C2Detector: a covert channel detection framework in cloud computing

Cloud computing is becoming increasingly popular because of the dynamic deployment of computing service. Another advantage of cloud is that data confidentiality is protected by the cloud provider with the virtualization technology. However, a covert channel can break the isolation of the virtualization platform and leak confidential information without letting it known by virtual machines. In this paper, the threat model of covert channels is analyzed. The channels are classified into three categories, and only the category that is new to cloud computing is concerned, for example, CPU load-based, cache-based, and shared memory-based covert channels. The covert channel scenario is modeled into an error-corrected four-state automaton, and two error-corrected algorithms are designed. A new detection framework termed CDetector is presented. CDetector includes a captor located in the hypervisor and a two-phase synthesis algorithm implemented as Markov and Bayesian detectors. A prototype of CDetector is implemented on Xen hypervisor, and its performance of detecting the covert channels is demonstrated. The experiment results show that CDetector can detect the three types of the covert channels with an acceptable false positive rate by using a pessimistic threshold. Moreover, CDetector is a plug-in framework and can be easily extended. It is believed that new covert channels can be detected by CDetector in the future. Copyright © 2013 John Wiley & Sons, Ltd.