Abstract
Dynamic Host Configuration Protocol (DHCP) is used to automatically configure clients with IP address and other network configuration parameters. Due to absence of any in-built authentication, the protocol is vulnerable to a class of Denial-of-Service (DoS) attacks, popularly known as DHCP starvation attacks. However, known DHCP starvation attacks are either ineffective in wireless networks or not stealthy in some of the network topologies. In this paper, we first propose a stealth DHCP starvation attack which is effective in both wired and wireless networks and can not be detected by known detection mechanisms. We test the effectiveness of proposed attack in both IPv4 and IPv6 networks and show that it can successfully prevent other clients from obtaining IP address, thereby, causing DoS scenario. In order to detect the proposed attack, we also propose a Machine Learning (ML) based anomaly detection framework. In particular, we use some popular one-class classifiers for the detection purpose. We capture IPv4 and IPv6 traffic from a real network with thousands of devices and evaluate the detection capability of different machine learning algorithms. Our experiments show that the machine learning algorithms can detect the attack with high accuracy in both IPv4 and IPv6 networks.
This is a preview of subscription content, log in via an institution to check access.
Similar content being viewed by others
Notes
Among 65536, one each was allotted to malicious client and server itself. Other two IP addresses, 10.100.0.0 and 10.100.255.255 were Network and Broadcast address respectively and were not used.
References
Dynamic ARP Inspection. http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/dynarp.html. Accessed 23 Sept 2017
Droms, R.: RFC2131: Dynamic Host Configuration Protocol. Internet Engineering Task Force (1997)
Droms, R., Bound, J., Volz, B., Lemon, T., Perkins, C., Carney, M.: RFC3315: Dynamic Host Configuration Protocol for IPv6 (DHCPv6). Internet Engineering Task Force (2003)
Gobbler. http://gobbler.sourceforge.net/. Accessed 23 Sept 2017
DHCPIG. https://github.com/kamorin/DHCPig. Accessed 23 Sept 2017
Tripathi, N., Hubballi, N.: Exploiting DHCP server-side IP address conflict detection: A DHCP starvation attack. In: International Conference on Advanced Networks and Telecommunication Systems (ANTS), pp. 1–3 (2015)
Aburomman, A.A., Reaz, M.B.I.: A survey of intrusion detection systems based on ensemble and hybrid classifiers. Comput. Secur. 65, 135–152 (2017)
Al-Yaseen, W.L., Othman, Z.A., Nazri, Z.A.: Multi-level hybrid support vector machine and extreme learning machine based on modified K-means for intrusion detection system. Expert Syst. Appl. 67, 296–303 (2017)
Liu, L., Zuo, W.L., Peng, T.: Detecting outlier pairs in complex network based on link structure and semantic relationship. Expert Syst. Appl. 69, 40–49 (2017)
DHCP Snooping. http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/snoodhcp.html. Accessed 23 Sept 2017
Xing, X., Shakshuki, E., Benoit, D., Sheltami, T.: Security analysis and authentication improvement for IEEE 802.11i specification. In: Global Telecommunications Conference (GLOBECOM), pp. 1–5 (2008)
JNetPcap. http://jnetpcap.com/docs/javadocs/jnetpcap-1.4/index.html. Accessed 23 Sept 2017
Scapy. http://www.secdev.org/projects/scapy/. Accessed 23 Sept 2017
Issac, B.: Secure ARP and secure DHCP protocols to mitigate security attacks. Int. J. Netw. Secur. 8(2), 107–118 (2009)
Droms, R., Arbaugh, W.: RFC3118: Authentication for DHCP Messages. Internet Engineering Task Force (2001)
Jerschow, Y. I., Lochert, C., Scheuermann, B., Mauve, M.: CLL: A cryptographic link layer for local area networks. In: International Conference on Security and Cryptography for Networks (SCN), pp. 21–38 (2008)
Hubballi, N., Tripathi, N.: A closer look into DHCP starvation attack in wireless networks. Comput. Secur. 65, 387–404 (2017)
Bishop, C.M.: Neural Networks for Pattern Recognition. Oxford University Press, Inc., Oxford (1995)
Chien, Y.: Pattern classification and scene analysis. IEEE Trans. Autom. Control 19(4), 462–463 (1974)
Friedman, N., Geiger, D., Goldszmidt, M.: Bayesian network classifiers. Mach. Learn. 29(2–3), 131–163 (1997)
Martinus, D., Tax, J.: One-Class Classification: Concept-Learning in the Absence of Counterexamples. Ph.D. Thesis, Delft University of Technology (2001)
Demerjian, J., Serhrouchni, A.: DHCP authentication using certificates. In: Security and Protection in Information Processing Systems, pp. 456–472. Springer (2004)
OConnor, T.: Detecting and responding to data link layer attacks. http://www.sans.org/reading-room/whitepapers/intrusion/detecting-responding-data-link-layer-attacks-33513. Accessed 23 Sept 2017
de Graaf, K., Liddy, J., Raison, P., Scano, J., Wadhwa, S.: Dynamic Host Configuration Protocol (DHCP) Authentication using Challenge Handshake Authentication Protocol (CHAP) Challenge. US Patent 8,555,347 (2013)
Port Security. http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/port_sec.html. Accessed 23 Sept 2017
Patrick, M.: RFC3046: DHCP Relay Agent Information Option. Internet Engineering Task Force (2001)
Mukhtar, H., Salah, K., Iraqi, Y.: Mitigation of DHCP starvation attack. Comput. Electr. Eng. 38(5), 1115–1128 (2012)
Tax, D.M.J., Muller, K.R.: A consistency-based model selection for one-class classification. In: International Conference on Pattern Recognition (ICPR), pp. 363–366 (2004)
Tax, D.M.J.: DDtools, the Data Description Toolbox for Matlab, version 2.1.2 (2015)
Author information
Authors and Affiliations
Corresponding author
Rights and permissions
About this article
Cite this article
Tripathi, N., Hubballi, N. Detecting stealth DHCP starvation attack using machine learning approach. J Comput Virol Hack Tech 14, 233–244 (2018). https://doi.org/10.1007/s11416-017-0310-x
Received:
Accepted:
Published:
Issue Date:
DOI: https://doi.org/10.1007/s11416-017-0310-x