Re: [Idnet] IDN dedicated session call for case

[Jérôme François <[e-mail]>]

Hi,

I support this use case and suggest to also include DDoS mitigation as
part of the process, e.g. re-routing to DPI middleboxes / blocking
traffic. You can thus evaluate the result of your mitigation decision
and readjust your model accordingly with reinforcement learning.
We have some on-going work in this area.

Best regards,
jerome


Le 02/08/2017 à 15:22, Aydin Ulas a écrit :
> Hi,
> Here is my suggestion.
>
> Use case N+1: Application (and/or DDoS) detection
>         Description: Detect the application (or attack) from network
> packets (HTTPS or plain) Collect the history traffic data and identify
> a service or attack (ex: Skype, Viber, DDoS attack etc.)
>         Process: 1. Data collection (e.g. traffic sample of
> application to be detected or attack dump); 2. Training Model
> (includes data correlation from different parts of the network); 3.
> Real-time data capture and input; 4. Output prediction; 5. Online or
> periodically updating model parameters according to changes in the
> application (or attack style) 
>         Data Format:   Time: [Timestamp, ...]
>                                 Data Packet: [Packet Header, optional:
> Packet Content or the first few bytes: src/dst ip, src/dst port, frame
> length/number, ...]
>                                 Direction: IN / OUT
>                                 Route : [R1, R2, ..., RN] 
>                                 Traffic: [T0, T1, T2, ..., TN]
>
>         Message :       Request: ask for the data
>                                 Reply: Identification of application
>                                 Notice: For notification or others
>                                 Policy: Control policy
>
>
> Best regards,
> Aydin
>
> On Wed, Aug 2, 2017 at 3:35 PM, Ciavaglia, Laurent (Nokia - FR/Nozay)
> <[e-mail]
> <mailto:[e-mail]>> wrote:
>
>     Hello,
>
>     Hint: it would be nice to contact the NMRG chairs regarding the
>     dedicated session you are mentioning.
>     Also, participants of the NMRG could/should be interested/aware
>     and could eventually contribute to the effort.
>
>     Thanks, Laurent (as NMRG co-chair).
>     ---
>
>     -----Original Message-----
>     From: IDNET [mailto:[e-mail]
>     <mailto:[e-mail]>] On Behalf Of yanshen
>     Sent: Wednesday, August 02, 2017 12:12 PM
>     To: [e-mail] <mailto:[e-mail]>
>     Subject: [Idnet] IDN dedicated session call for case
>
>     Dear all,
>
>     Since we plan to organize a dedicated session in NMRG, IETF100,
>     for applying AI into network management (NM), I’d try to list some
>     Use Cases and propose a roadmap and ToC before Nov.
>
>     These might be rough. You are welcome to refine them and propose
>     your focused use cases or ideas.
>
>     Use case 1: Traffic Prediction
>             Description: Collect the history traffic data and external
>     data which may influence the traffic. Predict the traffic in
>     short/long/specific term. Avoid the congestion or risk in previously.
>             Process: 1. Data collection (e.g. traffic sample of
>     physical/logical port ); 2. Training Model; 3. Real-time data
>     capture and input; 4. Predication output; 5. Fix error and go back
>     to 3.
>             Data Format:    Time : [Start, End, Unit, Number of Value,
>     Sampling Period]
>                                     Position: [Device ID, Port ID]
>                                     Direction: IN / OUT
>                                     Route : [R1, R2, ..., RN]  (might
>     be useful for some scenarios)
>                                     Service : [Service ID, Priority,
>     ...]  (Not clear how to use it but seems useful)
>                                     Traffic: [T0, T1, T2, ..., TN]
>             Message :       Request: ask for the data
>                                     Reply: Data
>                                     Notice: For notification or others
>                                     Policy: Control policy
>
>     Use case 2: QoS Management
>             Description: Use multiple paths to distribute the traffic
>     flows. Adjust the percentages. Avoid congestion and ensure QoS.
>             Process: 1. Data capture (e.g. traffic sample of
>     physical/logical port ); 2. Training Model; 3. Real-time data
>     capture and input; 4. Output percentages; 5. Fix error and go back
>     to 3.
>             Data Format:    Time : [Timestamp, Value type
>     (Delay/Packet Loss/...), Unit, Number of Value, Sampling Period]
>                                     Position: [Link ID, Device ID]
>                                     Value: [V0, V1, V2, ..., VN]
>             Message :       Request: ask for the data
>                                     Reply: Data
>                                     Notice: For notification or others
>                                     Policy: Control policy
>
>     Use case N: Waiting for your Ideas
>
>     Also I suggest a roadmap before Nov if possible.
>
>     ### Roadmap ###
>     Aug. : Collecting the use cases (related with NM). Rough thoughts
>     and requirements Sep. : Refining the cases and abstract the common
>     elements Oct. : Deeply analysis. Especially on Data Format,
>     control flow, or other key points
>     Nov.: F2F discussions on IETF100
>     ### Roadmap End ###
>
>     A rough ToC is listed in following. We may take it as a scope
>     before Nov. Hope that the content could become the draft of draft.
>
>     ###Table of Content###
>     1. Gap and Requirement Analysis
>             1.1 Network Management requirement
>             1.2 TBD
>     2. Use Cases
>             2.1 Traffic Prediction
>             2.2 QoS Management
>             3.3 TBD
>     3. Data Focus
>             3.1 Data attribute
>             3.2 Data format
>             3.3 TBD
>     4. Aims
>             4.1 Benchmarking Framework
>             4.2 TBD
>     ###ToC End###
>
>
>     Yansen
>
>     _______________________________________________
>     IDNET mailing list
>     [e-mail] <mailto:[e-mail]>
>     https://www.ietf.org/mailman/listinfo/idnet
>     <https://www.ietf.org/mailman/listinfo/idnet>
>     _______________________________________________
>     IDNET mailing list
>     [e-mail] <mailto:[e-mail]>
>     https://www.ietf.org/mailman/listinfo/idnet
>     <https://www.ietf.org/mailman/listinfo/idnet>
>
>
>
>
> _______________________________________________
> IDNET mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/idnet