Design of a monitoring system for detecting ARP spoofing on a rule-based wifi network

Abstract

Perkembangan teknologi informasi meningkatkan kompleksitas ancaman keamanan siber, salah satunya serangan ARP Spoofing. Serangan ini memanipulasi protokol ARP untuk mengakses dan memodifikasi lalu lintas jaringan, sehingga berpotensi menimbulkan Man-In-The-Middle (MITM) dan pencurian data. Penelitian ini bertujuan merancanag dan mengimplementasikan sistem pemantauan keamanan berbasis multi kriteria untuk mendeteksi serangan ARP Spoofing pada jaringan WiFi. Sistem dikembangkan sebagai Intrusion Prevention System (IPS) yang memantau data ARP dan menerapkan aturan deteksi, seperti ketidaksesuaian IP-MAC, perubahan atribut jaringan yang berlebihan, serta anomali jumlah paket. Notifikasi dikirim secara real-time kepada administrator ketika terjadi penyimpangan. Metode penelitian menggunakan pendekatan Research and Devolpment (R&D), meliputi analisis kebutuhan, perancangan algoritma deteksi, dan pengujian sistem. Eksperimen dilakukan untuk menilai efektivitas deteksi serta efesiensi penggunaan memori. Hasil menunjukkan sistem mampu mendeteksi ARP Spoofing dengan tingkat akurasi tinggi dan konsumsi memori yang efisien. Implementasi sistem ini menurunkan risiko MTIM dan pencurian data, sehingga layak diterapkan pada jaringan kampus maupun organisasi. Konstribusi penelitian ini adalah memperluas kajian keamanan jaringan dengan focus pada ARP spoofing, yang sebelumnya kurang mendapat perhatian dibanding DNS spoofing atau brute force attack. Untuk penelitian selanjutnya, integrasi metode berbasis aturan dengan machine learning diharapkan meningkatkan kemampuan sistem dalam menghadapi pola serangan baru yang lebih kompleks.The rapid development of information technology has increased the complexity of cybersecurity threats, including ARP spoofing attacks. This attack exploits the ARP protocol to intercept and modify network traffic, potentially leading to Man-in-the-Middle (MITM) attacks and data theft. This study aims to design and implement a multi-criteria security monitoring system capable of detecting ARP spoofing attacks in WiFi networks. The system was developed as an Intrusion Prevention System (IPS) that monitors ARP packets and applies detection rules, such as IP–MAC inconsistencies, excessive changes in network attributes, and abnormal packet frequency. Real-time notifications are sent to administrators when anomalies are detected. The research employed a Research and Development (R&D) approach, including requirements analysis, algorithm design for detection, and system testing. Experiments were conducted to evaluate detection effectiveness and memory efficiency. The results demonstrate that the system can accurately detect ARP spoofing while using memory efficiently. Its implementation reduces the risk of MITM attacks and data theft, making it suitable for deployment in campus and organizational networks. The contribution of this study lies in expanding the network security literature by focusing on ARP spoofing, which has received less attention than DNS spoofing and brute-force attacks. Future work suggests integrating rule-based methods with machine learning to enhance adaptability to emerging, complex attack patterns.