Intelligent ARP Spoofing Detection using Multi-layered Machine Learning (ML) Techniques for IoT Networks

TL;DR

This paper presents a multi-layered machine learning framework for real-time ARP spoofing detection in IoT networks, combining feature engineering and hybrid models to improve accuracy and efficiency.

Contribution

It introduces a hierarchical, multi-model detection system tailored for resource-constrained IoT environments, enhancing detection accuracy and scalability.

Findings

Over 97% detection accuracy achieved

Low false positive rates demonstrated

Effective on both simulated and real datasets

Abstract

Address Resolution Protocol (ARP) spoofing remains a critical threat to IoT networks, enabling attackers to intercept, modify, or disrupt data transmission by exploiting ARP's lack of authentication. The decentralized and resource-constrained nature of IoT environments amplifies this vulnerability, making conventional detection mechanisms ineffective at scale. This paper introduces an intelligent, multi-layered machine learning framework designed to detect ARP spoofing in real-time IoT deployments. Our approach combines feature engineering based on ARP header behavior, traffic flow analysis, and temporal packet anomalies with a hybrid detection pipeline incorporating decision trees, ensemble models, and deep learning classifiers. We propose a hierarchical architecture to prioritize lightweight models at edge gateways and deeper models at centralized nodes to balance detection accuracy and computational efficiency. The system is validated on both simulated IoT traffic and the CICIDS2017 dataset, achieving over 97% detection accuracy with low false positive rates. Comparative evaluations with signature-based and rule-based systems demonstrate the robustness and generalizability of our approach. Our results show that intelligent machine learning integration enables proactive ARP spoofing detection tailored for IoT scenarios, laying the groundwork for scalable and autonomous network security solutions.