Iris: Expressive Traffic Analysis for the Modern Internet#

Thea Rossman, Diana Qing, Gerry Wan, Zakir Durumeric (Stanford University)

• Why: Security/ops teams keep bolting one-off sniffers and Zeek scripts onto high-speed links; Iris asks what a framework for high-performance traffic analysis should look like and delivers one that composes hundreds of tasks on one box.
• What: A compiler-based framework that turns user-defined filters, stream transformations, and computations written in Rust into an optimized pipeline — executing hundreds of concurrent analysis tasks at 100 Gbps+ on a single commodity server.
• How: The compiler eliminates redundant logic across concurrent analysis tasks to produce one unified runtime minimizing aggregate work; users get connection- and application-layer semantics exposed as Rust types rather than a constrained DSL.
• Where applicable: General monitoring/security-analysis infrastructure, not tied to specific hardware. Artifact evaluated (available/functional/reproduced), so teams could realistically pilot it against existing Zeek/Graylog-style pipelines.