Using a Fuzzy Logic Controller to Thwart Data Link Layer Attacks in Ethernet Networks

Nowadays data networks represent the most common communication environment for transfer of data, voice or image. Such popularity led network users to becoming more vulnerable to network attacks and intrusions. Data link layer attacks, ex. ARP poisoning, is considered to be one of these dangerous attacks. ARP poisoning attack is a technique used to attack an Ethernet network. It may allow an attacker to sniff network traffic or stop the traffic altogether. In this paper, we use a fuzzy logic controller to thwart data link layer attacks in Ethernet networks (ARP poisoning). Each host in the network is assigned certain dynamic characteristics. Then a fuzzy logic controller is used to combine these characteristics keeping in mind the synergy between them. The output of the controller decides if the host is trusted or not. Moreover, we use a stateful ARP cache, instead of the traditional stateless ARP cache.