# Detecting Malicious Devices in IPSEC Traffic with IPv4 Steganography
## 2 Network Steganography
### Steganography for OSI RM Model  
The Open Systems Interconnection Reference Model (OSI RM) was created to standardize how information flows over IP networks [25]. It separated the communication process into seven layers. The network steganography technique allows the construction of concealed communication channels and covert communication between network users in each of the OSI RM model's layers. Table 1 presents an overview of existing methods in the literature. * Physical Layer--compared to the higher layers of the OSI RM model, covert channels in the lower layers are more challenging to execute and, hence, harder to find. One of the network steganography methods that uses the communication channel's physical characteristics is the wireless padding (WiPad) method for wireless local area networks (WLANs). This method consists of filling bits into the padding of transmission symbols. Another solution has been proposed, which is using DFT-precoded OFDM. The authors suggested sending a cover signal in addition to the weak secret signal rather than delivering the weak signal to the authorized recipient. In [27], the author proposed using the PHY Service Data Unit field, where seven of eight bits are used. The data can be hidden because one bit is reserved and not used. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**OSI Layer** & **Name** & **Medium/Protocol** & **Capacity** & **Reference Number** \\ \hline \multirow{3}{*}{Physical} & WiPad & OFDM & 1.54 Mbit/s & [26] \\  & - & PHY frame & 1 bit/packet & [27] \\  & - & DFT-precoded OFDM & - & [28] \\ \hline \multirow{3}{*}{Data link} & HICCUPS & & 44–216 kbit/s & [17] \\  & - & MAC frames & 1–22 bytes/frame & [27] \\ \hline \multirow{3}{*}{Network} & - & IPv4 & max 4 bytes/packet & [29; 30; 31; 32; 33] \\  & - & IPv6 & max 140 bits/packet & [34; 35; 36] \\  & ICMPStegano & ICMP & max 60 bytes/packet & [37] \\  & ARPNetSteg & ARP & 44 bits/packet & [38] \\  & PadSteg & ARP + TCP & 32 bit/s & [39] \\ \hline \multirow{3}{*}{Transport} & RSTEG & TCP & \textasci{-}max 1.4 kB/packet & [40] \\  & - & TCP & 30 bits/packet & [41; 42] \\  & - & UDP & 4 bits/packet & [43] \\  & - & SCTP & 10–500 bits/s & [44] \\ \hline \multirow{3}{*}{Session} & - & SIP + SDP & 2.36 kbit/VolP call & [45] \\  & - & SIP & 464–1856 kbit/s & [46] \\ \hline \multirow{3}{*}{Application} & LACK & VoIP (RTP) & max 590 bits/s & [48] \\  & TranSteg & VoIP (RTP) & \textasci{-}32 kbit/s & [49] \\ \cline{1-1}  & - & HTTP & 2–230 bit/connection & [50] \\ \cline{1-1}  & - & SSH & 12 bytes/packet & [51] \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Network steganography methods in literature. Data Link Layer--steganography at the data link layer can be implemented using methods based on the use of transmission frames with intentionally erroneous check-sums. The HICCUPS method, which uses the mentioned mechanism, was proposed. In ICT networks, frames with erroneous checksums are rejected by physical drivers (network cards), while cards aware of using steganographic methods can read such packets and extract secret data from the frame. An interesting solution was proposed, which was to hide data in MAC frames. We can achieve different capacities based on chosen frames: the data frame, the beacon frame, the acknowledgement frame, and the MAC command frame. In [52], the authors proposed a network access point authentication mechanism that leverages beacon frames and timestamp fields, exploiting the least significant bits of these fields. * Network Layer--the most popular protocol to hide data in the network layer is IPv4. The authors propose several methods based on hiding data in creating covert channels, such as hiding data in the identification field, overflowing the timestamp option field, and using time-to-live or flags. [PERSON] [33] summarized the possibilities of using individual header fields of the IPv4 protocol. Another interesting approach is steganography with IPv6.