# Resource Analysis of the Log Files Storage Based on Simulation Models in a Virtual Environment
## 2 Materials and Methods  
The task of building an architecture is to build a set of components that implement SIEM and their interconnections, so that there is an opportunity to assess their resource efficiencies. In other words, for the flow of user requests, \(x\), to a web service and for the component, \(Z_{i}\), of the architecture, \(V\), the following can be estimated:  
\[Z_{i}\subset V:x\ \xrightarrow{\Phi}\ R_{i},\ i=\overline{1,q}, \tag{1}\]  
where \(R_{i}=\mathbb{R}^{n}\) is the vector of the measured computing resources; \(n\) is the dimensionality of this vector; \(\Phi\) is a mapping such that parameter \(R_{i}\) is measurable for the observed process (\(x\)). That is, the architecture must ensure that the \(\Phi\) mapping is identifiable for a given stream of events. This can be achieved by implementing the dependency of each component on the input stream and the ability to measure resources. To estimate the resources (\(R_{i}\)) in expression (1), due to the structural transparency of the architecture, simulation modeling can be used. In a number of works devoted to the construction of the mathematical models of web-portal processes, it is shown that stochastic processes describing user access can be identified based on typical requests. However, the  
Figure 1: Scheme of secure access to computing resources. use of the dynamic stochastic models used in these works does not seem appropriate for solving the problems of assessing the resource efficiency of the components of the access control architecture. In general, dynamic models are widely used to build traffic models. To estimate resources, there is no need to build accurate predictive models of processes, since the sought-after values of the stocks of computing resources depend only on the range and intensity of processes, which can be implemented via simulation of a random variable with a given distribution function. Note that, when using public networks with the TCP/IP protocol, due to the limited channel, an increase in the frequency of requests is observed in the histogram in the area of the upper boundary, which is associated with re-sent non-missed packets, that is, heavy-tailed distributions are observed. A method for analyzing the costs of computing resources for the implementation of access control systems has been developed, based on an approach that uses virtual stands that provide a simulation environment that uses a computing complex at each level of access control. The technique consists of seven steps:  
1. The building of a typical user request. 2. Implementation of an access control system with the means for data flow control, generated by a typical request. 3. Creation of a virtual experimental stand that simulates an environment for using architecture components. 4. Formation of a random signal with a given distribution law based on typical user requests. 5. Obtaining estimates of the values of the resources required to use the access control system. 6. In the case of solving the problem of choosing options for the implementation of CA means, the selection of options that have lower resource costs. 7. Formation of the architecture of the computing complex, taking the obtained values of the costs of computing resources into account. Consider, for example, the problem of evaluating computational costs when recording events in a database while working with web services over computer networks with logging user actions. It is assumed that the recording of user actions will be carried out in the event log. For each device, keeping a record of the activity log is proposed. For experimental research, we will use the following data: the volume of the original data file is 460 MB without formatting and the file contains records in a semi-structured JSON format. Before starting the experiment, three virtual machines (VM) (client, server, and database) with specified characteristics were created. VirtualBox was utilized as a hypervisor for the task. RAM and CPU allocation policies were left at default settings.