New telemetry system ideas

[cmisa at cs.uoregon.edu (Chris Misa)]

I am a researcher working on developing a new switch-based on-the-fly 
telemetry system that takes a flow chart as input to describe a 
particular detection task (rather than just features or information 
elements as in IPFIX). For an example of what I mean by "flow chart" see 
the figure here: 
https://ieeexplore.ieee.org/mediastore_new/IEEE/content/media/8048782/8048856/8048939/8048939-fig-4-source-hires.gif.

Might anyone have pointers to a source of more such flow charts?

The other issue I'm worried about is that it might take a couple rounds 
before an event is detected (since the system has to step through the 
flow chart and possibly look at different traffic features in the 
process). What is a typical duration of the types of events people might 
want to catch with a telemetry system like this? Do these kind of events 
generate the same type of traffic throughout their durations, or do 
traffic features change as the event progresses?

Thanks!

Chris