A probabilistic anomaly detection scheme to detect DHCP starvation attacks

Dynamic Host Configuration Protocol (DHCP) is used by clients in a network to configure their interface with IP address. DHCP is vulnerable to a popularly known Denial of Service (DoS) attack called DHCP starvation attack. In this paper, we highlight the practical difficulties of creating conventional starvation attack in wireless networks (802.11) and also describe two new variations of attacks which can be easily launched in wireless networks. Subsequently, we also propose an anomaly detection system which can detect all variations of starvation attacks. This anomaly detection system generates a probability distribution of various DHCP messages collected from a particular network as a normal profile and subsequently compare the current activity to this profile to detect starvation attacks. We experiment with different types of starvation attacks in a real network setup and report detection performance of our proposed method.