%0 Conference Paper %1 ghiasvand2017event %A Ghiasvand, Siavash %A Ciorba, Florina M %B International Supercomputing Conference (ISC) %C Frankfurt, Germany %D 2017 %K myOwn from:ghiasvan %T Event Pattern Identification in Anonymized System Logs %X System logs are valuable sources of information to analyze and diagnose systems behavior. The size of computing systems, and the number of their components, constantly increase. The volume of generated system logs, is in proportion to this increase. Storing system logs for big computing systems, requires high amount of storage capacity. Sensitive data within system logs, raises serious concerns about sharing and publishing them. Using anonymization methods, to cleanse the sensitive data before publishing them, reduces the usability of anonymized system logs for further analysis. After certain level of anonymization, the cleansed system logs, lose their semantic, and only remain useful for some statistical analysis. In this work we address this tradeoff between anonymization and the usefulness of anonymized system logs. Such that, full anonymization of system logs is guaranteed while the minimum required storage is being used, and still the cleansed system logs are usable for general statistical analysis. To achieve this goal, (1) first we need to replace all variables -in each log entry- with defined constant values, (2) then map each log entry into a hash-key via a collision-resistance hash function, (3) and after calculating the frequency of each hash-key, (4) optimize the hash-keys based on their frequency of appearance. Additionally, according to hash-keys frequency, the non-informative hash-keys will be eliminated. Preliminary results of analyzing Taurus system logs via the proposed method, show up to 95\% reduction in storage capacity, while the precision of statistical analysis remained unchanged, and the full anonymity is guaranteed.

@inproceedings{ghiasvand2017event, abstract = {System logs are valuable sources of information to analyze and diagnose systems behavior. The size of computing systems, and the number of their components, constantly increase. The volume of generated system logs, is in proportion to this increase. Storing system logs for big computing systems, requires high amount of storage capacity. Sensitive data within system logs, raises serious concerns about sharing and publishing them. Using anonymization methods, to cleanse the sensitive data before publishing them, reduces the usability of anonymized system logs for further analysis. After certain level of anonymization, the cleansed system logs, lose their semantic, and only remain useful for some statistical analysis. In this work we address this tradeoff between anonymization and the usefulness of anonymized system logs. Such that, full anonymization of system logs is guaranteed while the minimum required storage is being used, and still the cleansed system logs are usable for general statistical analysis. To achieve this goal, (1) first we need to replace all variables -in each log entry- with defined constant values, (2) then map each log entry into a hash-key via a collision-resistance hash function, (3) and after calculating the frequency of each hash-key, (4) optimize the hash-keys based on their frequency of appearance. Additionally, according to hash-keys frequency, the non-informative hash-keys will be eliminated. Preliminary results of analyzing Taurus system logs via the proposed method, show up to 95\% reduction in storage capacity, while the precision of statistical analysis remained unchanged, and the full anonymity is guaranteed.}, added-at = {2024-12-10T16:27:59.000+0100}, address = {Frankfurt, Germany}, author = {Ghiasvand, Siavash and Ciorba, Florina M}, biburl = {https://puma.scadsai.uni-leipzig.de/bibtex/2b52e17d37df4d3b03901cfa805a98934/scads.ai}, booktitle = {International {Supercomputing} {Conference} ({ISC})}, file = {Ghiasvand and Ciorba - Event Pattern Identification in Anonymized System .pdf:D\:\\Documents\\Zotero\\storage\\2SW6E2V9\\Ghiasvand and Ciorba - Event Pattern Identification in Anonymized System .pdf:application/pdf}, interhash = {e6357cd09f0bb92ee5a1363a42170549}, intrahash = {b52e17d37df4d3b03901cfa805a98934}, keywords = {myOwn from:ghiasvan}, language = {en}, month = jun, timestamp = {2024-12-10T16:27:59.000+0100}, title = {Event {Pattern} {Identification} in {Anonymized} {System} {Logs}}, year = 2017 }