A CostEffective Cloud Event Archival for SIEMs Security Information and Event Management (SIEM) systems have been adopted by organizations to enable holistic monitoring of malicious activities in their IT infrastructures. SIEMs receive events from diverse devices of the organizationu0027s IT infrastructure (e.g., servers, firewalls, IDS), correlate these events, and present reports for security analysts. Given the large number of events collected by SIEMs, it is costly to store such data for long periods. Since organizations store a relatively limited timeframe of events, the forensic analysis capabilities severely become reduced. This concern limits the organizationsu0027 ability to store important information about the past cybersecurityrelated activity, limiting forensic analysis. A possible solution for this issue is to leverage public cloud storage services, exploiting their low cost and infinite scalability. We present SLiCER an archival system for longterm storage that makes use of a multicloudbased storage system to guarantee data security and ensures costeffectiveness by grouping events in blocks and using indexing techniques to recover them. The system was evaluated using a real dataset and the results show that it is significantly more costefficient than competing alternatives.

Delta Encoding Overhead Analysis of Cloud Storage Systems Using ClientSide Encryption With clientside encryption (CSE), a useru0027s data is encrypted before being transferred to a cloud provider. This ensures that only the intended user has access to the information, but complicates effective file synchronization (between different devices and the cloud). Motivated by prior findings that empirically show that the largest performance differences between popular CSE services (CSEs) and nonCSEs typically are related to the implementation of delta encoding solutions to reduce bandwidth usage, in this paper, we evaluate and provide insights into the practical CSErelated delta encoding overheads. First, we use targeted experiments to demonstrate the delta encoding problem associated with CSE and to compare the practical overhead differences associated with three example services implementing delta encoding. Second, we develop an analytic cost model and use it to show that a simple thresholdbased CSE policy can reduce the bandwidth and storage usage seen by the best CSE considered here, that such a policy has a provable worstcase overhead within a factor two of the best nonCSE, and typically performs much better. The results are highly encouraging, and show that it is possible to provide CSE at limited additional overhead compared to nonCSE services.