Fortifying Network Security: A Machine Learning-Based Approach to Improving DHCP Snooping

Abstract

Dynamic Host Configuration Protocol (DHCP) spoofing remains a critical security threat in modern networks, particularly when attackers exploit the assumption that traffic from trusted ports is always legitimate. Conventional DHCP Snooping mechanisms are unable to detect rogue servers connected to trusted interfaces, leaving networks vulnerable to man-in-the-middle and denial-of-service attacks. To address this overlooked weakness, we propose a machine learning–based enhancement to DHCP Snooping. A custom dataset was generated from simulated DHCP traffic, capturing relevant protocol-level features while excluding trivial identifiers such as MAC addresses to ensure fair evaluation. Multiple classifiers—including Logistic Regression, Naive Bayes, Decision Tree, K-Nearest Neighbors, Support Vector Machine, Random Forest, and Gradient Boosting Trees—were implemented and evaluated using k-fold cross-validation. The results demonstrate that ensemble models achieved superior performance, with Random Forest and Gradient Boosting Trees reaching up to 100.0% accuracy on the full dataset and maintaining above 96.0% accuracy, precision, recall, and F1-score even when MAC-based features were excluded. Confusion matrix analysis further confirmed their robustness in distinguishing spoofed from legitimate traffic. In addition, we compared our models against a rule-based baseline resembling conventional DHCP Snooping, which achieved only ~70–75% detection accuracy. Finally, deployment considerations such as latency, model size, and fail-safe behavior are discussed, and the dataset and workflow are made available to support reproducibility. These contributions establish a practical and adaptive framework for strengthening DHCP Snooping against spoofing attacks in real-world networks. © Author(s) 2026.