Identifying Security-relevant Log Data for Long-Term Retention

Mon, 04 May 2026 00:00:00 +0000

Background

In increasingly digital and high-throughput networks, retaining log data for extended periods is crucial for incident response and forensic analysis. Yet because truly malicious activity is rare relative to benign behavior, organizations often store massive volumes of logs only to discard them after a retention window (e.g., 12–16 months) without ever using them. An intelligent approach that prioritizes security-relevant logs can preserve storage capacity, extend retention for truly valuable data, and concentrate analysis on information that matters during investigations. In collaboration with Deutsche Telekom Technik, this thesis aims to define and operationalize “heightened interest” for logs, ensuring long-term retention is risk-aware, cost-effective, and aligned with incident response needs.

Your Approach

This thesis will develop an AI-assisted framework for long-term log retention that prioritizes security relevance while respecting storage budgets and compliance requirements. Building on modern Transformer‑based models (e.g., BERT or domain variants like LogBERT), complemented by selectively used LLMs for normalization and analyst‑facing explanations, the approach estimates the significance of individual logs and their surrounding context. These signals are combined with asset criticality, incident response needs, and storage constraints to drive a transparent, budget-aware retention policy that keeps high-value events (and relevant context windows) for longer, while judiciously downsampling lower-value records within regulatory bounds.

What we offer

The opportunity to address cutting-edge security challenges
This thesis is in collaboration with Deutsche Telekom Technik GmbH, which will support the thesis with real-world data and expert knowledge from cybersecurity professionals.

What we expect

Good understanding of machien learning techniques
Solid programming skills (preferably in Python)
Experience with the Transformers/LLMs is a plus, but not mandatory
Ability to work independently and communicate effectively and regularly

Contact & Application

If you are interested, please send a brief motivation explaining how your skills fit the topic and your transcript of records via email.

Security Log Data Management | COMSYS | RWTH Aachen University

Identifying Security-relevant Log Data for Long-Term Retention

Background

Your Approach

What we offer

What we expect

Contact & Application