See Like a Bat: Using Echo-Analysis to Detect Man-in-the-Middle Attacks in LANs

Overview: Yisroel Mirsky from Ben-Gurion University presents Vesper, an active defense tool that uses acoustic echolocation principles to detect Man-in-the-Middle (MitM) attacks within Local Area Networks (LANs). Mirsky explains how traditional LAN defenses struggle because attackers can tamper with network protocols such as ARP, DNS, ICMP, or STP without leaving reliable forensic traces. By transmitting virtual acoustic probe signals and analyzing the physical channel's impulse response, Vesper identifies when an attacker has inserted themselves into the communication path between hosts.

Key Topics: - LAN Man-in-the-Middle (MitM) attack vectors (ARP, DNS, ICMP, DHCP spoofing) - Channel impulse response and network physical layer profiling - Maximum Length Sequences (MLS) and nanosecond-precision probing - Vesper architecture, feature extraction, and deployment models

Technical Details: Traditional network intrusion detection systems rely on inspecting packet payloads, monitoring MAC-to-IP bindings (e.g., dynamic ARP inspection), or checking routing tables. However, skilled attackers can forge ARP replies, poison DNS caches, abuse ICMP redirects, manipulate Spanning Tree Protocol (STP), or insert physical hardware taps without violating high-level protocol rules. Vesper approaches the problem from a physics-inspired perspective, analogizing network packet round-trips to bat echolocation. In any physical LAN, the transmission path between two endpoints (switches, transceivers, network cards, cables) establishes a unique channel impulse response characterized by propagation delay, hardware processing latency, and micro-jitter.

When an attacker establishes a MitM position, they inevitably alter this physical transmission channel by introducing an intermediate network interface, OS packet processing queues, and routing overhead. Vesper transmits low-overhead probe packets containing pseudo-random sequences, specifically Maximum Length Sequences (MLS). By correlating the transmitted sequence with the received echo, Vesper computes the channel's impulse response with nanosecond timing precision. The system extracts three distinct statistical features from each probe echo: one tracking temporal delay, one measuring channel distortion, and one detecting sequence manipulation. This multi-feature analysis prevents adversarial bypasses such as sequence replay or selective packet relaying.

The authors evaluated Vesper across hundreds of diverse network devices and operating systems, as well as a testbed of 48 identical Raspberry Pi devices. For mixed device environments, Vesper detected MitM spoofing attacks almost instantaneously; for the identical Raspberry Pis, it successfully fingerprinted and differentiated 75% of them after five minutes of continuous probing. The prototype is implemented in Python with a Cython/C++ wrapper for raw socket generation and nanosecond timing. Deployment options include running on individual LAN endpoints to monitor subnet hosts, or running directly on network routers and public Wi-Fi gateways to secure outbound traffic against interception.

Key Takeaways: Network defenders can detect local MitM attacks without relying on signature inspection or protocol-specific heuristics by monitoring channel impulse response changes. Vesper provides an effective, protocol-agnostic defense capable of exposing ARP poisoning, DNS spoofing, and rogue inline hardware. High-precision timing coupled with multi-feature averaging mitigates transient network noise and CPU load variations, making echo-analysis viable for enterprise LAN and gateway monitoring.

(AI summary — Gemini Flash)