Searching covert channels by identifying malicious subjects in the time domain

Covert channel has three basic elements, i.e. sender subject, receiver subject and medium object. If the sender and receiver subjects change the medium object while they are communicating, though the sender and receiver are the origin, the security kernel will look them as different covert channels. By this method, covert communications between sender and receiver subjects can avoid being suppressed for covert channels of less than 100 bits per second are usually considered acceptable. Regardless the medium object´s influence, a new search method was presented to overcome that vulnerability by identifying the malicious subjects in time domain.