# Detecting Malicious Devices in IPSEC Traffic with IPv4 Steganography
## 2 Network Steganography
### Steganography for OSI RM Model
This technique leverages specific fields within the protocol, namely the traffic class, flow label, and source IPv6 address. An ICMP-based approach has been suggested; however, it has not gained as much popularity as other protocols, possibly due to its limited number of header fields. Additionally, methods utilizing ARP have been developed. However, ARPNetSteg, a technique employing covert communication through ARP spoofing, can also be implemented in the data link layer, as it does not strictly belong to either layer. The method involves synchronized generation of lists of unallocated local IP addresses using a shared seed value, enabling sender and receiver devices to exchange covert data by manipulating ARP requests and replies, with embedded control information indicating the sender's intent to transmit additional covert data. An alternative approach is the PadSteg method, which employs both ARP and TCP protocols. In this technique, a steganogram is embedded into the padding of Ethernet frames, requiring examination of the respective layer protocols (ARP or TCP) to ascertain the presence of secret data. * Transport Layer--the current networking advancements propose techniques for modifying TCP headers. Specifically, the fields open to modification include the reserved field and the urgent pointer field. Another interesting technique of network steganography in the TCP protocol is the retransmission steganography (RSTEG) method. The method rejects acknowledgement of successfully received segments to trigger retransmission intentionally. The retransmitted packet contains secret information hidden in the data field. The possible steganographic throughput per packet is about 1.4 kbit. The maximum possible bandwidth of the RSTEG method is even 8 kbit/s, with a targeted level of packet retransmission reaching 5%, where the average level of retransmission on the internet is 3-7%. Additionally, a method based on UDP has been suggested, wherein hidden data is transmitted within the length of the network packets. However, UDP introduces randomness in the packets since there is no ACK functionality like in TCP. Another usage is the stream control transmission protocol (SCTP), which was developed to replace the TCP protocol. The authors proposed methods that modify the content of packets and the way they are exchanged and hybridized for both scenarios. * Session Layer--tokens and fields within the SIP protocol were suggested for concealing data. An alternative covert channel involves manipulating header order or combining upper and lower-case letters in SIP headers. The authors recommend establishing concealed channels for SIP and the closely associated SDP protocols, incorporating security measures to guarantee authentication and confidentiality for sensitive information. The authors attained a throughput of 10 to 500 bits per second in their experimental scenario. However, authors in [40] calculated the number of SIPmessages that can be sent without raising the alarm and achieved 464 to 1856 kbit/s based on the test scenario. * Presentation Layer--the multimedia elements may function as covert data transport channels. Since multimedia files frequently include vast amounts of data, they make appealing hosts for secret data storage. In [47], the author presents examples of embedding concealed information within images, audio files, and texts. Various techniques, such as Least Significant Bit (LSB), phase coding, and echo data hiding, can be employed. It is important to note that these techniques are not exclusive to network steganography. Instead, they pertain to steganography across visual, audio, and text mediums, with the concealed data subsequently transmitted over a network for decoding the steganogram on the recipient's end. * Application Layer--this layer is the uppermost and is responsible for the user interface. One of the most popular and most used protocols is the Hypertext Transfer Protocol. Authors in [50] proposed nine new covert channels.