Gianvecchio also developed an entropy-based detection
technique [6]. Entropy is a measure of the amount of in-
formation missing if the value of a variable is unknown. En-
tropy will be low if the value of the variable can be predicted
with a greater certainty (e.g. a loaded coin
ip), and higher
if the variable cannot be as easily predicted (e.g. a fair coin
ip). Covert trac is more regular, and thus has a lower
entropy than legitimate trac. This technique is highly ef-
fective at detecting covert channels.