Vern Paxson

Bro debuted at USENIX Security in 1998 and went a different way from signature matchers like Snort: rather than grepping for byte patterns, it parses protocols and lets the analyst express policy in its own scripting language. It ended up as much a logging tool as an alarm system — and the logs turned out to be what people actually wanted. The project was renamed Zeek in 2018, and Paxson co-founded Corelight to sell it.

Before security he made his name in internet measurement; his 1995 work with Sally Floyd showed that wide-area traffic looks nothing like the Poisson models everyone assumed. With Stuart Staniford and Nicholas Weaver he wrote "How to 0wn the Internet in Your Spare Time" (2002), on just how fast a worm could spread.