# Detecting Malicious Devices in IPSEC Traffic with IPv4 Steganography
## 2 Network Steganography
### Prisoner Dilemma  
The prisoner's dilemma was first described by [PERSON] [18]. It is an anecdote that perfectly describes the essence of steganography--an attempt to carry out a hidden exchange of information. [PERSON] described the story of two prisoners held in separate and non-adjacent cells who would agree on a detailed plan to escape from the prison and warn each other of the threats posed by the guards. Their interactions are characterized by unstable communication and constant observation by guards assigned to report unusual behavior among prisoners. Prison communication would be difficult if cryptography were used to exchange information since the guards would view it as a conspiracy. Hence, cryptography is not a good way to secure messages exchanged by prisoners. Therefore, prisoners must use a method of conveying information that conceals this communication's existence--steganography. The entire communication process is illustrated in Figure 2.  
Before the arrest, prisoners have a message authentication scheme, which is done by entering redundant information by the sender. In such conditions, their communication must run through the subliminal channel, which enables the establishment of hidden communication between the sender and the recipient of an inconspicuous-looking message [19]. In practice, the prisoners are the sender and recipient of the message, while the guard is a network node that inspects the message using the deep packet inspection (DPI) functionality.  
In the communication channel, attempts to detect and counteract hidden communication are called steganalysis. It is usually carried out using the so-called wardens--network nodes equipped with deep packet inspection functionality. [PERSON] [20] describes the following behavior of the wardens:  
* Passive behavior--consists of monitoring messages sent through the communication channel without introducing changes to the message.
* Active behavior--consists of introducing changes to the messages transmitted in a way that does not modify the message's meaning or disrupt or limit communication between nodes that do not use steganographic methods.
* Malicious behavior--like active behavior, with the difference that counteracting hidden communication may lead to interruption, disruption, or restriction of communication between nodes that do not use steganographic methods.  
Additionally, there are three distinct countermeasures against covert channels [21]:  
Figure 2: Prisoner’s dilemma.  
* Functionality--Wardens counteract covert channels either passively by capturing traffic or actively by manipulating packets, with options for stateless or stateful processing and dynamic adaptation.
* Knowledge--Wardens use various types of information to detect covert channels, ranging from network awareness to being agnostic about the channel's characteristics. They might focus on particular patterns or threats or have pre-existing knowledge regarding how data is hidden.
* Localization--Wardens are deployed at specific locations within a network, ranging from local devices to cover large areas or adopting a distributed approach across multiple nodes. Modern wardens must scale to protect large network trunks and cooperate across replicas to detect threats effectively.  
In addition to the behaviors outlined by [PERSON], it is crucial to consider the active interference that wardens, such as [PERSON], could engage in within the communication channel. One such scenario involves [PERSON] substituting messages exchanged by the prisoners. By intercepting and altering the messages, [PERSON] could manipulate the flow of communication, potentially undermining the prisoners' plans or causing confusion, thus preventing the creation of a covert channel. Furthermore, [PERSON] could also fabricate messages that deceive the prisoners into believing they are communicating with each other when, in reality, they are interacting with [PERSON].