Implementation of Percentile as Dynamic Threshold Entropy for ARP Spoofing Detection on Routers

Abstract

The Address Resolution Protocol (ARP) plays a fundamental role in mapping IP addresses to MAC addresses within local area networks, yet it remains inherently vulnerable to spoofing attacks due to its lack of built-in authentication mechanisms. This weakness allows adversaries to intercept, manipulate, or redirect network traffic, posing a significant threat to network integrity, particularly on resource-constrained routers where conventional security solutions are often impractical to deploy. To address this gap, this paper proposes a lightweight ARP spoofing detection method based on entropy analysis, combined with a percentile-based dynamic threshold to adapt to varying network conditions without requiring manual calibration. The proposed method was implemented and evaluated on OpenWRT routers, a common platform for low-cost and embedded networking devices, to assess its practicality in real-world resource-constrained environments. Experimental results demonstrate that the method successfully detects eight out of ten simulated ARP spoofing scenarios, indicating a strong overall detection capability. Furthermore, resource consumption analysis shows that the approach introduces minimal system overhead, with only a 1% increase in memory usage, a 6% increase in disk usage, and CPU load consistently remaining below 0.02. These findings confirm that the proposed entropy-based detection method achieves an effective balance between detection accuracy and computational efficiency, making it a viable and scalable solution for real-time ARP spoofing detection in resource-constrained LAN environments such as small offices, home networks, and IoT deployments.