Detecting and Mitigating MitM Attack on IoT Devices Using SDN

The Software-Defined Network (SDN) is an innovative network architecture designed to offer enhanced flexibility and operational simplicity in network management through a centralized controller. While these qualities empower SDN to effectively address evolving network demands, they also expose security vulnerability. Given its centralized structure, SDN becomes susceptible to cyber attacks, particularly those targeting internet of things (IoT) devices. These attacks aim to target IoT devices and can lead to congestion and disruption. In this study, we introduce an Intrusion Detection and Prevention System (IDPS) framework based on SDN to detect Man-in-the-Middle (MitM) Attacks by decodes network packets, extracting ARP headers with source and destination Internet Protocol (IP) and Media Access Control (MAC) addresses, monitors Address Resolution Protocol (ARP) packet counts during flood attacks and add flow table to block attackers if the count exceeds a threshold. The research covers simulation outcomes as well as the implementation of a practical SDN model for applying our methodology. The results highlight the model’s ability to rapidly and accurately detect MitM attacks targeting IoT devices and mitigate it in real time.