Low-Cost Serverless SIEM in the Cloud
Adriano Serckumecka, Ibéria Medeiros, Alysson Bessani · 2019
Security systems such as the Security Information and Event Management (SIEMs) have been used to monitor logs and correlate data to quickly detect and respond to incidents. Despite their advantages, SIEMs are expensive to deploy and maintain, requiring extra budget and specialized staff. Another concern is the event retention period, which events are stored for a short period of time, missing important information about how threats may have affected the company infrastructure in the past. This thesis aims to improve these issues by using low-cost cloud services to correlate and store security events. We will investigate techniques to index, compress and store events in the cloud in a cost-efficient and safe way for a long time. We will create a cloud correlation engine using a serverless platform, such as Amazon Lambda. This approach can minimize the complexity of managing SIEMs in place, charging the customer only for the time actually spent processing events. Finally, we will integrate the storage and correlation engine into a cloud SIEM, providing also a monitoring tool, building a complete and innovative low-cost cloud-based security monitoring solution.