Detecting covert timing channels with time-deterministic replay

摘要: This paper presents a mechanism called time-deterministic replay (TDR) that can reproduce the execution of program, including its precise timing. Without TDR, reproducing timing an is difficult because there are many sources variability - such as preemptions, hardware interrupts, cache effects, scheduling decisions, etc. TDR uses combination techniques to either mitigate or eliminate most these variability. Using prototype implementation in Java Virtual Machine, we show it possible within 1.85% original execution, even on commodity hardware.The discusses several potential applications and studies one them detail: detection covert channel. Timing channels be used exfiltrate information from compromised machine; they work by subtly varying machine's outputs, this variation detected with TDR. Unlike prior solutions, which generally look for specific type channel, our approach detect wide variety high accuracy.