<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-01460611</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-21T05:57:38+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">Real-Time Covert Timing Channel Detection in Networked Virtual Environments</title>
            <author role="aut">
              <persName>
                <forename type="first">Anyi</forename>
                <surname>Liu</surname>
              </persName>
              <idno type="halauthorid">1128496-0</idno>
              <affiliation ref="#struct-483562"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Jim</forename>
                <surname>Chen</surname>
              </persName>
              <idno type="halauthorid">1128497-0</idno>
              <affiliation ref="#struct-452410"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Harry</forename>
                <surname>Wechsler</surname>
              </persName>
              <idno type="halauthorid">1128498-0</idno>
              <affiliation ref="#struct-452410"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Hal</forename>
                <surname>Ifip</surname>
              </persName>
              <email type="md5">2073ac78024b6e13f2714db96e9b1e63</email>
              <email type="domain">inria.fr</email>
            </editor>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2017-02-07 17:26:01</date>
              <date type="whenModified">2020-03-05 16:46:39</date>
              <date type="whenReleased">2017-02-07 17:32:40</date>
              <date type="whenProduced">2013-01-28</date>
              <date type="whenEndEmbargoed">2016-01-01</date>
              <ref type="file" target="https://inria.hal.science/hal-01460611v1/document">
                <date notBefore="2016-01-01"/>
              </ref>
              <ref type="file" subtype="author" n="1" target="https://inria.hal.science/hal-01460611v1/file/978-3-642-41148-9_19_Chapter.pdf" id="file-1460611-1532808">
                <date notBefore="2016-01-01"/>
              </ref>
              <ref type="externalLink" target="https://link.springer.com/content/pdf/10.1007%2F978-3-642-41148-9_19.pdf"/>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="200187">
                <persName>
                  <forename>Hal</forename>
                  <surname>Ifip</surname>
                </persName>
                <email type="md5">2073ac78024b6e13f2714db96e9b1e63</email>
                <email type="domain">inria.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-01460611</idno>
            <idno type="halUri">https://inria.hal.science/hal-01460611</idno>
            <idno type="halBibtex">liu:hal-01460611</idno>
            <idno type="halRefHtml">&lt;i&gt;9th International Conference on Digital Forensics (DF)&lt;/i&gt;, Jan 2013, Orlando, FL, United States. pp.273-288, &lt;a target="_blank" href="https://dx.doi.org/10.1007/978-3-642-41148-9_19"&gt;&amp;#x27E8;10.1007/978-3-642-41148-9_19&amp;#x27E9;&lt;/a&gt;</idno>
            <idno type="halRef">9th International Conference on Digital Forensics (DF), Jan 2013, Orlando, FL, United States. pp.273-288, &amp;#x27E8;10.1007/978-3-642-41148-9_19&amp;#x27E9;</idno>
            <availability status="restricted">
              <licence target="https://creativecommons.org/licenses/by/4.0/">CC BY 4.0 - Attribution<ref corresp="#file-1460611-1532808"/></licence>
            </availability>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="IFIP-LNCS" corresp="IFIP">IFIP - Lecture Notes in Computer Science</idno>
            <idno type="stamp" n="IFIP">IFIP - International Federation for Information Processing</idno>
            <idno type="stamp" n="IFIP-AICT" corresp="IFIP">IFIP Advances in Information and Communication Technology</idno>
            <idno type="stamp" n="IFIP-TC" corresp="IFIP">IFIP Technical Committees </idno>
            <idno type="stamp" n="IFIP-WG" corresp="IFIP">Working Groups</idno>
            <idno type="stamp" n="IFIP-TC11" corresp="IFIP-TC">IFIP TC11: Security and Privacy Protection in Information Processing Systems</idno>
            <idno type="stamp" n="IFIP-DF" corresp="IFIP-LNCS">IFIP-DF</idno>
            <idno type="stamp" n="IFIP-WG11-9" corresp="IFIP-WG">IFIP-WG11-9</idno>
            <idno type="stamp" n="IFIP-AICT-410" corresp="IFIP-AICT">Advances in Digital Forensics IX</idno>
          </seriesStmt>
          <notesStmt>
            <note type="commentary">Part 5: NETWORK FORENSICS</note>
            <note type="audience" n="2">International</note>
            <note type="invited" n="0">No</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
            <note type="proceedings" n="1">Yes</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">Real-Time Covert Timing Channel Detection in Networked Virtual Environments</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Anyi</forename>
                    <surname>Liu</surname>
                  </persName>
                  <idno type="halauthorid">1128496-0</idno>
                  <affiliation ref="#struct-483562"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Jim</forename>
                    <surname>Chen</surname>
                  </persName>
                  <idno type="halauthorid">1128497-0</idno>
                  <affiliation ref="#struct-452410"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Harry</forename>
                    <surname>Wechsler</surname>
                  </persName>
                  <idno type="halauthorid">1128498-0</idno>
                  <affiliation ref="#struct-452410"/>
                </author>
              </analytic>
              <monogr>
                <title level="m">IFIP Advances in Information and Communication Technology</title>
                <meeting>
                  <title>9th International Conference on Digital Forensics (DF)</title>
                  <date type="start">2013-01-28</date>
                  <date type="end">2013-01-30</date>
                  <settlement>Orlando, FL</settlement>
                  <country key="US">United States</country>
                </meeting>
                <editor>Gilbert Peterson</editor>
                <editor>Sujeet Shenoi</editor>
                <imprint>
                  <publisher>Springer</publisher>
                  <biblScope unit="serie">Advances in Digital Forensics IX</biblScope>
                  <biblScope unit="volume">AICT-410</biblScope>
                  <biblScope unit="pp">273-288</biblScope>
                  <date type="datePub">2013</date>
                </imprint>
              </monogr>
              <idno type="doi">10.1007/978-3-642-41148-9_19</idno>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <keywords scheme="author">
                <term xml:lang="en">virtual environments</term>
                <term xml:lang="en">detection</term>
                <term xml:lang="en">Covert timing channels</term>
              </keywords>
              <classCode scheme="halDomain" n="info">Computer Science [cs]</classCode>
              <classCode scheme="halTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halOldTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halTreeTypology" n="COMM">Conference papers</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>Despite extensive research on malware and Trojan horses, covert channels are still among the top computer security threats. These attacks, which are launched using specially-crafted content or by manipulating timing characteristics, transmit sensitive information to adversaries while remaining undetected. Current detection approaches typically analyze deviations from legitimate network traffic statistics. These approaches, however, are not applicable to highly dynamic, noisy environments, such as cloud computing environments, because they rely heavily on historical traffic and tedious model training. To address these challenges, we present a real-time, wavelet-based approach for detecting covert timing channels. The novelty of the approach comes from leveraging a secure virtual machine to mimic a vulnerable virtual machine. A key advantage is that the detection approach does not require historical traffic data. Experimental results demonstrate that the approach exhibits good overall performance, including a high detection rate and a low false positive rate.</p>
            </abstract>
            <particDesc>
              <org type="consortium">TC 11</org>
              <org type="consortium">WG 11.9</org>
            </particDesc>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="institution" xml:id="struct-483562" status="OLD">
          <idno type="ROR">https://ror.org/01jxzq227</idno>
          <orgName>Indiana University-Purdue University Fort Wayne</orgName>
          <orgName type="acronym">IPFW</orgName>
          <date type="end">2018-06-30</date>
          <desc>
            <address>
              <addrLine>2101 E. Coliseum Blvd., Fort Wayne, IN 46805</addrLine>
              <country key="US"/>
            </address>
            <ref type="url">http://ipfw.edu/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-452410" status="VALID">
          <idno type="ROR">https://ror.org/02jqj7156</idno>
          <orgName>George Mason University [Fairfax]</orgName>
          <desc>
            <address>
              <addrLine>4400 University Drive, Fairfax, Virginia 22030</addrLine>
              <country key="US"/>
            </address>
            <ref type="url">https://www2.gmu.edu/</ref>
          </desc>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>