Automatic Detection of Covert Channels in Networks

A covert channel is a mechanism that can be used to violate a security policy by allowing information to leak to an unauthorized process. Two types of covert channels exist storage and timing channels. A storage channel involves the direct or indirect writing of a storage location by one process and the direct or indirect reading of the storage by another process. A timing channel involves a sender process that signals information to another by modulating its own use of systems resources in such a way that this manipulation affects the real response time observed by the second process. In this research, we focused on the analysis and detection of covert timing channels in the TCPIP protocol suite.