C2Detector: a covert channel detection framework in cloud computing. Issue 3 (8th May 2013)

• Record Type: Journal Article
• Authors: Wu, Jingzheng; Ding, Liping; Wu, Yanjun; Min‐Allah, Nasro; Khan, Samee U.; Wang, Yongji
• Is Part Of: Security and communication networks. Volume 7:Issue 3(2014:Mar.)
• Page Start: 544
• Page End: 557
• Publication Date: 2013-05-08
• Subjects: Computer networks -- Security measures -- Periodicals; Computer security -- Periodicals; Cryptography -- Periodicals; 005.805
• DOI: 10.1002/sec.754
• Languages: English
• ISSNs: 1939-0114

Abstract

<abstract abstract-type="main"> <title>ABSTRACT</title> <p>Cloud computing is becoming increasingly popular because of the dynamic deployment of computing service. Another advantage of cloud is that data confidentiality is protected by the cloud provider with the virtualization technology. However, a covert channel can break the isolation of the virtualization platform and leak confidential information without letting it known by virtual machines. In this paper, the threat model of covert channels is analyzed. The channels are classified into three categories, and only the category that is new to cloud computing is concerned, for example, CPU load‐based, cache‐based, and shared memory‐based covert channels. The covert channel scenario is modeled into an error‐corrected four‐state automaton, and two error‐corrected algorithms are designed. A new detection framework termed C<sup>2</sup>Detector is presented. C<sup>2</sup>Detector includes a captor located in the hypervisor and a two‐phase synthesis algorithm implemented as Markov and Bayesian detectors. A prototype of C<sup>2</sup>Detector is implemented on Xen hypervisor, and its performance of detecting the covert channels is demonstrated. The experiment results show that C<sup>2</sup>Detector can detect the three types of the covert channels with an acceptable false positive rate by using a pessimistic threshold. Moreover, C<sup>2</sup>Detector is a plug‐in framework and can be easily extended. It is believed that new covert channels can be detected by C<sup>2</sup>Detector in the future. Copyright © 2013 John Wiley & Sons, Ltd.</p> </abstract>