Abstract: Address Resolution Protocol (ARP) is a standard protocol used to map an IP address to its MAC address so the network can send packets to its destination. Office networks, which typically have limited network resources, are vulnerable to ARP flooding attacks launched by malware. ARP flooding can be used by malware to create network disruption and jam the networks. This study presents a rule-based detection method, Time Density ARP Thresholding with Binding Consistency Monitoring (TDCM), to identify ARP flooding using a simple mechanism, making it suitable for use in networks with limited hardware. To detect flooding anomalies, the TDCM algorithm monitors the flow of ARP packets and the consistency between MAC IP bindings in ARP packets. In this study, a series of experiments was conducted and repeated multiple times. On average, the experiment shows that the system performs well under high-volume ARP attack conditions. This proposed method offers an alternative to machine learning techniques, making it more suitable for deployment in resource-constrained office networks. Future work will focus on improving detection in low-volume attack scenarios, validating performance in real-world environments, and implementing on devices with limited computing resources.

Rizal Fathoni Aji, Heri Kurniawan and Nilamsari Putri Utami. “A Lightweight Rule-Based Detection Approach for ARP Flooding Malware in Office Networks”. International Journal of Advanced Computer Science and Applications (IJACSA) 16.12 (2025). http://dx.doi.org/10.14569/IJACSA.2025.0161248

@article{Aji2025,
title = {A Lightweight Rule-Based Detection Approach for ARP Flooding Malware in Office Networks},
journal = {International Journal of Advanced Computer Science and Applications},
doi = {10.14569/IJACSA.2025.0161248},
url = {http://dx.doi.org/10.14569/IJACSA.2025.0161248},
year = {2025},
publisher = {The Science and Information Organization},
volume = {16},
number = {12},
author = {Rizal Fathoni Aji and Heri Kurniawan and Nilamsari Putri Utami}
}