Enhanced Retention of High-Impact Network Security Information

In today's interconnected world, cybersecurity is critical for any enterprise network. Organizations need to be proactive in detecting and preventing cyber-attacks, malware infections, data breaches, and advanced persistent threats (APTs). One important tool for detecting and responding to these security incidents is collecting and storing cybersecurity network audit logs. Audit logs provide a detailed record of activity on a network, including who accessed the system, what they did, and when they did it. This information is essential for forensic analysis, which involves investigating and reconstructing security incidents to determine how they occurred and what damage was done. Unfortunately, the amount of audit log data generated by an enterprise network can be enormous, and storing it for long periods of time can quickly become expensive and impractical. At the same time, the retention of audit logs for extended periods is often required to support digital forensics investigations that are concerned with reconstructing the root causes of initial attack-related network and system events that occurred weeks or months earlier. Long-term audit log storage is therefore essential for piecing together the events leading up to an incident. As a result, organizations need to strike a balance between retaining critical audit logs that have high security value and reducing storage requirements to minimize costs. To address these challenges, we propose to develop a novel system, named ERHINS, for log collection, reduction and retention that can reduce storage requirements by orders of magnitude, compared to raw audit log storage, while retaining high-value security information that is required to support cyber-forensics investigations, including threat hunting, root cause analysis, and lateral movement reconstruction. Our system will combine network traffic capturing and parsing, anomaly detection, DNS and IP reputation, and efficient storage techniques to enable a cost-effective retention of critical network events for long periods of time. In this project, we will carry out the research and development of a fully functioning prototype of our ERHINS system that can be deployed into real-world enterprise networks in both corporate and government space.