# Detecting Malicious Devices in IPSEC Traffic with IPv4 Steganography
## 5 Results and Analysis
Figure 15 illustrates an exemplary setup of the alarm mechanism, outlining the configuration that dictates the activation criteria for alarms based on metric values. The configuration empowers the establishment of triggers, specifying conditions under which alarms are initiated. These triggers are tied to predefined thresholds and operate within designated time intervals. Such a setup enables administrators to receive alerts promptly in the event of malicious activity. Figure 14: Dashboards in Grafana. Figure 15: Creating threshold alert in Grafana. The determination of unauthorized traffic relies on the detection threshold. This threshold is predefined and configured by the network administrator, leveraging their expertise and insights into the current conditions within the network. The administrator's knowledge enables fine-tuning the detection mechanism, tailoring it to the unique characteristics of the network, and anticipating potential threats. This approach ensures flexibility in adapting the solution, allowing for a proactive response to evolving network conditions and emerging security challenges. The alarm is triggered once a metric surpasses the set threshold, as depicted in Figure 16.  
Apart from Grafana, there is also information about the MAC address received by the network element incorporating the described approach. Figure 17 illustrates an example of output information about a malicious node. This output includes the IP address from which an invalid packet was received. Additionally, it provides information about the MAC address of the malicious node and the destination MAC address, along with interface details indicating from which address the packet was sent. This information serves as a basis for various actions within the network. For instance, the network controller can take measures such as excluding the identified host from the network based on this data. An example of MAC address interception output is illustrated in Figure 17.  
Figure 16: Notification for fired alert. Figure 17: For example, MAC address interception output. In the realm of network security, the presented solution not only identifies but also enhances the network's ability to secure itself. Delving into the specifics, as showcased in the visual representation, the network gains a nuanced understanding of potential threats by capturing detailed information on malicious nodes. This includes key data points such as MAC addresses. When armed with this intelligence, the system can swiftly implement targeted responses, exemplified by dynamically isolating and excluding flagged hosts from the network. Implementing this sophisticated strategy metamorphoses the network into a vigilant protector, reinforcing its resilience against potential security vulnerabilities. In addition to detection tests, we conducted network overhead tests. The results are depicted in Figure 18, revealing an overhead ranging from 0.3 to a maximum of 1.4 milliseconds. We observed a slight increase in delay time as the volume of packets transmitted over the network increased. This delay is negligible, indicative of our approach introducing minimal overhead. This is attributed to the low computational complexity of our method.