Uploaded June 2026 | Updated September 2026, 3 weeks ago
Iris: Expressive Traffic Analysis for the Modern Internet
Thea Rossman, Diana Qing, Gerry Wan, and Zakir Durumeric, Stanford University
In this work, we investigate the needs of modern traffic analysis, and we introduce Iris, a framework for efficiently building complex, high-performance traffic analysis applications. Iris's key contribution is a compiler that transforms user-defined traffic filters, stream transformations, and computation written in Rust into an optimized processing pipeline. The Iris compiler eliminates redundant logic across analysis tasks to generate a unified runtime that minimizes aggregate work, allowing it to scale to hundreds of concurrent workloads. Rather than restricting users to a domain-specific query language, Iris provides a flexible development environment by exposing connection- and application-layer semantics as Rust data types to user-defined functions. We show that Iris can execute hundreds of analysis tasks concurrently at 100Gbps+ on a single commodity server, and we demonstrate its flexibility through three use cases drawn from prior work.
View the full NSDI '26 program at usenix.org/conference/nsdi26/technical-sessions
Iris: Expressive Traffic Analysis for the Modern Internet
Thea Rossman, Diana Qing, Gerry Wan, and Zakir Durumeric, Stanford University
In this work, we investigate the needs of modern traffic analysis, and we introduce Iris, a framework for efficiently building complex, high-performance traffic analysis applications. Iris's key contribution is a compiler that transforms user-defined traffic filters, stream transformations, and computation written in Rust into an optimized processing pipeline. The Iris compiler eliminates redundant logic across analysis tasks to generate a unified runtime that minimizes aggregate work, allowing it to scale to hundreds of concurrent workloads. Rather than restricting users to a domain-specific query language, Iris provides a flexible development environment by exposing connection- and application-layer semantics as Rust data types to user-defined functions. We show that Iris can execute hundreds of analysis tasks concurrently at 100Gbps+ on a single commodity server, and we demonstrate its flexibility through three use cases drawn from prior work.
View the full NSDI '26 program at usenix.org/conference/nsdi26/technical-sessions
