Detecting Covert Timing Channels with Time-Deterministic Replay
نویسندگان
چکیده
This paper presents a mechanism called timedeterministic replay (TDR) that can reproduce the execution of a program, including its precise timing. Without TDR, reproducing the timing of an execution is difficult because there are many sources of timing variability – such as preemptions, hardware interrupts, cache effects, scheduling decisions, etc. TDR uses a combination of techniques to either mitigate or eliminate most of these sources of variability. Using a prototype implementation of TDR in a Java Virtual Machine, we show that it is possible to reproduce the timing to within 1.85% of the original execution, even on commodity hardware. The paper discusses several potential applications of TDR, and studies one of them in detail: the detection of a covert timing channel. Timing channels can be used to exfiltrate information from a compromised machine; they work by subtly varying the timing of the machine’s outputs, and it is this variation that can be detected with TDR. Unlike prior solutions, which generally look for a specific type of timing channel, our approach can detect a wide variety of channels with high accuracy. Disciplines Computer Engineering | Computer Sciences Comments 11th USENIX Symposium on Operating Systems Design and Implementation (OSDI), Broomfield, CO, October 2014. Author(s) Ang Chen, W. Brad Moore, Hanjun Xiao, Andreas Haeberlen, Linh T.X. Phan, Micah Sherr, and Wenchao Zhou This conference paper is available at ScholarlyCommons: http://repository.upenn.edu/cis_papers/796 Detecting Covert Timing Channels with Time-Deterministic Replay
منابع مشابه
A Covert Channel Based on Web Read-time Modulation
A network covert channel is created that operates by modulating the time between web resource accesses, with an “average web user” read-time used as a reference. While the covert channel may be classified as timing based, it does not operate by changing deterministic protocol attributes such as inter-packet delay, as do most timing based network covert channels. Instead, our channel communicate...
متن کاملEmploying Entropy in the Detection and Monitoring of Network Covert Channels
The detection of covert channels has quickly become a vital need due to their pervasive nature and the increasing popularity of the Internet. In recent years, new and innovative methods have been proposed to aid in the detection of covert channels. Existing detection schemes are often too specific and are ineffective against new covert channels. In this paper, we expound upon previous work done...
متن کاملDecision Tree Rule Induction for Detecting Covert Timing Channels in TCP/IP Traffic
The detection of covert channels in communication networks is a current security challenge. By clandestinely transferring information, covert channels are able to circumvent security barriers, compromise systems, and facilitate data leakage. A set of statistical methods called DAT (Descriptive Analytics of Traffic) has been previously proposed as a general approach for detecting covert channels...
متن کاملDetection of Covert Channel Encoding in Network Packet Delays
Covert channels are mechanisms for communicating information in ways that are difficult to detect. Data exfiltration can be an indication that a computer has been compromised by an attacker even when other intrusion detection schemes have failed to detect a successful attack. Covert timing channels use packet interarrival times, not header or payload embedded information, to encode covert messa...
متن کاملMethods of IPD normalization to counteract IP timing covert channels
Covert channels are used for information transmission in a manner that is not intended for communication and is difficult to detect. We propose a technique to prevent the information leakage via IP covert timing channels by inter-packet delays normalization in the process of packets sending. Recommendations for using the counteraction methods and choosing parameters were given. The advantage of...
متن کامل