Optimizing SIEM Throughput on the Cloud Using Parallelization

Masoom Alam; Asif Ihsan; Muazzam A Khan; Qaisar Javaid; Abid Khan; Jawad Manzoor; Adnan Akhundzada; Muhammad Khurram Khan; Sajid Farooq

doi:10.1371/journal.pone.0162746

Optimizing SIEM Throughput on the Cloud Using Parallelization

PLoS One. 2016 Nov 16;11(11):e0162746. doi: 10.1371/journal.pone.0162746. eCollection 2016.

Authors

Masoom Alam¹, Asif Ihsan², Muazzam A Khan³, Qaisar Javaid⁴, Abid Khan¹, Jawad Manzoor¹, Adnan Akhundzada¹, Muhammad Khurram Khan⁵, Sajid Farooq¹

Affiliations

¹ Dept. of Computer Science, COMSATS Institute of Information technology, Islamabad, Pakistan.
² Trillium Information Security Systems, Rawalpindi, Pakistan.
³ NUST College of EME, National University of Sciences and Technology, Islamabad, Pakistan.
⁴ Deptt of Computer Science, International Islamic University, Islamabad, Pakistan.
⁵ King Saud University, Riyadh, Saudi Arabia.

Abstract

Processing large amounts of data in real time for identifying security issues pose several performance challenges, especially when hardware infrastructure is limited. Managed Security Service Providers (MSSP), mostly hosting their applications on the Cloud, receive events at a very high rate that varies from a few hundred to a couple of thousand events per second (EPS). It is critical to process this data efficiently, so that attacks could be identified quickly and necessary response could be initiated. This paper evaluates the performance of a security framework OSTROM built on the Esper complex event processing (CEP) engine under a parallel and non-parallel computational framework. We explain three architectures under which Esper can be used to process events. We investigated the effect on throughput, memory and CPU usage in each configuration setting. The results indicate that the performance of the engine is limited by the number of events coming in rather than the queries being processed. The architecture where 1/4th of the total events are submitted to each instance and all the queries are processed by all the units shows best results in terms of throughput, memory and CPU usage.

MeSH terms

Cloud Computing*
Computers
Electronic Data Processing
Software*

Grants and funding

The authors extend their sincere appreciations to the Deanship of Scientific Research at King Saud University for its funding this Prolific Research Group (PRG-1436-16). AI received funding in the form of salary from commercial company Trillium Information Security Systems, Rawalpindi, Pakistan, during this study. The funder did not have any role in the study design, data collection and analysis, decision to publish, or preparation of the manuscript. The specific roles of co-author AI are articulated in the ‘author contributions’ section.