With the rise of the Internet in the mid-1990s came the scourge of Internet attacks. At the time, Vern Paxson was pursuing a work-study PhD at the Lawrence Berkeley National Laboratory (LBNL), with a focus on Internet measurement. The LBNL security staff would occasionally ask him whether his research data happened to have information about a particular attack. It often did, but extracting the activity was a cumbersome process that only provided insight after-the-fact. This led him to develop a system – now named Zeek – to more effectively answer such questions.
Zeek’s key advantage is its ability to handle vast streams of Internet traffic to provide both real-time intruder detection and a rich archive of logs for retrospective security analysis. Paxson pursued the concept for about two years at LBNL before transitioning the project to ICSI, where it became a major focus of ICSI’s newly-minted Center for Internet Research. The open-source system had its public debut in 1998 (in a paper subsequently recognized with the distinguished USENIX “Test of Time” Award) and gradually matured into a platform popular with universities, national laboratories, and supercomputer centers.
By the mid-2000s the National Science Foundation (NSF) and U.S. Department of Energy were investing in its development, and between 2010-2016 NSF granted nearly $7 million to facilitate the project’s transition from a specialized system for highly technical users to a tool that could be used much more broadly. That work set Zeek on its path to becoming a system heavily relied upon by customers across a wide range of sectors and industries, including companies such as Apple, Amazon, Facebook, General Electric, Target, and Visa.
To provide sustainability for the project, its developers founded Corelight, a startup spun out of ICSI that has attracted $160 million in venture funding to date and grown into one of today’s leading solutions for network security monitoring. The platform’s path from an idea born in a government lab to startup stardom exemplifies ICSI’s role as an incubator for transformative technologies and a bridge between government, academia, and industry.
This story was published in January 2026 as part of a retrospective series highlighting ICSI’s accomplishments and impacts over the years. To learn about our ongoing work, explore our Core Research Themes.