A novel covert channel detection method in cloud based on XSRM and improved event association algorithm. Issue 16 (18th July 2016)

• Record Type: Journal Article
• Authors: Wang, Lina; Liu, Weijie; Kumar, Neeraj; He, Debiao; Tan, Cheng; Gao, Debin
• Is Part Of: Security and communication networks. Volume 9:Issue 16(2016)
• Page Start: 3543
• Page End: 3557
• Publication Date: 2016-07-18
• Subjects: cloud security -- covert channel detection -- shared resource matrix -- event association analysis; Computer networks -- Security measures -- Periodicals; Computer security -- Periodicals; Cryptography -- Periodicals; 005.805
• DOI: 10.1002/sec.1560
• Languages: English
• ISSNs: 1939-0114

Abstract

Abstract: Covert channel is a major threat to the information system security and commonly found in operating systems, especially in cloud computing environment. Owing to the characteristics in cloud computing environment such as resources sharing and logic boundaries, covert channels become more varied and difficult to find. Focusing on those problems, this paper presents a universal method for detecting covert channel automatically. To achieve a global detection, we leveraged a virtual machine event record mechanism in hypervisor to gather necessary metadata. Combining the shared resources matrix methodology with events association mechanism, we proposed a distinctive algorithm that can accurately locate and analyze malicious covert channels from the respect of behaviors. Compared with the popular statistical test methods focusing on the single covert channel, our method is capable of recognizing and detecting more covert channels in real time. Experimental results show that this method is not only able to detect multilevel and multiform covert channels in cloud environment effectively but also facilitates the implementation and deployment in practical scenarios without modifying the existing system. Copyright © 2016 John Wiley & Sons, Ltd. Abstract : This paper presents a universal method for detecting covert channel in cloud environment automatically. Combining the shared resources matrix methodology with events association mechanism, we proposed a distinctive algorithm that can accurately locate malicious covert channel exploitations. Experimental results show that this method not only has a high detection rate but also facilitates its deployment in practical scenarios.