Learn ARP Spoofing Attack in a Game

Abstract

Local Area Network (LAN) access is the top vector for insider threats and misuses. It is critical for students to learn these vulnerabilities and know the common countermeasures. Although some educational tools exist that are effective in teaching ARP spoofing, they are usually hard to access and not fun enough to engage students. Gamification has been successfully used in many areas of education to engage students in learning. Gamification can provide educational and immersive experiences to the students. To our knowledge, there is no game developed to teach LAN and ARP spoofing concepts. In this paper, we present a gamification of this subject with an escape-the-room style game to teach LAN and ARP spoofing attacks. The game is developed with the Unity game engine and deployed on the world wide web. Therefore, the game is accessible anywhere on the Internet with a web browser. The game has several levels of difficulty that guide learning from the basics of LAN to the countermeasures. This game’s primary learning objectives are 1) Learn how switches and hubs work, and how ARP protocol works; 2) Learn how ARP spoofing works; 3) Learn the counter measures against LAN attacks. The game would be hosted on the Web and students would be allowed to play online using the web link and provide feedback. The game is presented in the form of a 3-level building. Each level has multiple rooms where each room holds the content to learn on a different concept. The player must go through each concept and answer the quiz questions before the player can move to the next room. At the end of each level, the player will get additional challenges to complete to move to the next level. The game events which describe the player’s interaction with the game will be logged and submitted for further future analysis through the GameSparks. Once the player completes all the levels, the player will enter the post-assessment stage, where they will complete a post-test and survey. The post-assessment results will be automatically collected and submitted for quantitative analysis.