# Detecting Malicious Devices in IPSEC Traffic with IPv4 Steganography
## 5 Results and Analysis  
In most cases where network steganography is employed, maximizing bandwidth, undetectability, and robustness are primary objectives. However, our priorities differ in our approach, which centers on detecting malicious traffic. Rather than emphasizing robustness and undetectability, our focus lies in maximizing bandwidth and the ability to detect changes. We aim to prevent malicious traffic from coincidentally matching predefined signatures. Here, we utilize a 2-byte identification field and allocate 2 bits to the time-to-live field, resulting in an effective bandwidth of 18 bits. If we expand to utilize all bits in the TTL field, the bandwidth increases to 3 bytes, allowing for \(2^{24}\) distinct values. This expansion significantly reduces the chance of overlap with predefined signatures in malicious traffic injection scenarios. Detecting a 3-byte signature that varies with each packet is practically feasible only if the signature generation method is known. The solution exploits containerization technology via Docker, wherein Docker containers play host to the Visualization and Alert Service components. These components, constructed using Pushgateway, Prometheus, and Grafana, are responsible for visualizing and monitoring metrics to detect malicious traffic. The presented solution funnels metrics obtained during the steganographic message detection process to the Pushgateway. This gateway, serving ephemeral and batch jobs, facilitates Prometheus's metrics collection. Prometheus, acting as a monitoring and alerting toolkit, scrapes and stores metrics, making them queryable and available for alerting. Grafana is employed to craft dashboards that present the collected metrics in a user-friendly format, allowing the creation of customizable visualizations, graphs, and charts. Within the solution architecture, the Pushgateway is a data ingestion gateway. It facilitates collecting and aggregating time-series metrics generated by both ephemeral and batch jobs. Metrics are \"pushed\" toward the Pushgateway, which mediates data sources and Prometheus. Prometheus operates as both a time-series database and a monitoring system. It collects, stores, and querying of metrics from diverse sources, including the Pushgateway. By employing a pull-based model, Prometheus regularly scrapes metrics endpoints, storing the acquired metrics in its data repository for historical analysis and querying. Grafana complements the solution and serves as a potent visualization and dashboarding platform. It retrieves metric data from Prometheus, empowering users to create personalized, interactive dashboards. Grafana supports various visualization types, such as graphs, charts, and tables, fostering insightful interpretation of monitored metrics. The synergistic utilization of Pushgateway, Prometheus, and Grafana furnishes a comprehensive solution for real-time monitoring, collection, storage, and visualization of time-series metrics. The network administrator can derive insights into system performance, diagnose issues, and proactively respond to anomalies. Alert capabilities ensure timely notification of critical incidents or deviations from predefined baselines, streamlining efficient incident response and problem resolution. The figures below present the dashboards generated by Grafana. These dashboards showcase crucial metrics, including the count of packets with detected steganographic content (Metric A) and the count of packets without detected steganographic content (Metric B). These metrics serve as indicators of steganographic message presence and activity. The detection ratio, derived by dividing Metric A by Metric B, offers insights into the efficacy of the steganographic detection process. Grafana facilitates the generation of alarms based on predefined threshold values, triggering notifications or actions when metrics breach specified limits. Elevated values of Metric B and the detection ratio signify potential attacks, establishing it as a valuable tool for monitoring and response (Figure 14).