Massive transaction streams present a number of opportunities for data
mining techniques. Transactions might represent calls on a telephone
network, commercial credit card purchases, stock market trades, or
HTTP requests to a web server.  While historically such data have been
collected for billing or security purposes, they are now being used to
discover how customers or their intermediaries (called transactors)
use the underlying services.

For several years, we have computed evolving profiles (called
signatures) of the transactors in large data streams using 
handwritten C code.  The signature for each transactor captures the
salient features of his transactions through time.  Programs for
processing signatures must be highly optimized because of the size of
the data stream (several gigabytes per day) and the number of
signatures to maintain (hundreds of millions).  C programs to compute
signatures often sacrificed readability for performance.
Consequently, they are difficult to verify and maintain.

Hancock is a domain-specific language created to express
computationally efficient signature programs cleanly.  In this paper,
we describe the obstacles to computing signatures from massive streams
and explain how Hancock addresses these problems.  For expository
purposes, we present Hancock using a running example from the
telecommunications industry; however, the language itself is general
and applies equally well to other data sources.