Event Correlation for Log Analysis in the Cloud

Cloud computing is a booming service oriented architecture which supports multiple tenants and users. They allow clients to use their infrastructure on a pay-per use model. With the increasing popularity of cloud systems, cyber crimes on cloud systems are also on the rise. But there are no standardized methods established for performing digital forensic investigation on the cloud. Our paper focuses on forensic analysis of cloud systems with specific emphasis to the analysis of cloud service logs. One of the major issues with service logs in cloud is that there is no segregation as all events related to all tenants and users are logged together. Hence it is essential to group events relevant to specific users or tenants who are of interest to the investigation. This paper discusses event correlation techniques to group events logged by tenants of interest. OpenStack cloud is used for the testing and evaluation of the solution.