Methods, systems, and computer readable media for detecting covert timing channels

Abstract

A mechanism called time-deterministic replay (TOR) that can reproduce the execution of a program, including its precise timing. Without TOR, reproducing the timing of an execution is difficult because there are many sources of timing variability. TOR uses a combination of techniques to either mitigate or eliminate most of these sources of variability. Using a prototype implementation of TOR in a Java Virtual Machine, we show it is possible to reproduce the timing to within 1.85% of the original execution. A study of one of the applications of TOR is described: the detection of a covert timing channel. Timing channels can be used to exfiltrate information from a compromised machine by subtly varying timing of the machine's outputs, TOR can detect this variation. Unlike prior solutions, which generally look for a specific type of timing channel, our approach can detect a wide variety of channels with high accuracy.