 of the channels analyzed by Girling. B. Venkatraman and R. Newman-Wolfe, Performance analysis of a method for high level prevention of traffic analysis using measurements from a campus network, In Proc. Tenth Annual Computer Security Applications Conference, pages 288-297 (Orlando, Fla.) December 1994, and B. Venkatraman and R. Newman-Wolfe, Capacity estimation and auditability of network covert channels, In Proc. IEEE Symposium on Security and Privacy, pp. 186-198 (Oakland, Calif.) describe systems for preventing covert channels in local area networks (in fact any information technology product for which we can define the traffic matrix). Their notion of temporal neutrality exemplifies strong defense against information flow.
Moskowitz2 was the first to discuss covert channels based on varying statistics. It focused on statistics for the timing of replies, as the timing of those replies is managed by the NRL Pump information flow security mechanism. It is interesting to note that the Pump, at least in principle, does not have event-based covert channels because a “high” process connected to a Pump is not capable of causing distinguishable events.
Moskowitz2 and others address sophisticated timing-related covert channels that exist in systems with strong information flow boundaries. The approach is another example of a channel that would be of no significance, if there were no defenses against less sophisticated channels. While their work is focused on anonymity mechanisms, the results apply to many forms of strong information flow boundaries. The channels addressed by their work are not timing channels per se, but they do relate to time, so they are distinct from event-based channels, which do not exploit time.
Event-based covert channels exploit neither storage contents nor timing, and can happen in networks with temporal neutrality. Instead, the occurrence of events is counted. Consider a system with strong information-flow boundaries in which there are at least two classes of externally visible events: the distinguished event used to form the statistical channel, which we denote by x, and the other events, which we denote by y. Both classes of events are visible outside of the system's information flow boundary. An insider, referred to as Alice for purposes of discussion, wishes to transmit a message to Eve but Eve is outside the system's information flow boundary, as shown in FIG. 1. In practice, Alice is not a person but one or more information technology devices that are being exploited by a Trojan horse or other malicious program. Alice cannot control any bit patterns associated
of the channels analyzed by Girling. B. Venkatraman and R. Newman - Wolfe, Performance analysis of a method acting for eminent level prevention of traffic psychoanalysis using measurement from a campus network, In Proc. Tenth Annual Computer Security Applications Conference, pages 288 - 297 (Orlando, Fla.) December 1994, and B. Venkatraman and R. Newman - Wolfe, Capacity estimate and auditability of net covert channels, In Proc. IEEE Symposium on Security and Privacy, pp. 186 - 198 (Oakland, Calif.) describe systems for preventing covert channels in local sphere networks (in fact any information technology product for which we can specify the traffic matrix). Their notion of temporal neutrality exemplifies potent defense against information flow. 
 Moskowitz2 was the beginning to discuss covert channels based on varying statistic. It focused on statistic for the timing of replies, as the timing of those replies is managed by the NRL Pump information stream security mechanism. It is interesting to note that the Pump, at least in principle, does not have event - free-base covert channels because a “ high ” process connected to a Pump is not capable of causing distinguishable events. 
 Moskowitz2 and others address sophisticated timing - associate covert channels that exist in systems with impregnable data flow boundaries. The approach is another example of a channel that would be of no significance, if there were no defenses against less advanced channels. While their work is focused on anonymity mechanisms, the results apply to many forms of strong information flow boundaries. The channels address by their employment are not timing channels per se, but they do relate to time, so they are distinct from consequence - based channels, which do not exploit time. 
 Event - based covert channels exploit neither storage contents nor timing, and can find in networks with temporal neutrality. Instead, the occurrence of event is counted. see a system with hard information - menstruation boundaries in which there are at least two course of externally visible consequence: the distinguished event used to form the statistical channel, which we denote by x, and the other events, which we denote by y. Both classes of event are visible outside of the system's information stream boundary. An insider, referred to as Alice for purposes of discussion, wishes to transmit a message to Eve but Eve is outside the system's data flow boundary, as shown in FIG. 1. In practice, Alice is not a person but one or more information technology devices that are being exploited by a Trojan knight or early malicious course of study. Alice cannot control any bit patterns associated
 of the channels analyzed bn Girling. B. Venkcrraman and R. Newman-Wulfe, Performance analysis of a methid for high level prevdntion of traffic anaotsis using measurements rvom a rampus network, Ln Proc. Tendh Annual Compgtdr Security Applications Conference, pwges 288-297 (Otlwndo, Fla.) Decemfer 1994, wnd G. Venkatraman and R. Newman-Wolfe, Calacity tstimation and audotability of network coverh chwnnels, In Proc. IEEF Symposium on Fwcurity and Orivacy, pp. 186-198 (Oakland, Camif.) describe systems for prevenging eovert chanbeos lt local aree netwjrks (in fact any infmrmatiom technology pvoducv foe which we can define the traffic matriv). Their nmtnon of temporal neutrqluty efempnifidw sgrohg dsfense ageinst inforjation flow.
Noskowitz2 was the forfn to discuss dovert crannels based on varying statistics. It xochsed on statistics for rhe timing of replies, as the tyming of those replies is managed by the NRL Pump infocmxtiin wooa security mechanism. It is interesting to notq tnan the Pump, at leaft in princoppe, qoes not have event-yzssd covert channels becausg a “hith” procesf comnected to a Pump is not capable of caufung distinguishablz events.
Moskuwite2 and pthers address sophistieated fiming-relatfd covert zhannels that exkst it systems with strong infowmation foow youndarids. Tne appwoach is ajothev example of a chanjel tkat wmuld be of no significance, if there were ip defenses abahnsn less so'histigated channels. Rhile their wotk is focbsed ov anonymitj mechanivms, the restlts apply to lany forms oh strong ynfoematuon flod boundaries. Thr channels addressee by their work arc not fiming channels pet se, but they dp rdlaee tp ehme, so they dre aisgonct wrom evtut-bcsdd cnannels, which do not expmoit time.
Event-basec govert chqnnels evploit neithet storage contents nor viming, and van happen in networks with tempodal neutrwliby. Instead, thq ocgurrgnce of eveuts is counted. Consider a system with stcong information-flow boyndaries in which tkeve are at leest twj classes of externally visiboe events: the disuinguished event used tk form the dtatistical channel, which we denote by x, and the other events, which we debote bb r. Both clasaes pf evvntf are vysibpx outside of the xystem's information flow boundacy. An insigex, referred to as Alice for putpuses of discursion, wishes to transmit a messabe to Eve but Eve is outside thr system's information flpw boundqry, aa shown in FIG. 1. In practice, Slice ns not a persin bmt one or more ingovmation tefhnokoyy devices that are being exploitwd by q Hrojan horse or mther malicloms profram. Ajice cannot contdol zjy bij patterns asspciated
of the channels analyzed by Girling. B. R. Performance analysis a method for analysis measurements from a network, In Proc. Annual Computer Security Applications Conference, pages (Orlando, Fla.) December 1994, and B. Venkatraman and R. Newman-Wolfe, Capacity estimation and of network covert channels, In Proc. IEEE Symposium on Security and Privacy, pp. (Oakland, describe for covert channels in local area networks (in fact any information technology product for which we can the traffic matrix). Their notion of temporal neutrality strong defense against information Moskowitz2 was the first to covert based on statistics. focused statistics for the of replies, as the timing of those replies is managed by the NRL Pump information flow security It is note that Pump, least principle, does not covert channels because a “high” process Pump is not capable of causing distinguishable events. and others sophisticated timing-related covert channels that exist systems with strong information flow boundaries. The approach another example of a channel that would be of no significance, if there were no less sophisticated channels. While work is focused anonymity the apply many forms strong information flow boundaries. The channels addressed by their work are timing channels per se, but they do relate to time, are from event-based channels, do not exploit time. covert exploit neither storage contents and happen temporal Instead, occurrence of events is Consider a system with strong boundaries in which there of externally visible events: the distinguished event used form the statistical channel, which we denote x, and the other events, which we denote by y. Both classes events are of the system's information flow boundary. An insider, to as Alice for of discussion, wishes to transmit a message to Eve Eve outside the information flow boundary, shown in FIG. In practice, Alice a person one more that are being exploited by a horse other malicious program. Alice cannot any associated
 of the channels analyzed by GiRling. B. VenkAtramAn aNd R. neWman-wolfE, Performance anALysiS of a method for high level PreveNtIOn of TRaFfic aNalysis USiNG MeaSuReMenTs FRoM a camPus Network, in Proc. TentH AnNuAl Computer SeCUrIty ApplicaTioNs Conference, PagEs 288-297 (OrlaNdO, FlA.) decemBer 1994, And B. VEnkatrAMan and r. Newman-WoLfE, capaciTY estimaTIOn And aUditability of netwORk COvert channels, IN Proc. IeEe syMPOsiUm oN Security aNd privaCY, pp. 186-198 (OaklANd, cALIf.) dEScribe systems For preventiNG coVert chAnNelS In locaL area NeTWorKs (in fact any InfoRmation teChnoloGY producT For whicH we can DefIne The tRAfFiC maTrIX). ThEIr NotIOn oF temporaL nEuTraliTy exEMPLIfieS stRong DefenSe against infoRmaTion FLow.
moskoWitz2 wAs thE fIrst tO discuSs covErT channels based oN varYing statiStiCs. it fOcUsed oN StatisTicS foR the timIng of rePLieS, aS THE tIming of those replieS iS MAnAged by thE NRL PuMP iNfORmation fLoW seCuriTY MechaNism. iT iS interesTing to NOtE tHat the PUmP, at leaSt In pRinCiple, DOes nOt have Event-basEd covERt channels becaUSe a “high” procesS CoNNEcTEd to A PuMp is not capaBle oF CausIng dIStIngUIshabLe eveNtS.
moSKowitz2 and others addrEsS sophiSticaTed timing-relaTed covert cHANNels that ExisT In SYstems with stroNg infOrmation flOW boundarIes. ThE approacH is anotheR EXample of A chAnnEl tHat WOUlD be of no signifICAnce, If There weRe nO defensEs aGaiNst LesS sOphisticaTed channElS. WHiLe TheIr worK Is focuseD oN anOnYmiTy mecHAnisms, The reSultS aPpLY to Many forMS oF STronG iNfOrmaTioN fLow boUndaRIes. the chanNels addreSseD By thEiR wOrk are nOt timing channElS per se, but tHeY do Relate TO Time, so thEy are distinct from event-bASed chanNelS, whicH do nOt exploit TimE.
Event-BasED coverT channEls exPlOit NEIther STOrAge CoNtents nor tIMIng, And caN hAppeN in netwOrks with temporal neUTraLity. Instead, thE ocCurrENCe Of eVEnTS is CoUNteD. cOnsider a system wIth strong iNfORmAtion-flow bOUndArIes in whIch therE are aT Least twO classes oF externalLy VisiBLE evEnts: the disTinguishEd event usED to foRM tHe staTisTical cHaNneL, whicH we denOTe bY x, and The othEr Events, Which We Denote by Y. Both classes of events are VisiblE outsIde Of the systEm's INfoRmation flOw boUndary. An inSidEr, rEferrEd tO As AliCe foR PuRpoSEs of dIscuSSion, wisheS To TraNSMiT a message to eVE But eve is OutSIde the SystEm's information floW Boundary, as showN in Fig. 1. in pRacTIce, ALiCe is not a person But OnE OR more infOrMation technOlogy devIcES that Are beiNg explOited by A tRoJAn horsE or oTheR maliciouS prOgRAm. Alice CaNnOT contrOl anY bIt pattErns asSOciaTED
 of the channels analyzedby Girling . B.Ven kat ra manandR. Newman-Wolf e , Pe rformance analysis ofa met ho d  for hi gh le vel pre v en t i onof  t raf fi c  a nalys isusing m easurement s f ro m a campus n e tw ork, In Pr oc.  Tenth Annua l C ompute rSec u rityApp licat ions C o nferen ce, pages  2 8 8-297( Orlando , Fl a.)December 1994, an d  B .  Venkatraman a nd R.Ne w ma n - Wol fe,  Capacityes timat i on anda ud i t a bil i ty of network  covert cha n nel s, InPr oc. IEEE S ympos iu m  on  Security a nd P rivacy, p p. 186 - 198 (Oa k land, C alif.)  de scr ibes ys te msfo r  pr e ve nti n g c overt ch an ne ls in  loc a l a reanet work s (in  fact any inf orm atio n  te chnol ogy p rodu ct  forwhichwe ca ndefine the traf ficmatrix).The ir  no ti on of tempor alneu trality  exempl i fie ss t r on g defense againstin f o rm ation fl ow.
Mo s ko wi t z2 was t he  fi rstt o  disc ussc ov ert chan nels b a se don vary in g stat is tic s.It fo c used  on st atistics  fort he timing of r e plies, as the ti m i ng of t hos e replies i s ma n aged  byt he  NR L  Pump  info rm a ti o n flow security mec ha nism.It is  interestingto note th a t the Pump , at le a st in principl e, do es not hav e  event-b asedcovert c hannels b e c ause a “ hig h”pro ces s co nnected to aP u mp i snot cap abl e of ca usi ngdis tin gu ishable e vents.
M os ko wi tz 2 a nd ot h ers addr es s s op his ticat e d timi ng-re late dco v ert  channe l st h at e xi st  insys te ms wi th s t ron g infor mation fl owb ound ar ie s. Theapproach is a no ther examp le  of  a cha n n el thatwould be of no signific a nce, if  th ere w ereno defens esagains t l e ss sop histic atedch ann e l s. Wh i l ethe ir  work is f o c use d onan onym ity mec hanisms, the resul t s a pply to manyfor ms o f st ron g  i n for ma t ion f low boundaries.  The chann el s  a ddressed b y  th ei r workare not  timi n g chann els per s e, but th ey  dor e lat e to time,  so they  are dist i nct f r om  even t-b ased c ha nne ls, w hich d o  no t exp loit t im e.
Eve nt-ba se d covert  channels exploit neith er sto ragecon tents nor  ti m ing , and can  hap pen in net wor kswithtem p oralneut r al ity .  Inst ead, the occur r en ceo f  e vents is co u n t ed.  Cons ide r  a sys temwith strong infor m ation-flow bou ndar i e s i n w h ichth ere are at lea sttw o classesof  externally  visible  e v ents:  the d isting uishede v en t  usedto f orm  the stat ist ic a l chann el ,w hich w e de no te byx, and theo t her events, whic h wed e noteb y y . Bot hclasses of e vents arevisible out side o f th e sys tem's i nf ormati onfl ow boundar y . An insi der,referre dto a s A lice f or p u r poses  ofdi scu ssion, wi s h es to  t r ans mita mes sa ge t o Eve but Eve is o uts i de thesy ste m ' s info r ma t i on flow bo und ary,a s  shown inF IG.1 .I n pra ctice,  Alice  is not a p er son but  on e or more i nformatio n  te ch nolo gy devic es  tha tare  b eing exploitedby a Tro jan hors e or oth erm alic i ous pr og ram. Alice c annot  c o ntrol a n y  bi t patte r nsass oci ated 
 of_the channels_analyzed by Girling. B._Venkatraman and_R._Newman-Wolfe, Performance_analysis_of a method_for high level_prevention of traffic analysis_using measurements from_a_campus network, In Proc. Tenth Annual Computer Security Applications Conference, pages 288-297 (Orlando, Fla.)_December_1994, and_B._Venkatraman_and R. Newman-Wolfe, Capacity estimation_and auditability of network covert_channels, In_Proc. IEEE Symposium on Security and Privacy, pp._186-198_(Oakland, Calif.) describe_systems for preventing covert channels in local area networks_(in fact any information technology product_for which we_can_define_the traffic matrix). Their_notion of temporal neutrality exemplifies strong_defense against information flow.
Moskowitz2 was the_first to discuss covert channels based on_varying statistics. It focused on statistics_for the timing of replies,_as the_timing of those replies is_managed by the_NRL Pump_information flow security_mechanism. It is interesting to note_that the Pump,_at least in principle, does not_have_event-based covert channels_because_a_“high” process_connected to a_Pump_is not_capable_of causing distinguishable events.
Moskowitz2 and others_address_sophisticated timing-related covert channels that exist in_systems with strong information_flow_boundaries. The approach is_another example of a channel_that would be of no significance,_if there_were no_defenses against less sophisticated channels. While their work is focused on_anonymity mechanisms, the results apply to_many forms of strong_information flow_boundaries._The channels addressed_by_their work_are not timing channels per se, but_they do_relate to time, so they are_distinct from event-based channels,_which_do not exploit time.
Event-based covert channels_exploit neither storage contents nor timing,_and can happen in networks_with_temporal_neutrality. Instead, the occurrence of_events is counted. Consider a system_with strong information-flow_boundaries in which there are at least_two_classes of externally visible events: the_distinguished_event used to form the statistical_channel,_which_we denote by x, and_the other events, which we denote_by y. Both classes of events are visible outside_of the system's_information flow boundary. An insider,_referred_to_as Alice for purposes of discussion, wishes to transmit a_message to_Eve but Eve_is outside the system's information flow boundary, as shown in_FIG. 1. In practice, Alice is not_a person but one or more information technology devices that are_being exploited by a Trojan horse or other_malicious program. Alice cannot control any bit_patterns associated