Publications

2026

1. Vision

   ASAP: Reimagining the Data Lifecycle using Application Semantic-Aware Processing

   Milind Srivastava, Zeying Zhu, Yajie Zhou, and 5 more authors

   2026

   Vision paper

   Abs

   Across many domains (e.g., observability, networking, security), data processing pipelines face what we refer to as the Cost-Scale-Performance (CSP) problem: achieving low Cost at large Scale, while maintaining high Performance. In response, we see several efforts to tackle CSP in various stages of the Collect-Transmit-Store-Analyze data lifecycle; such as approximate query processing in databases or sketches in network routers. Our work is driven by the simple insight: "seeing the forest for the trees". These proposed solutions (e.g., AQP, sketching, compression, rollup) addressing CSP share a common property – they exploit semantic-preserving opportunities to support application needs. In this paper, we make a case for ASAP, a paradigm that makes Application Semantic-Aware Processing (ASAP) a first-class design principle in data processing pipelines. We argue that by taking a unified view across ASAP primitives developed in different domains, across the entire data lifecycle, we can unlock new opportunities to tackle the CSP problem. In particular, we can: (i) enable novel cross-lifecycle optimizations such as analytics run directly on sketches computed at the source; (ii) leverage primitives developed in other application domains; and (iii) enable widespread adoption of these powerful techniques. We discuss research challenges in socializing the benefits of the ASAP paradigm, and show preliminary evidence that adopting ASAP can yield up to three orders of magnitude improvements in the CSP tradeoff for many application domains.

2. SIGCOMM

   Zero-Knowledge Cloud Analytics

   Zeying Zhu, Clarence Lam, Alexander Frolov, and 2 more authors

   In Proceedings of the ACM SIGCOMM 2026 Conference, Denver, CO, USA, 2026

   Abs DOI Code

   We present zk-Analytics, a distributed cloud analytics system that enables publicly verifiable analytics without revealing raw logs or relying on trusted hardware in analytics providers’ infrastructure. Today’s cloud analytics are largely self-assertive: providers collect telemetry, perform aggregation, and report results, leaving external parties unable to verify correctness without access to sensitive data or trusted execution environments. zk-Analytics addresses this gap by augmenting analytics pipelines with lightweight append-only log commitments and verifiable aggregation and query execution using zero-knowledge proofs. The system cleanly separates online log commitment from offline, distributed batch aggregation and query verification, enabling scalability while keeping online overhead low. We implement zk-Analytics using a zkVM-based execution environment and evaluate it on real-world and synthetic workloads, demonstrating that verifiable, privacy-preserving cloud analytics is feasible for real-world cloud workloads.

3. SIGCOMM Demo

   DEMO: ASAPQuery: A Drop-in Sketch-based Query Accelerator for Netflow Analytics

   Akanksha Akkihal, Milind Srivastava, and Vyas Sekar

   In Proceedings of the ACM SIGCOMM 2026 Conference, Denver, CO, USA, 2026

   Abs DOI Code

   Network operators rely on NetFlow telemetry to monitor attacks, diagnose performance, and analyze traffic. To do so, they run SQL queries over recent time windows to detect heavy hitters, anomalies, and tail metrics, served through analytics databases and dashboards. These NetFlow records are typically stored in databases like ClickHouse, which are well-tuned for full-scan analytical queries through column compression, vectorized execution, and time-based partitioning. Even so, every query remains bound by the cost of scanning each row in its window, a cost that increases with the ingestion rate. As data volumes and field cardinality (e.g., IP addresses) grow, these scans slow dashboards during traffic spikes, precisely when timely insight matters most. We built ASAPQuery, a sketch-based accelerator for NetFlow SQL workloads that drops into an existing stack with no database changes or query rewrites. It sits between the operator’s dashboard and the analytics database, serving queries from streaming sketches when one matches and forwarding the rest to the database for exact execution.

4. SIGCOMM Poster

   POSTER: DeePCAP: Enabling High-Fidelity and Cost-Efficient Archival Packet Trace Storage

   Fenghao Dong, Yucheng Yin, Yajie Zhou, and 3 more authors

   In Proceedings of the ACM SIGCOMM 2026 Conference, Denver, CO, USA, 2026

   Abs DOI

   Long-term network packet traces (e.g., pcaps), if available, can enable and inform lots of management tasks. However, storing packet data at scale is very expensive, forcing operators to choose between coarse historical summaries or short retention windows. In this context, deep generative compression (DGC) offers a new hope to store compact model parameters and regenerate structurally accurate traces on demand. We evaluate the suitability of recent deep generative approaches for packet trace modeling and generation. We find that their fidelity metrics are disconnected from the domain-specific queries/use cases, and they have bad cost-fidelity trade-off. We propose DeePCAP, an end-to-end trace storage system to close this gap. DeePCAP introduces a query-driven fidelity framework spanning packet- and flow-level queries to tackle the fidelity disconnection, and proposes a novel dimensionality reduction approach using frequency domain encoding to improve cost-fidelity trade-off. Our preliminary results show that DeePCAP achieves the best fidelity on the 100+ query suite and the strongest cost-fidelity trade-off.

2025

1. VLDB

   Approximation-First Timeseries Query At Scale

   Zeying Zhu, Jonathan Chamberlain, Kenny Wu, and 2 more authors

   Proc. VLDB Endow., Apr 2025

   Abs DOI Code

   Timeseries monitoring systems such as Prometheus play a crucial role in gaining observability of the underlying system infrastructure. These systems collect timeseries metrics from various system components and perform monitoring queries over periodic window-based aggregations (i.e., rule queries). However, despite wide adoption, the operational costs and query latency of rule queries remain high. In this paper, we identify major bottlenecks associated with repeated data scans and query computations concerning window overlaps in rule queries, and present PromSketch, an approximation-first query framework as intermediate caches for monitoring systems. It enables low operational costs and query latency, by combining approximate window-based query frameworks and sketch-based precomputation. PromSketch is implemented as a standalone module that can be integrated into Prometheus and VictoriaMetrics, covering 70% of Prometheus’ aggregation over time queries. Our evaluation shows that PromSketch achieves up to a two-order-of-magnitude reduction in query latency over Prometheus and VictoriaMetrics, while lowering operational dollar costs of query processing by three orders of magnitude compared to Prometheus and by at least 4\texttimes compared to VictoriaMetrics with at most 5% average errors across statistics.

2. SIGCOMM Demo

   DEMO: Rearchitecting Approximation-First Cloud Telemetry

   Zeying Zhu and Zaoxing Liu

   In Proceedings of the ACM SIGCOMM 2025 Posters and Demos, Coimbra, Portugal, Apr 2025

   Abs DOI

   Cloud-native telemetry systems like Prometheus enable observability through rule queries-window- and dimension-based aggregations over time series data. However, these queries incur high operational costs and latency due to raw data ingestion, repeated computations, and expensive storage. In this demonstration, we revisit the potential of approximate analytics to improve efficiency across the telemetry pipeline. We propose a hybrid, sketch-based caching architecture that unifies optimizations across ingestion, query processing, and storage. By supporting approximate representations at each stage, our design achieves significant cost savings while maintaining high accuracy and responsiveness.

2024

1. IMC

   Raising the Level of Abstraction for Sketch-Based Network Telemetry with SketchPlan

   Milind Srivastava, Shao-Tse Hung, Hun Namkung, and 3 more authors

   In Proceedings of the 2024 ACM on Internet Measurement Conference, Madrid, Spain, Apr 2024

   Abs DOI Code

   While sketch-based network telemetry is attractive, realizing its potential benefits has been elusive in practice. Existing sketch solutions offer low-level interfaces and impose high effort on operators to satisfy telemetry intents with required accuracies. Extending these approaches to reduce effort results in inefficient deployments with poor accuracy-resource tradeoffs. We present SketchPlan, an abstraction layer for sketch-based telemetry to reduce effort and achieve high efficiency. SketchPlan takes an ensemble view across telemetry intents and sketches, instead of existing approaches that consider each intent-sketch pair in isolation. We show that SketchPlan improves accuracy-resource tradeoffs by up-to 12x and up-to 60x vs. baselines, in single-node and network-wide settings. SketchPlan is open-sourced at: https://github.com/milindsrivastava1997/SketchPlan.

2. SIGCOMM Poster

   Poster: Circa: Re-imagining Network Telemetry from an Approximation-First Perspective

   Milind Srivastava and Vyas Sekar

   In Proceedings of the ACM SIGCOMM 2024 Conference: Posters and Demos, Sydney, NSW, Australia, Apr 2024

   Abs DOI

   Telemetry systems are widely used to collect data from distributed endpoints, analyze data in conjunction to gain valuable insights, and store data for historical analytics. These systems consist of four stages (Figure 1): collection, transmission, analysis, and storage. Collectors at the endpoint collect various types of data, which is then transmitted to a central server for analysis. This data is used for multiple downstream tasks, such as dashboard monitoring and anomaly detection. Finally, this data is stored in long-term storage to aid retrospective analytics and debugging.