Detecting neighbor discovery protocol-based flooding attack using machine learning techniques

Abstract

Neighbor Discovery Protocol (NDP) is stateless and lacks of authentication which exposes it to flooding attacks. Securing NDP is critical due to the large deployment of open network. Commonly existing solutions for securing NDP violate its design principle in terms of overhead and complexity. Other solutions suffer from high false positive alerts which affects solution trustiness. This paper aims to investigate the use of machine learning mechanism for detecting NDP flooding attacks. It was found that the advantage of using machine learning is that the detection can be done without relying on attack signatures they can learn broader definitions of attack attributes.