IMPLEMENTATION OF A CLIENT APPLICATION FOR IDENTIFYING THE «MAN-IN-THE-MIDDLE» ATTACKS AS A WINDOWS SYSTEM SERVICE

The purpose of this study is to develop a client-server application for identifying and prompt reacting to the attacks of the «man-in-the-middle» type. This application is intended for fine tuning the security policies for different network nodes. The method for this study is the development of a network utility program by means of object-oriented programming in C#, with the implementation of the software functionality at the level of classes and methods. A method for developing the functionality is proposed at the most abstract level – contracts or interfaces – with a description of the methods signature, which the class should implement. As a result of this study, a utility program has been developed, which acts as a Windows system service and analyzes the continuous data of a network node. This study describes the client application of this utility program. The utility program collects such parameters as DHCP server address; DNS server addresses; gateway address; IP address of the active computer; the name of the active computer; ARP table and the routing table. These network parameters are transmitted for further analysis and response to information security incidents. The practical value of this study is the development of the client application of this utility program. The implementation of a Windows system service in C#, which transmits data that helps revealing the attacks, which in turn helps identifying and analyzing the status of all network nodes (for example, computers of the same organization) as to detect a «man-in-themiddle » attack, such as: MAC spoofing; ARP Spoofing; Evil Twin; DHCP Spoofing; ICMP Redirect; DNS Spoofing; configuration of hacked router. The result of running the application could be observed in the Windows logs through Event Viewer application.