Feature Relevance for Detecting Address Resolution Protocol Spoofing in Smart Homes with Machine Learning

The Internet of Things (IoT) has revolutionized smart homes but also makes smart homes vulnerable to cyber attacks. One such attack is the Address Resolution Protocol (ARP) spoofing-based Man-in-the-Middle (MITM) attack. This form of attack puts the integrity of communication at risk in smart home networks. Identifying ARP spoofing in these settings is essential to maintain user security and privacy. Unfortunately, there is a lack of detection methods for ARP spoofing attacks in smart homes. Recent Machine-Learning (ML)-based detection techniques have severe limitations when applied to such environments: they were developed based on a single dataset typically originating from a single lab testbed mimicking a single home, whilst implicitly assuming applicability of the results to smart homes in general. We found that this assumption is incorrect: the performance of ML varies quite significantly from dataset to dataset and between algorithms. From an in-depth analysis of feature importance and impact on the outcomes of the algorithms, we conclude that only a very specific set of features is responsible for the lion share of the algorithms' performance. We, therefore, recommend that future smart home datasets to be used for training artificially intelligent detection techniques for ARP-spoofing in smart homes in general are sourced using a limited but standardized set of features as laid out in this paper, and use XGBoost as the algorithm of choice.