  Recently, the IaaS (Infrastructure as a Service) Cloud (e.g., Amazon EC2) has
been widely used by many organizations. However, some IaaS security issues
create serious threats to its users. A typical issue is the timing channel.
This kind of channel can be a cross-VM information channel, as proven by many
researchers. Because it is covert and traceless, the traditional identification
methods cannot build an accurate analysis model and obtain a compromised
result. We investigated the underlying behavior of the timing channel from the
perspective of the memory activity records and summarized the signature of the
timing channel in the underlying memory activities. An identification method
based on long-term behavior signatures was proposed. We proposed a complete set
of forensics steps including evidence extraction, identification, record
reserve, and evidence reports. We studied four typical timing channels, and the
experiments showed that these channels can be detected and investigated, even
with disturbances from normal processes.
