R&D: Archival System Slicer for Long-Term Storage

IEEE Xplore has published, in 2019 IEEE 24th Pacific Rim International Symposium on Dependable Computing (PRDC) proceesdings, an article written by Adriano Serckumecka, Ibéria Medeiros, Bernardo Ferreira, and Alysson Bessani, LASIGE, Faculdade de Ciências, Universidade de Lisboa, Portugal.

Abstract: “Security Information and Event Management (SIEM) systems have been adopted by organizations to enable holistic monitoring of malicious activities in their IT infrastructures. SIEMs receive events from several devices of the organization’s IT infrastructure (e.g., servers, firewalls, IDS), correlate these events, and present reports for security analysts. Given the large number of events collected by SIEMs, it is costly to store such data for long periods. Besides, since organizations store a relatively limited time-frame of events, the forensic analysis capabilities severely become reduced. We present SLICER an archival system for long-term storage that makes use of multi-cloud storage to guarantee data security, low cost and high scalability, and ensures cost-effectiveness by grouping events in blocks and using indexing techniques to recover them. The system was evaluated using a real dataset, and the results show that it is significantly more cost-efficient than competing alternatives.“