Using MapReduce and Hierarchical Entropy Analysis to Speed-Up the Detection of Covert Timing Channels

Covert timing channels provide a mechanism to transmit unauthorized information across different processes. Applications that generate large datasets allow this information to be easily hidden within the big data, making it difficult to detect. In this paper, we introduce the application of big data analysis techniques, specifically MapReduce, in the process of speeding up the performance of covert time channels detection. The hierarchal entropy algorithm (HEA) is utilized to reveal a "needle" of covert timing channels from a huge "haystack" of inter-arrival times. A real indexed inter-arrival dataset of approximately 1.4 gigabyte is generated between two different machines and injected by 615 bytes of covert timing message. The HEA with MapReduce was able to uncover around 7*10(-6) of hidden covert message from this huge amount of data in a significantly shorter time as compared to the classical sequential HEA.