%0 Conference Proceedings
%T Real-Time Covert Timing Channel Detection in Networked Virtual Environments
%+ Indiana University-Purdue University Fort Wayne (IPFW)
%+ George Mason University [Fairfax]
%A Liu, Anyi
%A Chen, Jim
%A Wechsler, Harry
%Z Part 5: NETWORK FORENSICS
%< avec comité de lecture
%( IFIP Advances in Information and Communication Technology
%B 9th International Conference on Digital Forensics (DF)
%C Orlando, FL, United States
%Y Gilbert Peterson
%Y Sujeet Shenoi
%I Springer
%3 Advances in Digital Forensics IX
%V AICT-410
%P 273-288
%8 2013-01-28
%D 2013
%R 10.1007/978-3-642-41148-9_19
%K Covert timing channels
%K detection
%K virtual environments
%Z Computer Science [cs]Conference papers
%X Despite extensive research on malware and Trojan horses, covert channels are still among the top computer security threats. These attacks, which are launched using specially-crafted content or by manipulating timing characteristics, transmit sensitive information to adversaries while remaining undetected. Current detection approaches typically analyze deviations from legitimate network traffic statistics. These approaches, however, are not applicable to highly dynamic, noisy environments, such as cloud computing environments, because they rely heavily on historical traffic and tedious model training. To address these challenges, we present a real-time, wavelet-based approach for detecting covert timing channels. The novelty of the approach comes from leveraging a secure virtual machine to mimic a vulnerable virtual machine. A key advantage is that the detection approach does not require historical traffic data. Experimental results demonstrate that the approach exhibits good overall performance, including a high detection rate and a low false positive rate.
%G English
%Z TC 11
%Z WG 11.9
%2 https://inria.hal.science/hal-01460611/document
%2 https://inria.hal.science/hal-01460611/file/978-3-642-41148-9_19_Chapter.pdf
%L hal-01460611
%U https://inria.hal.science/hal-01460611
%~ IFIP-LNCS
%~ IFIP
%~ IFIP-AICT
%~ IFIP-TC
%~ IFIP-WG
%~ IFIP-TC11
%~ IFIP-DF
%~ IFIP-WG11-9
%~ IFIP-AICT-410