published: London, England SAGE Publications 18.11.2024; Sage Publications Ltd
• Subjects: Cybersecurity; IP (Internet Protocol); Poisoning; ARP poisoning; Industry 4.0; Man-in-the-Middle attacks; secure ARP; ARP
• ISSN: 0926-227X; 1875-8924
• DOI: 10.3233/JCS-230023

The increased adoption of the Internet Protocol (IP) in ICSs has made these systems vulnerable to the same security risks that are present in traditional IT environments. The legacy nature of ICSs and their unique operational requirements make them vulnerable to security threats that are different from those in IT environments. In this paper, we describe a protocol, named ArpON, which is able to wipe out in quasi real time any ARP cache poisoning attempt, thus making it ineffective. Contrarily to solutions presented in the literature for contrasting ARP cache poisoning, ArpON incurs in low operational costs, is backward compatible, transparent to the ARP protocol and does not use any HW feature nor cryptography functionality. We also model and validate ArpON in the OMNET + + network simulator. The simulation results show that ArpON is effective in avoiding ARP poisoning, and its communication overhead is negligible with respect to classical ARP protocol.