  Network security analysts gather data from diverse sources, from high-level
summaries of network flow and traffic volumes to low-level details such as
service logs from servers and the contents of individual packets. They validate
and check this data against traffic patterns and historical indicators of
compromise. Based on the results of this analysis, a decision is made to either
automatically manage the traffic or report it to an analyst for further
investigation. Unfortunately, due rapidly increasing traffic volumes, there are
far more events to check than operational teams can handle for effective
forensic analysis. However, just as packets are grouped into flows that share a
commonality, we argue that a high-level construct for grouping network flows
into a set a flows that share a hypothesis is needed to significantly improve
the quality of operational network response by increasing Events Per Analysts
Hour (EPAH).
  In this paper, we propose a formalism for describing a superflow construct,
which we characterize as an aggregation of one or more flows based on an
analyst-specific hypothesis about traffic behavior. We demonstrate simple
superflow constructions and representations, and perform a case study to
explain how the formalism can be used to reduce the volume of data for forensic
analysis.
