FA-SEAL: Forensically Analyzable Symmetric Encryption for Audit Logs

Audit logs serve as crucial resources for cybersecu-rity analysts conducting forensic analysis to gain insights into the constantly evolving cyberattacks. Due to the substantial volume of these logs, a growing number of companies have chosen to outsource their log storage to cloud-based solutions. To enhance the security of externally stored audit logs, which often contain sensitive data susceptible to breaches, encrypting them at all time is recommended, following guidance from the National Institute of Standards and Technology (NIST). How-ever, conducting forensic analysis on encrypted audit logs poses a non-trivial challenge, often requiring the complete decryption of the logs before analysis. Given that companies frequently outsource forensic investigations to third-party entities, the need to share fully decrypted audit logs with these parties may risk exposing sensitive data to external parties.In this paper, we introduce a new approach called FA-SEAL, to enable forensic analysis on encrypted logs without fully decrypting them, but instead selectively discloses only information related to specific incidents to third-party entities. Moreover, to handle the encryption of logs produced on a massive scale over time, FA-SEAL introduces the concept of segmentation and clustering to effectively manage the ingestion of a large volume of audit logs. This approach also allows for both backward and forward forensic analysis without neces-sitating the decryption of the entire log set. Our experiments involving a log dataset embedded with cyberattacks generated by AIT [1], along with eight simulated attack scenarios, show that FA-SEAL enables near real-time ingestion of logs. Fur-thermore, the causal graphs generated from the encrypted logs using FA-SEAL are found to be identical to those produced by the baseline system, which necessitates decrypting the entire collection of audit logs.