The detection and prevention for ARP Spoofing based on Snort
The detection and prevention for ARP Spoofing based on Snort
复制标题
基于Snort的ARP欺骗检测与防范
DOI：
10.1109/iccasm.2010.5619113
复制
发表时间：
2010
期刊：
影响因子：
--
通讯作者：
Xinli Tian
中科院分区：
文献类型：
--
作者：
Xian;Zhiping Jiang;Xinli Tian
Snort作为一种功能强大、轻量级的网络入侵检测系统，具有良好的可扩展性和可移植性，可以应用于各种环境。但是Snort在阿普欺骗检测方面存在明显的不足，自身的阿普欺骗防御能力较弱。为了实现对阿普欺骗的检测和防范，本文对ARP预处理器插件进行了扩展，增加了阿普检测模块。实验结果表明，该方法可以使Snort嗅探器自身具有免疫性，从而更及时、准确地定位攻击者。
As one of powerful and light weight Network Intrusion Detection System, Snort has good expansibility and transplantability, and can be used in various environments. However, Snort has clear deficiency on ARP spoofing detection, and its own ARP spoofing defense is powerless. To realize the detection and prevention of the ARP spoofing, the paper expanded the snort preprocessor plug-ins by adding an ARP detection module. Results shows this way can make Snort sniffer itself has immunity, and make locate the attacker more timely and accurately.