Search Results

Now showing 1 - 3 of 3

Some of the metrics are blocked by your
consent settings
Workload-Aware Storage Reduction for Multi-Tenant SIEM on ClickHouse
(2026-01-01)
Chalaemwongwan, Nutthakorn
—Security Information and Event Management (SIEM) platforms ingest terabytes of heterogeneous telemetry daily—Windows event logs, DNS queries, HTTP transactions, EDR alerts, and network metadata from Zeek—yet the majority of stored records are never queried for threat-hunting or incident-response workflows. This study presents a workload-aware storage reduction framework that tailors data retention to observed analytical demand within a multi-tenant ClickHouse deployment. The main contribution is a Workload Analyzer algorithm that extracts importance scores for columns from ClickHouse query logs using a frequency–recency–coverage weighting scheme, and a Storage-Coverage Cost Model that computes the optimal pruning threshold that minimizes a weighted sum of storage cost and coverage loss. Guided by these metrics, the framework applies six composable reduction operators: column pruning with materialized views, adaptive sampling, deduplication, per-column codec selection, skip-indexing, and time-to-live (TTL)-based retention tiering across hot/warm/cold storage. Multi-tenant isolation is enforced through role-based access control overlays aligned with the Thai Personal Data Protection Act (PDPA). Experimental evaluation on 1,000,000 Zipf-distributed Windows Security Events demonstrates 79% uncompressed and 70% compressed storage reduction with sub-second query latency, while the Workload Analyzer automatically identifies the optimal column subset that preserves 100% detection rule coverage at minimum storage cost.
Some of the metrics are blocked by your
consent settings
Comparative Evaluation of Log Reduction Techniques Using Vector on Public Security Datasets
(2026-01-01)
Chalaemwongwan, Nutthakorn
Efficient log reduction is critical for Security Operations Centers (SOCs) and Managed Security Service Providers (MSSPs), which must store, an-alyze, and retain massive volumes of event data while satisfying compli-ance requirements and controlling operational costs. Traditional pipelines often retain redundant or low-value records, leading to excessive storage overhead and slower analytics. This study evaluates five Vector-based log-reduction methods: filter-based selection, field pruning, event sampling, template hashing, and a combined pruning + sampling profile. The eval-uation uses more than 3 million log records from two well-known public intrusion datasets, CIC-IDS2017 and UNSW-NB15, to measure efficiency, throughput, and attack coverage under the same experimental setup. Com-pared with a baseline Filebeat pipeline, the proposed Vector-based ap-proach improved throughput by 45%, reduced outbound traffic by 80%, and maintained 98% attack coverage. The results show that a substantial proportion of raw logs is redundant and can be trimmed without compro-mising essential evidence or analytic clarity. Template hashing preserved fidelity with moderate CPU cost; although it required slightly more pro-cessing than filtering or pruning, it still consumed fewer resources than the baseline. We repeated each test three times to ensure consistent results and validated the findings through ClickHouse queries at the sink layer. We also release the scripts and benchmark data to support reproduction and extension. Overall, the benchmark demonstrates how log-reduction design can improve operational efficiency while preserving analytic fidelity.
Some of the metrics are blocked by your
consent settings
ThaiScamBench: Toward a Benchmark Dataset for Scam and Phishing Detection in the Thai Language
(2025-01-01)
Chalaemwongwan, Nutthakorn
Recent reports from Thai financial regulators reveal a sharp increase in online scams, resulting in major financial damage each year. While English-language research has made considerable progress, Thai-language scam detection remains underexplored and lacks standardized benchmarks. The study establishes *ThaiScamBench (pilot)*, a curated corpus of 1,750 Thai messages labeled as scam or legitimate across seven categories. Reproducible baselines (Logistic Regression, Linear SVM) and a rigorous evaluation protocol are provided to address class imbalance, Thai-English code-switching, and adversarial obfuscation. All scam texts contained URLs; none appeared in legitimate messages, revealing dataset bias, with all scam samples containing a URL and none among legitimate texts, artificially inflating headline metrics. We addressed this issue by introducing URL-masked and domain hold-out evaluations. We outline our roadmap toward version 1.0 (around 50k messages), focusing on dataset scaling and robust benchmarking for Thai scam detection, adversarial stress tests, and PDPA-compliant release artifacts. *ThaiScamBench∗ establishes the first standardized evaluation for Thai scam detection, enabling transparent comparison and artifact-conscious evaluation. This benchmark provides a reproducible foundation for robust Thai-language scam detection.

KMITL

Browse

Filters

Settings

Sort By

Results per page

Search Results