{"id":"https://openalex.org/W54019231","doi":null,"title":"Chimera: a declarative language for streaming network traffic analysis","display_name":"Chimera: a declarative language for streaming network traffic analysis","publication_year":2012,"publication_date":"2012-08-08","ids":{"openalex":"https://openalex.org/W54019231","mag":"54019231"},"language":"en","primary_location":{"id":"pmh:oai:CiteSeerX.psu:10.1.1.360.4102","doi":null,"is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.360.4102","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final116.pdf","raw_type":"text"},"volume":null,"type":"conference-paper","is_traditional":true,"indexed_in":[],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5035783903","display_name":"Kevin Borders","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I130440993","display_name":"National Security Agency","ror":"https://ror.org/0047bvr32","country_code":"US","type":"government","lineage":["https://openalex.org/I130440993","https://openalex.org/I1330347796"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Kevin Borders","raw_affiliation_strings":["National Security Agency ,"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National Security Agency ,","institution_ids":["https://openalex.org/I130440993"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5089567502","display_name":"Jonathan Springer","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I4210102519","display_name":"Reservoir Labs (United States)","ror":"https://ror.org/01a3m3f05","country_code":"US","type":"company","lineage":["https://openalex.org/I4210102519"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jonathan Springer","raw_affiliation_strings":["Reservoir Labs#TAB#"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Reservoir Labs#TAB#","institution_ids":["https://openalex.org/I4210102519"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5079540774","display_name":"Matthew Burnside","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I130440993","display_name":"National Security Agency","ror":"https://ror.org/0047bvr32","country_code":"US","type":"government","lineage":["https://openalex.org/I130440993","https://openalex.org/I1330347796"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Matthew Burnside","raw_affiliation_strings":["National Security Agency ,"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National Security Agency ,","institution_ids":["https://openalex.org/I130440993"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.2084,"has_fulltext":false,"cited_by_count":44,"citation_normalized_percentile":{"value":0.76620087,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"19","last_page":"19"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.8065999746322632,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.8065999746322632,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.11649999767541885,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10317","display_name":"Advanced Database Systems and Queries","score":0.057999998331069946,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/chimeras","display_name":"chimeras","score":0.9449999928474426},{"id":"https://openalex.org/keywords/declarative-query-language","display_name":"declarative query language","score":0.9710000157356262},{"id":"https://openalex.org/keywords/network-traffic-analysis","display_name":"network traffic analysis","score":0.9449999928474426},{"id":"https://openalex.org/keywords/intrusion-detection-systems","display_name":"intrusion detection systems","score":0.8550000190734863},{"id":"https://openalex.org/keywords/policy-language","display_name":"policy language","score":0.7929999828338623},{"id":"https://openalex.org/keywords/first-class-functions","display_name":"first-class functions","score":0.8970000147819519},{"id":"https://openalex.org/keywords/structured-data-types","display_name":"structured data types","score":0.8920000195503235}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8847044706344604},{"id":"https://openalex.org/C510870499","wikidata":"https://www.wikidata.org/wiki/Q47607","display_name":"SQL","level":2,"score":0.6362818479537964},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.5713149309158325},{"id":"https://openalex.org/C169590947","wikidata":"https://www.wikidata.org/wiki/Q47506","display_name":"Compiler","level":2,"score":0.5622624158859253},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5460841059684753},{"id":"https://openalex.org/C56288433","wikidata":"https://www.wikidata.org/wiki/Q58673","display_name":"Data manipulation language","level":2,"score":0.45987528562545776},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.3264400362968445},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.19989854097366333}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:CiteSeerX.psu:10.1.1.360.4102","doi":null,"is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.360.4102","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final116.pdf","raw_type":"text"},{"id":"mag:54019231","doi":null,"is_oa":false,"landing_page_url":"https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final116.pdf","pdf_url":null,"source":null,"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":null}],"best_oa_location":null,"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":23,"referenced_works":["https://openalex.org/W1491178396","https://openalex.org/W1516506771","https://openalex.org/W1604972505","https://openalex.org/W1674877186","https://openalex.org/W1860215963","https://openalex.org/W1922832738","https://openalex.org/W1954903228","https://openalex.org/W2101717554","https://openalex.org/W2109507516","https://openalex.org/W2129088288","https://openalex.org/W2129502462","https://openalex.org/W2131413649","https://openalex.org/W2135292514","https://openalex.org/W2136195851","https://openalex.org/W2144261930","https://openalex.org/W2149576945","https://openalex.org/W2150397765","https://openalex.org/W2151575925","https://openalex.org/W2156972533","https://openalex.org/W2157022252","https://openalex.org/W2158466615","https://openalex.org/W2167679350","https://openalex.org/W2611007427"],"related_works":["https://openalex.org/W7168014573","https://openalex.org/W45323394","https://openalex.org/W7097602386","https://openalex.org/W6999603174","https://openalex.org/W2055506298","https://openalex.org/W2275006726","https://openalex.org/W831585235","https://openalex.org/W7095815168","https://openalex.org/W2999192487","https://openalex.org/W7101043738"],"abstract_inverted_index":{"Intrusion":[0],"detection":[1,34,77,100,143],"systems":[2,13,35,56,101],"play":[3],"a":[4,85,103,156],"vital":[5],"role":[6],"in":[7,47],"network":[8,90,116],"security.":[9],"Central":[10],"to":[11,18,60,67,113,137],"these":[12,132],"is":[14],"the":[15,69,95,151,166],"language":[16,23,46,88],"used":[17],"express":[19],"policies.":[20],"Ideally,":[21],"this":[22,39,80],"should":[24],"be":[25,135],"powerful,":[26],"implementation-agnostic,":[27],"and":[28,71,102,125,144,153],"cross-platform.":[29],"Unfortunately,":[30],"today\u2019s":[31],"popular":[32],"intrusion":[33,76,99],"fall":[36],"short":[37],"of":[38,155],"goal.":[40],"Each":[41],"has":[42],"their":[43],"own":[44],"policy":[45],"which":[48],"expressing":[49],"complicated":[50],"logic":[51],"requires":[52],"implementation-specific":[53],"code.":[54],"Database":[55],"have":[57,65],"adapted":[58],"SQL":[59,106,111],"handle":[61,115],"streaming":[62,110],"data,":[63],"but":[64],"yet":[66],"achieve":[68],"efficiency":[70],"flexibility":[72],"required":[73],"for":[74,89,165],"complex":[75],"tasks.":[78],"In":[79],"paper,":[81],"we":[82,149],"introduce":[83],"Chimera,":[84],"declarative":[86],"query":[87],"traffic":[91,117],"processing":[92],"that":[93,158],"bridges":[94],"gap":[96],"between":[97],"powerful":[98],"simple,":[104],"platform-independent":[105],"syntax.":[107],"Chimera":[108,160],"extends":[109],"languages":[112],"better":[114],"by":[118],"adding":[119],"structured":[120],"data":[121],"types,":[122],"first-class":[123],"functions,":[124],"dynamic":[126],"window":[127],"boundaries.":[128],"We":[129],"show":[130],"how":[131],"constructs":[133],"can":[134],"applied":[136],"realworld":[138],"scenarios,":[139],"such":[140],"as":[141],"side-jacking":[142],"DNS":[145],"feature":[146],"extraction.":[147],"Finally,":[148],"describe":[150],"implementation":[152],"evaluation":[154],"compiler":[157],"translates":[159],"queries":[161],"into":[162],"low-level":[163],"code":[164],"Bro":[167],"event":[168],"language.":[169],"1":[170]},"counts_by_year":[{"year":2024,"cited_by_count":3},{"year":2023,"cited_by_count":4},{"year":2022,"cited_by_count":5},{"year":2021,"cited_by_count":9},{"year":2020,"cited_by_count":6},{"year":2019,"cited_by_count":3},{"year":2018,"cited_by_count":4},{"year":2017,"cited_by_count":1},{"year":2016,"cited_by_count":4},{"year":2015,"cited_by_count":2},{"year":2014,"cited_by_count":3}],"updated_date":"2026-11-03T10:50:19.383937","created_date":"2016-06-24T00:00:00"}