{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,12]],"date-time":"2026-02-12T15:57:11Z","timestamp":1770911831287,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":60,"publisher":"ACM","license":[{"start":{"date-parts":[[2018,8,7]],"date-time":"2018-08-07T00:00:00Z","timestamp":1533600000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["CNS-1704077"],"award-info":[{"award-number":["CNS-1704077"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2018,8,7]]},"DOI":"10.1145\/3230543.3230555","type":"proceedings-article","created":{"date-parts":[[2018,8,8]],"date-time":"2018-08-08T19:13:06Z","timestamp":1533755586000},"page":"357-371","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":211,"title":["Sonata"],"prefix":"10.1145","author":[{"given":"Arpit","family":"Gupta","sequence":"first","affiliation":[{"name":"Princeton University"}]},{"given":"Rob","family":"Harrison","sequence":"additional","affiliation":[{"name":"Princeton University"}]},{"given":"Marco","family":"Canini","sequence":"additional","affiliation":[{"name":"KAUST"}]},{"given":"Nick","family":"Feamster","sequence":"additional","affiliation":[{"name":"Princeton University"}]},{"given":"Jennifer","family":"Rexford","sequence":"additional","affiliation":[{"name":"Princeton University"}]},{"given":"Walter","family":"Willinger","sequence":"additional","affiliation":[{"name":"NIKSUN Inc."}]}],"member":"320","published-online":{"date-parts":[[2018,8,7]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"USENIX Security Symposium","author":"Antonakakis M.","year":"2017","unstructured":"Antonakakis , M. , April , T. , Bailey , M. , Bernhard , M. , Bursztein , E. , Cochran , J. , Durumeric , Z. , Halderman , J. A. , Invernizzi , L. , Kallitsis , M. , Understanding the Mirai botnet . In USENIX Security Symposium ( 2017 ). Antonakakis, M., April, T., Bailey, M., Bernhard, M., Bursztein, E., Cochran, J., Durumeric, Z., Halderman, J. A., Invernizzi, L., Kallitsis, M., et al. Understanding the Mirai botnet. In USENIX Security Symposium (2017)."},{"key":"e_1_3_2_1_2_1","unstructured":"Apache Thrift API. https:\/\/thrift.apache.org\/.  Apache Thrift API. https:\/\/thrift.apache.org\/."},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/2934872.2934892"},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1145\/2723372.2742797"},{"key":"e_1_3_2_1_5_1","unstructured":"Assignment 3 COS 561 Princeton University. https:\/\/github.com\/Sonata-Princeton\/SONATA-DEV\/tree\/tutorial\/sonata\/tutorials\/Tutorial-1.  Assignment 3 COS 561 Princeton University. https:\/\/github.com\/Sonata-Princeton\/SONATA-DEV\/tree\/tutorial\/sonata\/tutorials\/Tutorial-1."},{"key":"e_1_3_2_1_6_1","volume-title":"USENIX Network and Distributed System Security Symposium","author":"Bilge L.","year":"2011","unstructured":"Bilge , L. , Kirda , E. , Kruegel , C. , and Balduzzi , M . Exposure: Finding malicious domains using passive DNS analysis . In USENIX Network and Distributed System Security Symposium ( 2011 ). Bilge, L., Kirda, E., Kruegel, C., and Balduzzi, M. Exposure: Finding malicious domains using passive DNS analysis. In USENIX Network and Distributed System Security Symposium (2011)."},{"key":"e_1_3_2_1_7_1","volume-title":"USENIX Security Symposium","author":"Borders K.","year":"2012","unstructured":"Borders , K. , Springer , J. , and Burnside , M . Chimera: A declarative language for streaming network traffic analysis . In USENIX Security Symposium ( 2012 ). Borders, K., Springer, J., and Burnside, M. Chimera: A declarative language for streaming network traffic analysis. In USENIX Security Symposium (2012)."},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/2656877.2656890"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/2486001.2486011"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/872757.872838"},{"key":"e_1_3_2_1_11_1","unstructured":"The CAIDA UCSD Anonymized Internet Traces 2016-09. http:\/\/www.caida.org\/data\/passive\/passive_2016_dataset.xml.  The CAIDA UCSD Anonymized Internet Traces 2016-09. http:\/\/www.caida.org\/data\/passive\/passive_2016_dataset.xml."},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1145\/2815675.2815692"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/863955.863972"},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2004.03.033"},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.5555\/1251327.1251330"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/3005745.3005748"},{"key":"e_1_3_2_1_17_1","unstructured":"Gurobi Solver. http:\/\/www.gurobi.com\/.  Gurobi Solver. http:\/\/www.gurobi.com\/."},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/3185467.3185476"},{"key":"e_1_3_2_1_19_1","unstructured":"Hira M. and Wobker L. J. Improving Network Monitoring and Management with Programmable Data Planes. Blog posting http:\/\/p4.org\/p4\/inband-network-telemetry\/ September 2015.  Hira M. and Wobker L. J. Improving Network Monitoring and Management with Programmable Data Planes. Blog posting http:\/\/p4.org\/p4\/inband-network-telemetry\/ September 2015."},{"key":"e_1_3_2_1_20_1","volume-title":"September","author":"Izzard M.","year":"2016","unstructured":"Izzard , M. The Programmable Switch Chip Consigns Legacy Fixed-Function Chips to the History Books. https:\/\/goo.gl\/JKWnQc , September 2016 . Izzard, M. The Programmable Switch Chip Consigns Legacy Fixed-Function Chips to the History Books. https:\/\/goo.gl\/JKWnQc, September 2016."},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/2508859.2516719"},{"key":"e_1_3_2_1_22_1","volume-title":"USENIX NSDI","author":"Jose L.","year":"2015","unstructured":"Jose , L. , Yan , L. , Varghese , G. , and McKeown , N. Compiling packet programs to reconfigurable switches . In USENIX NSDI ( 2015 ). Jose, L., Yan, L., Varghese, G., and McKeown, N. Compiling packet programs to reconfigurable switches. In USENIX NSDI (2015)."},{"key":"e_1_3_2_1_23_1","volume-title":"Workshop on Hot Topics in Management of Internet, Cloud, and Enterprise Networks and Services (March","author":"Jose L.","year":"2011","unstructured":"Jose , L. , Yu , M. , and Rexford , J . Online measurement of large traffic aggregates on commodity switches . In Workshop on Hot Topics in Management of Internet, Cloud, and Enterprise Networks and Services (March 2011 ). Jose, L., Yu, M., and Rexford, J. Online measurement of large traffic aggregates on commodity switches. In Workshop on Hot Topics in Management of Internet, Cloud, and Enterprise Networks and Services (March 2011)."},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1109\/SECPRI.2004.1301325"},{"key":"e_1_3_2_1_25_1","volume-title":"USENIX Security Symposium","author":"K\u00fchrer M.","year":"2014","unstructured":"K\u00fchrer , M. , Hupperich , T. , Rossow , C. , and Holz , T . Exit from hell? Reducing the impact of amplification DDoS attacks . In USENIX Security Symposium ( 2014 ). K\u00fchrer, M., Hupperich, T., Rossow, C., and Holz, T. Exit from hell? Reducing the impact of amplification DDoS attacks. In USENIX Security Symposium (2014)."},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1145\/2934872.2934906"},{"key":"e_1_3_2_1_27_1","volume-title":"USENIX OSDI","author":"Madden S.","year":"2002","unstructured":"Madden , S. , Franklin , M. J. , Hellerstein , J. M. , and Hong , W . TAG: A Tiny Aggregation Service for Ad-hoc Sensor Networks . In USENIX OSDI ( 2002 ). Madden, S., Franklin, M. J., Hellerstein, J. M., and Hong, W. TAG: A Tiny Aggregation Service for Ad-hoc Sensor Networks. In USENIX OSDI (2002)."},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1145\/1061318.1061322"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1145\/2619239.2626291"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/2716281.2836099"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/2934872.2934879"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1109\/32.52778"},{"key":"e_1_3_2_1_33_1","volume-title":"USENIX NSDI","author":"Narayana S.","year":"2016","unstructured":"Narayana , S. , Arashloo , M. T. , Rexford , J. , and Walker , D . Compiling path queries . In USENIX NSDI ( 2016 ). Narayana, S., Arashloo, M. T., Rexford, J., and Walker, D. Compiling path queries. In USENIX NSDI (2016)."},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/3098822.3098829"},{"key":"e_1_3_2_1_35_1","volume-title":"USENIX Workshop on Offensive Technology","author":"Pa Y. M. P.","year":"2015","unstructured":"Pa , Y. M. P. , Suzuki , S. , Yoshioka , K. , Matsumoto , T. , Kasama , T. , and Rossow , C . IoTPOT: Analysing the rise of IoT compromises . In USENIX Workshop on Offensive Technology ( 2015 ). Pa, Y. M. P., Suzuki, S., Yoshioka, K., Matsumoto, T., Kasama, T., and Rossow, C. IoTPOT: Analysing the rise of IoT compromises. In USENIX Workshop on Offensive Technology (2015)."},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1145\/2588555.2610521"},{"key":"e_1_3_2_1_37_1","unstructured":"An update on the Memcached\/Redis benchmark. http:\/\/oldblog.antirez.com\/post\/update-on-memcached-redis-benchmark.html.  An update on the Memcached\/Redis benchmark. http:\/\/oldblog.antirez.com\/post\/update-on-memcached-redis-benchmark.html."},{"key":"e_1_3_2_1_38_1","unstructured":"Apache Flink. http:\/\/flink.apache.org\/.  Apache Flink. http:\/\/flink.apache.org\/."},{"key":"e_1_3_2_1_39_1","unstructured":"Benchmarking Apache Kafka: 2 Million Writes Per Second (On Three Cheap Machines). https:\/\/engineering.linkedin.com\/kafka\/benchmarking-apache-kafka-2-million-writes-second-three-cheap-machines.  Benchmarking Apache Kafka: 2 Million Writes Per Second (On Three Cheap Machines). https:\/\/engineering.linkedin.com\/kafka\/benchmarking-apache-kafka-2-million-writes-second-three-cheap-machines."},{"key":"e_1_3_2_1_40_1","unstructured":"OpenSOC. http:\/\/opensoc.github.io\/.  OpenSOC. http:\/\/opensoc.github.io\/."},{"key":"e_1_3_2_1_41_1","unstructured":"OpenSOC Scalability. https:\/\/goo.gl\/CX2jWr.  OpenSOC Scalability. https:\/\/goo.gl\/CX2jWr."},{"key":"e_1_3_2_1_42_1","unstructured":"Sonata's technical report. http:\/\/www.cs.princeton.edu\/~arpitg\/pdfs\/sonata_tr.pdf.  Sonata's technical report. http:\/\/www.cs.princeton.edu\/~arpitg\/pdfs\/sonata_tr.pdf."},{"key":"e_1_3_2_1_43_1","unstructured":"The Bro Network Security Monitor. https:\/\/www.bro.org\/.  The Bro Network Security Monitor. https:\/\/www.bro.org\/."},{"key":"e_1_3_2_1_44_1","unstructured":"The CAIDA Anonymized Internet Traces 2016 Dataset. https:\/\/www.caida.org\/data\/passive\/passive_2016_dataset.xml.  The CAIDA Anonymized Internet Traces 2016 Dataset. https:\/\/www.caida.org\/data\/passive\/passive_2016_dataset.xml."},{"key":"e_1_3_2_1_45_1","volume-title":"June","author":"Slowloris S.","year":"2009","unstructured":"Slowloris HTTP Do S. https:\/\/web.archive.org\/web\/20150426090206\/http:\/\/ha.ckers.org\/slowloris , June 2009 . Slowloris HTTP DoS. https:\/\/web.archive.org\/web\/20150426090206\/http:\/\/ha.ckers.org\/slowloris, June 2009."},{"key":"e_1_3_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1145\/1065167.1065199"},{"key":"e_1_3_2_1_47_1","volume-title":"USENIX OSDI","author":"Tammana P.","year":"2016","unstructured":"Tammana , P. , Agarwal , R. , and Lee , M . Simplifying datacenter network debugging with PathDump . In USENIX OSDI ( 2016 ). Tammana, P., Agarwal, R., and Lee, M. Simplifying datacenter network debugging with PathDump. In USENIX OSDI (2016)."},{"key":"e_1_3_2_1_48_1","unstructured":"Apache Spark. http:\/\/spark.apache.org\/.  Apache Spark. http:\/\/spark.apache.org\/."},{"key":"e_1_3_2_1_49_1","unstructured":"Barefoot's Tofino. https:\/\/www.barefootnetworks.com\/technology\/.  Barefoot's Tofino. https:\/\/www.barefootnetworks.com\/technology\/."},{"key":"e_1_3_2_1_50_1","unstructured":"P4 software switch. https:\/\/github.com\/p4lang\/behavioral-model.  P4 software switch. https:\/\/github.com\/p4lang\/behavioral-model."},{"key":"e_1_3_2_1_51_1","unstructured":"Scapy: Python-based interactive packet manipulation program. https:\/\/github.com\/secdev\/scapy\/.  Scapy: Python-based interactive packet manipulation program. https:\/\/github.com\/secdev\/scapy\/."},{"key":"e_1_3_2_1_52_1","unstructured":"SONATA Github. https:\/\/github.com\/Sonata-Princeton\/SONATA-DEV.  SONATA Github. https:\/\/github.com\/Sonata-Princeton\/SONATA-DEV."},{"key":"e_1_3_2_1_53_1","unstructured":"Sonata Queries. https:\/\/github.com\/sonata-queries\/sonata-queries.  Sonata Queries. https:\/\/github.com\/sonata-queries\/sonata-queries."},{"key":"e_1_3_2_1_54_1","volume-title":"May","author":"Vinnakota B.","year":"2016","unstructured":"Vinnakota , B. P4 with the Netronome Server Networking Platform. https:\/\/goo.gl\/PKQtC7 , May 2016 . Vinnakota, B. P4 with the Netronome Server Networking Platform. https:\/\/goo.gl\/PKQtC7, May 2016."},{"key":"e_1_3_2_1_55_1","volume-title":"Network telemetry and big data analysis","author":"Wu Q.","year":"2016","unstructured":"Wu , Q. , Strassner , J. , Farrel , A. , and Zhang , L . Network telemetry and big data analysis . Network Working Group Internet-Draft ( 2016 (Expired)). Wu, Q., Strassner, J., Farrel, A., and Zhang, L. Network telemetry and big data analysis. Network Working Group Internet-Draft (2016 (Expired))."},{"key":"e_1_3_2_1_56_1","volume-title":"USENIX NSDI","author":"Yu M.","year":"2013","unstructured":"Yu , M. , Jose , L. , and Miao , R . Software Defined Traffic Measurement with OpenSketch . In USENIX NSDI ( 2013 ). Yu, M., Jose, L., and Miao, R. Software Defined Traffic Measurement with OpenSketch. In USENIX NSDI (2013)."},{"key":"e_1_3_2_1_57_1","doi-asserted-by":"publisher","DOI":"10.1145\/1282380.1282392"},{"key":"e_1_3_2_1_58_1","doi-asserted-by":"publisher","DOI":"10.1145\/3098822.3098830"},{"key":"e_1_3_2_1_59_1","doi-asserted-by":"publisher","DOI":"10.1145\/2517349.2522737"},{"key":"e_1_3_2_1_60_1","doi-asserted-by":"publisher","DOI":"10.1145\/2785956.2787483"}],"event":{"name":"SIGCOMM '18: ACM SIGCOMM 2018 Conference","location":"Budapest Hungary","acronym":"SIGCOMM '18","sponsor":["SIGCOMM ACM Special Interest Group on Data Communication"]},"container-title":["Proceedings of the 2018 Conference of the ACM Special Interest Group on Data Communication"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3230543.3230555","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3230543.3230555","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3230543.3230555","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T01:39:46Z","timestamp":1750210786000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3230543.3230555"}},"subtitle":["query-driven streaming network telemetry"],"short-title":[],"issued":{"date-parts":[[2018,8,7]]},"references-count":60,"alternative-id":["10.1145\/3230543.3230555","10.1145\/3230543"],"URL":"https:\/\/doi.org\/10.1145\/3230543.3230555","relation":{},"subject":[],"published":{"date-parts":[[2018,8,7]]},"assertion":[{"value":"2018-08-07","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}