An Intelligent SDN-Enabled Framework for Real-Time IPv6 IP Spoofing Detection and Prevention
Article Sidebar
Main Article Content
Abstract
With the increase in the adoption of Internet Protocol version 6 (IPv6), the issue of Internet Protocol (IP) spoofing has remained a significant risk that damages the integrity of networks. Although some countermeasures, like Secure Neighbor Discovery (SEND) and Router Advertisement (RA) Guard, are available, these solutions are complex to deploy, consume high resources, and can be bypassed by advanced attacks. This paper provides a critical review of the available IPv6 spoofing prevention methods and proposes an enhanced multi-layered framework that uses improved ingress and egress filtering, Artificial Intelligence (AI)-based anomaly detection, and Software-Defined Networking (SDN) to automatically mitigate threats in real time. The enhanced framework is precisely identifying spoofed traffic, whereas SDN dynamically applies policies in the network to isolate and block malicious sources without affecting legitimate traffic. The framework is implemented over a Mininet and Docker-based setup in which it is tested under controlled and real-world traffic conditions. It had an average precision and recall of 0.98 with an F1-score of 0.97 and a prevention latency averaging less than 0.4 seconds. Through the centralized traffic visibility provided by SDN and the pattern recognition capabilities of Machine Learning (ML), the proposed framework adjusts smoothly to traffic changes and new spoofing techniques. Its modular architecture allows it to be integrated into existing systems and deployed in a manner that does not interfere with the flow of operations. The proposed solution is better in robustness, scalability, and adaptability than any traditional static filtering approach, and therefore it is a practical approach to enhance security in both dual-stack and IPv6-only network environments. This research provides practical implications and further highlights the possibility of ML and SDN contributions in the creation of proactive IPv6 security systems
Article Details
This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.
All articles published in JIWE are licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International (CC BY-NC-ND 4.0) License. Readers are allowed to
- Share — copy and redistribute the material in any medium or format under the following conditions:
- Attribution — You must give appropriate credit, provide a link to the license, and indicate if changes were made. You may do so in any reasonable manner, but not in any way that suggests the licensor endorses you or your use;
- NonCommercial — You may not use the material for commercial purposes;
- NoDerivatives — If you remix, transform, or build upon the material, you may not distribute the modified material.
References
[1] Y. Almukhtar and N. Ahmed, "IPv4 address exhaustion: Mitigation strategies, architectural trade-offs, and IPv6 transition challenges," AlQalam Journal of Medical and Applied Sciences, pp. 1522–1526, 2026, doi: 10.54361/ajmas.269610.
[2] O. A. Akano, T. O. Olayinka, O. D. Adeniji, and B. O. Ogunjinmi, "Mitigating insider threat's IP spoofing through enhanced dynamic cluster algorithm (EDPU Based HCF)," AIR, vol. 25, no. 3, pp. 85–90, Mar. 2024, doi: 10.9734/air/2024/v25i31052.
[3] N. C. Arjuman, M. U. B. M. Yusof, Z. C. Hlaing, and S. Salih, "Enhanced mechanism for neighbor discovery protocol table exhaustion attacks in IPv6 networks," in TENCON 2025 - 2025 IEEE Region 10 Conference (TENCON), 2025, pp. 1773–1777, doi: 10.1109/TENCON66050.2025.11374974.
[4] V. Boopathi, A. Balamurugan, M. Deenan, and A. Hemlathadhevi, "A behavioral-based MAC spoofing detection system," International Journal of Applied Smart Interdisciplinary Technologies (IJASIT), vol. 1, no. 1, pp. 49–55, 2026. Available: https://ijasit.org/index.php/home/article/view/9.
[5] F. Najjar, Q. Bsoul, and H. Al-Refai, "An analysis of neighbor discovery protocol attacks," Computers, vol. 12, no. 6, pp. 125, Jun. 2023, doi: 10.3390/computers12060125.
[6] R. Kartheek, B. S. K. Raju, D. J. Sonia, and P. Gopinadh, "Classifying IP spoofing requests using heuristic fuzzy computer network approach," International Journal for Multidisciplinary Research, vol. 6, no. 2, Mar. 2024, doi: 10.36948/ijfmr.2024.v06i02.15111.
[7] M. N. Hoda, Bharati Vidyapeeth's Institute of Computers Applications and Management, and Institute of Electrical and Electronics Engineers, Eds., Proceedings of the 17th INDIACom; 2023 10th International Conference on Computing for Sustainable Global Development (15th-17th March, 2023): INDIACom-2023. Piscataway, NJ: IEEE, 2023.
[8] M. H. Ali and S. Al-Alak, "Using unique node ID to control IPv6 ID spoofing," Journal of Physics Conference Series, vol. 1999, no. 1, pp. 012120, 2021, doi: 10.1088/1742-6596/1999/1/012120.
[9] J. S. Nixon and M. Amenu, "Investigating security issues and preventive mechanisms in IPv6 deployment," International Journal of Advanced Engineering and Nano Technology, vol. 9, no. 2, pp. 1–20, 2022, doi: 10.35940/ijaent.b0466.029222.
[10] M. U. Shreehitha and K. V, "Comparative analysis of routing protocols and IP traffic management using ACL," International Journal of Engineering Applied Sciences and Technology, vol. 6, no. 5, 2021, doi: 10.33564/ijeast.2021.v06i05.014.
[11] M. A. Al-Shareeda, S. Manickam, M. A. Saare, and N. C. Arjuman, "Proposed security mechanism for preventing fake router advertisement attack in IPv6 link-local network," Indonesian Journal of Electrical Engineering and Computer Science, vol. 29, no. 1, pp. 518, 2022, doi: 10.11591/ijeecs.v29.i1.pp518-526.
[12] A. Al-Ani, A. K. Al-Ani, S. A. Laghari, S. Manickam, K. W. Lai, and K. Hasikin, "NDPsec: Neighbor discovery protocol security mechanism," IEEE Access, vol. 10, pp. 83650–83663, 2022, doi: 10.1109/ACCESS.2022.3196028.
[13] Z. T. Puhl and J. Guo, "Securing IPv6 neighbor discovery address resolution with voucher-based addressing," Network, vol. 4, no. 3, pp. 338–366, Aug. 2024, doi: 10.3390/network4030016.
[14] M. Monnich, N. S. Bulbul, D. Ergenc, and M. Fischer, "Mitigation of IPv6 router spoofing attacks with P4," in Proceedings of the Symposium on Architectures for Networking and Communications Systems, ACM, Dec. 2021, pp. 144–150, doi: 10.1145/3493425.3502765.
[15] H. Nasser and M. A. Hussain, "An effective approach to detect and prevent ARP spoofing attacks on WLAN," Iraqi Journal for Electrical and Electronic Engineering, vol. 19, no. 2, pp. 8–17, 2023, doi: 10.37917/ijeee.19.2.2.
[16] S. Kianpisheh and T. Taleb, "A survey on in-network computing: Programmable data plane and technology specific applications," IEEE Communications Surveys & Tutorials, vol. 25, no. 1, pp. 701–761, 2023, doi: 10.1109/comst.2022.3213237.
[17] A. Karakoc and F. Alagoz, "LSAV: Lightweight source address validation in SDN to counteract IP spoofing-based DDoS attacks," Turkish Journal of Electrical Engineering and Computer Sciences, vol. 31, no. 7, pp. 1187–1205, Nov. 2023, doi: 10.55730/1300-0632.4042.
[18] A. A. Bahashwan, M. Anbar, S. Manickam, T. A. Al-Amiedy, M. A. Aladaileh, and I. H. Hasbullah, "A systematic literature review on machine learning and deep learning approaches for detecting DDoS attacks in software-defined networking," Sensors, vol. 23, no. 9, pp. 4441, 2023, doi: 10.3390/s23094441.
[19] N. C. Arjuman, S. Manickam, and S. Karuppayah, "An improved secure router discovery mechanism to prevent fake RA attack in link local IPv6 network," Communications in Computer and Information Science, pp. 248–276, 2021, doi: 10.1007/978-981-16-8059-5_15.
[20] J. Wang, L. Wang, and R. Wang, "A method of DDoS attack detection and mitigation for the comprehensive coordinated protection of SDN controllers," Entropy, vol. 25, no. 8, pp. 1210, 2023, doi: 10.3390/e25081210.