Abstract: The detection of covert timing channel is the focus and the difficulty of the research on covert channel. Current detections of covert timing channels are more directed against some particular covert timing channels, not all applicable. In this paper, a detection approach based on one-class SVM was introduced. Detection of covert channels is seen as a one-calss calssification problem. The model-building part of the algorithm works trained by the common channel set and generates the classification model. Experimental results show that the detection method can not only ensure a higher detection rate and better versatility, but also effectively detect covert timing channels.

Key words: covert timing channel, one-class SVM, network security