# Detecting Malicious Devices in IPSEC Traffic with IPv4 Steganography
## 4 Test Scenarios Architecture  
IPsec has an integrity system to avoid injecting malicious ESP packets into the SA ESP packets flow: the anti-replay window [60; 61]. The principle is to check the packet's sequence information encoded into the ESP header's ESN field. If the security gateway (or host) detects repeated W packets within a reception window, it drops them. Figure 8: Modified malicious traffic packet sequence. This mechanism preserves the integrity of the inner IP flow after IPsec deencapsulation. Nevertheless, as the control of each packet within a large anti-replay window can require significant CPU consumption of the security gateway and repetition of missing packets and some transmission resources, it is possible to affect the complete decoding of an IPsec flow by flooding the interface of the security gateway with a considerable amount of repeated ESP packets. At least flooding will significantly increase latency and jitter of decoded IPsec application flow. A standard cyber defense will detect an increase in packets without being able to sort out valid and invalid packets. A security gateway will be able to raise some alerts on an increasing number of dropped packets due to anti-replay without being able to easily identify the hacking machine. By introducing steganography into ESP flow, we can:  
* detect along the IP path, the segment in which the malicious packets are introduced
* segregate before reaching the security, valid, and invalid packets. Figure 9 describes a classic network architecture in which we interconnect several LANs connected via several routers via IPsec (site-to-site case). We need at least two probes to control this IPsec flow in one direction. One is at the beginning of the flow, right after the security gateway encodes the steganography message. The other is just before the destination security gateway decodes the steganography message, checks its validity, drops the packet, and alerts the security agent. This probe deployment option allows for determining whether a DDoS attack is present but does not precisely locate the hacking machine. Figure 10 gives an example of architecture with this probe deployment option and a hacking machine in the network injecting malicious ESP packets into a router. To detect the corrupted transmission segment, more probes must be introduced to cover inter-router transmission segments. Additional probes are also needed to cover potential rerouting of IPsec flows through another path going through various routers due to link failure, for example. Figure 11 shows an example of steganography probe deployment covering all transmission links. Figure 9: The standard architecture of site-to-site IPsec connection over several networks. This configuration of probes allows for the better detection of malicious packets. For example, the listener probe of the bottom left router will detect that the hacking machine is somewhere on its supervised network segment. It also allows early network protection (either by dropping packets before reaching the last network segment or activating counter-security measures in the last router). Nevertheless, this deployment scheme of probes introduces additional complexity to message encoding/decoding: who generates the message into the hidden channel created using steganography from a send to a listener probe? The easiest solution is to manage the message \"per proximity\": a sender will encode a message for every next listener probe on its next routing table hopes (Figure 12). Figure 11: Use case with probes per inter-router link. Figure 10: Use case with two probes for controlling an IPSec flow with a hacker. The content of the message sent can be unique for every listener. The next hope is to identify the faulty network segment even more precisely. A last approach is to have an end-to-end unique message encoding per IPsec flow (from security gateway to destination security gateway) but with probes on each network segment. In this case, we must introduce a new probe type: the relay probe.