Real-time GPU-based timing channel detection using entropy

Abstract

Abstract-As line rates continue to grow, network security applications such as covert timing channel (CTC) detection must utilize new techniques for processing network flows in order to protect critical enterprise networks. GPU-based packet processing provides one means of scaling the detection of CTCs and other anomalies in network flows. In this paper, we implement a GPUbased detection tool, capable of detecting model-based covert timing channels (MBCTCs). The GPU's ability to process a large number of packets in parallel enables more complex detection tests, such as the corrected conditional entropy (CCE) test-a modified version of the conditional entropy measurement, which has a variety of applications outside of covert channel detection. In our experiments, we evaluate the CCE test's true and false positive detection rates, as well as the time required to perform the test on the GPU. Our results demonstrate that GPU packet processing can be applied successfully to perform real-time CTC detection at near 10 Gbps with high accuracy.

Real-Time Detection of Storage Covert Channels

“…Gegan et al [GAOG16] take a similar approach to this thesis in that they use known tests and build a detector that manages to operate in real-time by using specialized hardware. However, they use GPUs rather than FPGAs and try to detect timing covert channels rather than storage covert channels.…”