  Increasing activity and the number of devices online are leading to
increasing and more diverse cyber attacks. This continuously evolving attack
activity makes signature-based detection methods ineffective. Once malware has
infiltrated into a LAN, bypassing an external gateway or entering via an
unsecured mobile device, it can potentially infect all nodes in the LAN as well
as carry out nefarious activities such as stealing valuable data, leading to
financial damage and loss of reputation. Such infiltration could be viewed as
an insider attack, increasing the need for LAN monitoring and security. In this
paper we aim to detect such inner-LAN activity by studying the variations in
Address Resolution Protocol (ARP) calls within the LAN. We find anomalous nodes
by modelling inner-LAN traffic using hierarchical forecasting methods. We
substantially reduce the false positives ever present in anomaly detection, by
using an extreme value theory based method. We use a dataset from a real
inner-LAN monitoring project, containing over 10M ARP calls from 362 nodes.
Furthermore, the small number of false positives generated using our methods,
is a potential solution to the "alert fatigue" commonly reported by security
experts.
