Time Series Database Dedicated for a Computer Security Incident Response

• Item type: National Convention(1)
• 公開日: 2019-02-28
• タイトル: Time Series Database Dedicated for a Computer Security Incident Response
• 言語: eng
• キーワード / 主題Scheme: Other
• キーワード / 主題: ネットワーク
• 資源タイプ / 資源タイプ識別子: http://purl.org/coar/resource_type/c_5794
• 資源タイプ: conference paper
• 著者所属: 鳥取大
• 著者名: 大森, 幹之
• 論文抄録 / 内容記述タイプ: Other
• 論文抄録 / 内容記述: Computer security has been getting more attentions because a computer security incident may cause great damage on an organization. A quick response against an incident is then important in order to to avoid information compromise and a second infection of a malware. It is then important to quickly identify a suspicious host that may be compromised. When ones identify a suspicious host, ones may check to see communication logs. Amount of communication logs tend to be huge, and their search delays tend to be long and the delay should be minimized. To this end, this paper proposes a fast logging system that considers a fact that a communication log is in time series while a traditional logging system on top of RDBMS is not dedicated for the time series logs. The proposed system also minimize a size of logging storage by indexing logging messages as much as possible. This paper then demonstrates that proposed system can reduce a delay and a storage size of communication logs of a firewall in an actual campus network in comparison with a traditional logging system.
• 書誌レコードID / 収録物識別子タイプ: NCID
• 書誌レコードID / 収録物識別子: AN00349328
• 書誌情報: 第81回全国大会講演論文集; 巻 2019, 号 1, p. 35-36, 発行日 2019-02-28
• 出版者 / 言語: ja
• 出版者: 情報処理学会