SA-aChain: A Blockchain Hybrid Architecture for Privacy-Preserving Alert Data Management

Alert aggregation plays an important role in intrusion detection. Traditionally, a centralized system is utilized to manage the massive alert data generated by various network security devices. However, such a system faces data tampering risks and cannot support cross-organization alert information sharing. To overcome the shortcomings of centralized alert management systems, in this paper we propose SA-aChain, a hybrid architecture which incorporates relational database into blockchain so as to enhance the online analytical processing performances of blockchain. Considering that alert data may contain sensitive information and cannot be directly stored on blockchain, the proposed architecture utilizes field-level encryption to secure sensitive data. And a dual-indexing scheme is designed to support ciphertext queries. More importantly, the proposed architecture adopts a hybrid storage structure which seamlessly combines encrypted tables with blockchain metadata. Simulation results show that, compared to existing hybrid architecture which does not provide privacy protection, SA-aChain has slightly higher storage overhead and query latency. The results demonstrate that SA-aChain balances well between privacy and efficiency, and is applicable to practical alert data management scenarios.