{"id":"https://openalex.org/W2547023114","doi":"https://doi.org/10.1145/3005745.3005748","title":"Network Monitoring as a Streaming Analytics Problem","display_name":"Network Monitoring as a Streaming Analytics Problem","publication_year":2016,"publication_date":"2016-11-02","ids":{"openalex":"https://openalex.org/W2547023114","doi":"https://doi.org/10.1145/3005745.3005748","mag":"2547023114"},"language":"en","primary_location":{"id":"doi:10.1145/3005745.3005748","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3005745.3005748","pdf_url":"http://dl.acm.org/ft_gateway.cfm?id=3005748&type=pdf","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 15th ACM Workshop on Hot Topics in Networks","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"http://dl.acm.org/ft_gateway.cfm?id=3005748&type=pdf","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5046100948","display_name":"Arpit Gupta","orcid":"https://orcid.org/0000-0002-6378-7440"},"institutions":[{"id":"https://openalex.org/I20089843","display_name":"Princeton University","ror":"https://ror.org/00hx57361","country_code":"US","type":"education","lineage":["https://openalex.org/I20089843"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Arpit Gupta","raw_affiliation_strings":["Princeton University"],"affiliations":[{"raw_affiliation_string":"Princeton University","institution_ids":["https://openalex.org/I20089843"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5072860899","display_name":"R\u00fcdiger Birkner","orcid":null},"institutions":[{"id":"https://openalex.org/I35440088","display_name":"ETH Zurich","ror":"https://ror.org/05a28rw58","country_code":"CH","type":"education","lineage":["https://openalex.org/I2799323385","https://openalex.org/I35440088"]}],"countries":["CH"],"is_corresponding":false,"raw_author_name":"R\u00fcdiger Birkner","raw_affiliation_strings":["ETH Z\u00fcrich"],"affiliations":[{"raw_affiliation_string":"ETH Z\u00fcrich","institution_ids":["https://openalex.org/I35440088"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5042255975","display_name":"Marco Canini","orcid":"https://orcid.org/0000-0002-5051-4283"},"institutions":[{"id":"https://openalex.org/I4210099236","display_name":"Kootenay Association for Science & Technology","ror":"https://ror.org/011pv9p44","country_code":"CA","type":"nonprofit","lineage":["https://openalex.org/I4210099236"]},{"id":"https://openalex.org/I71920554","display_name":"King Abdullah University of Science and Technology","ror":"https://ror.org/01q3tbs38","country_code":"SA","type":"education","lineage":["https://openalex.org/I71920554"]}],"countries":["CA","SA"],"is_corresponding":false,"raw_author_name":"Marco Canini","raw_affiliation_strings":["KAUST"],"affiliations":[{"raw_affiliation_string":"KAUST","institution_ids":["https://openalex.org/I4210099236","https://openalex.org/I71920554"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5068586837","display_name":"Nick Feamster","orcid":"https://orcid.org/0000-0001-9315-5201"},"institutions":[{"id":"https://openalex.org/I20089843","display_name":"Princeton University","ror":"https://ror.org/00hx57361","country_code":"US","type":"education","lineage":["https://openalex.org/I20089843"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Nick Feamster","raw_affiliation_strings":["Princeton University"],"affiliations":[{"raw_affiliation_string":"Princeton University","institution_ids":["https://openalex.org/I20089843"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5066935793","display_name":"Chris Mac-Stoker","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chris Mac-Stoker","raw_affiliation_strings":["NIKSUN, Inc"],"affiliations":[{"raw_affiliation_string":"NIKSUN, Inc","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5082255432","display_name":"Walter Willinger","orcid":"https://orcid.org/0000-0002-1384-8188"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Walter Willinger","raw_affiliation_strings":["NIKSUN, Inc"],"affiliations":[{"raw_affiliation_string":"NIKSUN, Inc","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":4,"institutions_distinct_count":6,"corresponding_author_ids":["https://openalex.org/A5046100948"],"corresponding_institution_ids":["https://openalex.org/I20089843"],"apc_list":null,"apc_paid":null,"fwci":7.0875,"has_fulltext":true,"cited_by_count":52,"citation_normalized_percentile":{"value":0.97262136,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":90,"max":100},"biblio":{"volume":null,"issue":null,"first_page":"106","last_page":"112"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10714","display_name":"Software-Defined Networks and 5G","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10714","display_name":"Software-Defined Networks and 5G","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10138","display_name":"Network Traffic and Congestion Control","score":0.9991999864578247,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8599693179130554},{"id":"https://openalex.org/keywords/stream-processing","display_name":"Stream processing","score":0.6853805184364319},{"id":"https://openalex.org/keywords/scalability","display_name":"Scalability","score":0.6699753403663635},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.5906369090080261},{"id":"https://openalex.org/keywords/analytics","display_name":"Analytics","score":0.5267267227172852},{"id":"https://openalex.org/keywords/tuple","display_name":"Tuple","score":0.4785507321357727},{"id":"https://openalex.org/keywords/query-plan","display_name":"Query plan","score":0.4708903431892395},{"id":"https://openalex.org/keywords/data-stream","display_name":"Data stream","score":0.4611987769603729},{"id":"https://openalex.org/keywords/data-stream-mining","display_name":"Data stream mining","score":0.4164232611656189},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.36536091566085815},{"id":"https://openalex.org/keywords/real-time-computing","display_name":"Real-time computing","score":0.35536453127861023},{"id":"https://openalex.org/keywords/distributed-computing","display_name":"Distributed computing","score":0.3003382384777069},{"id":"https://openalex.org/keywords/sargable","display_name":"Sargable","score":0.2620593011379242},{"id":"https://openalex.org/keywords/database","display_name":"Database","score":0.2537667155265808},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.23036032915115356},{"id":"https://openalex.org/keywords/search-engine","display_name":"Search engine","score":0.22517260909080505},{"id":"https://openalex.org/keywords/web-search-query","display_name":"Web search query","score":0.22500327229499817},{"id":"https://openalex.org/keywords/information-retrieval","display_name":"Information retrieval","score":0.11940652132034302}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8599693179130554},{"id":"https://openalex.org/C107027933","wikidata":"https://www.wikidata.org/wiki/Q2006448","display_name":"Stream processing","level":2,"score":0.6853805184364319},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.6699753403663635},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.5906369090080261},{"id":"https://openalex.org/C79158427","wikidata":"https://www.wikidata.org/wiki/Q485396","display_name":"Analytics","level":2,"score":0.5267267227172852},{"id":"https://openalex.org/C118930307","wikidata":"https://www.wikidata.org/wiki/Q600590","display_name":"Tuple","level":2,"score":0.4785507321357727},{"id":"https://openalex.org/C2779729312","wikidata":"https://www.wikidata.org/wiki/Q784232","display_name":"Query plan","level":5,"score":0.4708903431892395},{"id":"https://openalex.org/C2778484313","wikidata":"https://www.wikidata.org/wiki/Q1172540","display_name":"Data stream","level":2,"score":0.4611987769603729},{"id":"https://openalex.org/C89198739","wikidata":"https://www.wikidata.org/wiki/Q3079880","display_name":"Data stream mining","level":2,"score":0.4164232611656189},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.36536091566085815},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.35536453127861023},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.3003382384777069},{"id":"https://openalex.org/C192939062","wikidata":"https://www.wikidata.org/wiki/Q104840822","display_name":"Sargable","level":4,"score":0.2620593011379242},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.2537667155265808},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.23036032915115356},{"id":"https://openalex.org/C97854310","wikidata":"https://www.wikidata.org/wiki/Q19541","display_name":"Search engine","level":2,"score":0.22517260909080505},{"id":"https://openalex.org/C164120249","wikidata":"https://www.wikidata.org/wiki/Q995982","display_name":"Web search query","level":3,"score":0.22500327229499817},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.11940652132034302},{"id":"https://openalex.org/C76155785","wikidata":"https://www.wikidata.org/wiki/Q418","display_name":"Telecommunications","level":1,"score":0.0},{"id":"https://openalex.org/C118615104","wikidata":"https://www.wikidata.org/wiki/Q121416","display_name":"Discrete mathematics","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/3005745.3005748","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3005745.3005748","pdf_url":"http://dl.acm.org/ft_gateway.cfm?id=3005748&type=pdf","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 15th ACM Workshop on Hot Topics in Networks","raw_type":"proceedings-article"},{"id":"pmh:oai:repository.kaust.edu.sa:10754/622573","is_oa":false,"landing_page_url":"http://hdl.handle.net/10754/622573","pdf_url":null,"source":{"id":"https://openalex.org/S4306401596","display_name":"King Abdullah University of Science and Technology Repository (King Abdullah University of Science and Technology)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I71920554","host_organization_name":"King Abdullah University of Science and Technology","host_organization_lineage":["https://openalex.org/I71920554"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"Conference Paper"}],"best_oa_location":{"id":"doi:10.1145/3005745.3005748","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3005745.3005748","pdf_url":"http://dl.acm.org/ft_gateway.cfm?id=3005748&type=pdf","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 15th ACM Workshop on Hot Topics in Networks","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1607469483","display_name":"NeTS: Medium: Collaborative Research: A Software Defined Internet Exchange","funder_award_id":"1539920","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G2999818235","display_name":null,"funder_award_id":"CNS-1539920","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G3522681013","display_name":null,"funder_award_id":"644960","funder_id":"https://openalex.org/F4320320300","funder_display_name":"European Commission"},{"id":"https://openalex.org/G4929706509","display_name":null,"funder_award_id":"644960","funder_id":"https://openalex.org/F4320335254","funder_display_name":"Horizon 2020"},{"id":"https://openalex.org/G8318064016","display_name":null,"funder_award_id":"Horizon","funder_id":"https://openalex.org/F4320320300","funder_display_name":"European Commission"},{"id":"https://openalex.org/G848032724","display_name":null,"funder_award_id":"Science","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"},{"id":"https://openalex.org/F4320320300","display_name":"European Commission","ror":"https://ror.org/00k4n6c32"},{"id":"https://openalex.org/F4320320719","display_name":"Department of Science and Technology, Ministry of Science and Technology, India","ror":"https://ror.org/0101xrq71"},{"id":"https://openalex.org/F4320335254","display_name":"Horizon 2020","ror":null}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W2547023114.pdf","grobid_xml":"https://content.openalex.org/works/W2547023114.grobid-xml"},"referenced_works_count":27,"referenced_works":["https://openalex.org/W15949162","https://openalex.org/W40890042","https://openalex.org/W54019231","https://openalex.org/W171087157","https://openalex.org/W1484539234","https://openalex.org/W1744212210","https://openalex.org/W1858168446","https://openalex.org/W1993226606","https://openalex.org/W1994926493","https://openalex.org/W1995328140","https://openalex.org/W2038412523","https://openalex.org/W2062735494","https://openalex.org/W2068084848","https://openalex.org/W2118828104","https://openalex.org/W2126453171","https://openalex.org/W2144261930","https://openalex.org/W2147118406","https://openalex.org/W2168911445","https://openalex.org/W2189400569","https://openalex.org/W2255206882","https://openalex.org/W2266632434","https://openalex.org/W2340103561","https://openalex.org/W2547333022","https://openalex.org/W2562897376","https://openalex.org/W2914012796","https://openalex.org/W4246132045","https://openalex.org/W6639080731"],"related_works":["https://openalex.org/W2347305876","https://openalex.org/W2044761590","https://openalex.org/W2118924829","https://openalex.org/W4253061173","https://openalex.org/W4389449520","https://openalex.org/W2151831402","https://openalex.org/W2157032266","https://openalex.org/W2949310134","https://openalex.org/W180351855","https://openalex.org/W1162555933"],"abstract_inverted_index":{"Programmable":[0],"switches":[1,49,154],"potentially":[2],"make":[3,19],"it":[4,20],"easier":[5],"to":[6,22,26,54,63,72,112,129,147,166,173,184,227],"perform":[7,113],"flexible":[8],"network":[9,33,39,81,110,117,132],"monitoring":[10,40,82,118,133],"queries":[11,30,41,190],"at":[12,42,75,120,193],"line":[13],"rate,":[14],"and":[15,50,59,101,155,159,208,242],"scalable":[16],"stream":[17,52,157,180],"processors":[18,53],"possible":[21],"fuse":[23],"data":[24,234],"streams":[25],"answer":[27],"more":[28],"sophisticated":[29],"about":[31,240],"the":[32,48,51,56,73,78,99,149,153,156,169,174,179,214,228,232,243],"in":[34,95],"real-time.":[35],"However,":[36],"processing":[37],"such":[38],"high":[43,195],"traffic":[44,57,67,170,192,209,225],"rates":[45],"requires":[46],"both":[47,152],"filter":[55],"iteratively":[58],"adaptively":[60],"so":[61],"as":[62,139],"extract":[64,167],"only":[65,168],"that":[66,68,80,108,171,178,218],"is":[69,83,98],"of":[70,103,189,213,223,239,245,251],"interest":[71],"query":[74,134,150,203],"hand.":[76],"While":[77],"realization":[79],"a":[84,105,131,140,186,200,237],"streaming":[85,114],"analytics":[86,115],"problem":[87],"has":[88],"been":[89],"made":[90],"earlier,":[91],"our":[92],"main":[93],"contribution":[94],"this":[96,124],"paper":[97],"design":[100],"implementation":[102],"Sonata,":[104],"closed-loop":[106],"system":[107],"enables":[109],"operators":[111,128],"for":[116,191],"applications":[119],"scale.":[121],"To":[122],"achieve":[123],"objective,":[125],"Sonata":[126,144,219],"allows":[127,145],"express":[130],"by":[135,236,248],"considering":[136],"each":[137],"packet":[138],"tuple.":[141],"More":[142],"importantly,":[143],"them":[146],"partition":[148],"across":[151],"processor,":[158],"through":[160],"iterative":[161],"refinement,":[162],"Sonata's":[163],"runtime":[164],"attempts":[165],"pertains":[172],"query,":[175,229],"thus":[176],"ensuring":[177],"processor":[181],"can":[182,220],"scale":[183],"satisfy":[185],"large":[187],"number":[188,244],"very":[194],"rates.":[196],"We":[197],"show":[198],"with":[199],"simple":[201],"example":[202],"involving":[204],"DNS":[205],"reflection":[206],"attacks":[207],"traces":[210],"from":[211],"one":[212],"world's":[215],"largest":[216],"IXPs":[217],"capture":[221],"95%":[222],"all":[224],"pertaining":[226],"while":[230],"reducing":[231],"overall":[233],"rate":[235],"factor":[238],"400":[241],"required":[246],"counters":[247],"four":[249],"orders":[250],"magnitude.":[252]},"counts_by_year":[{"year":2025,"cited_by_count":4},{"year":2024,"cited_by_count":3},{"year":2023,"cited_by_count":5},{"year":2022,"cited_by_count":1},{"year":2021,"cited_by_count":4},{"year":2020,"cited_by_count":11},{"year":2019,"cited_by_count":5},{"year":2018,"cited_by_count":13},{"year":2017,"cited_by_count":5},{"year":2016,"cited_by_count":1}],"updated_date":"2026-04-13T07:58:08.660418","created_date":"2025-10-10T00:00:00"}