Subject: Re: [Nmlrg] I-D Action: draft-jiang-nmlrg-traffic-machine-learning-00.txt

From: Brian E Carpenter <[email-masked]>
Date: Mon, 13 Jun 2016 11:32:41 +1200

Hi,

Just a couple of comments on this interesting draft:

> 1.  Introduction
...
> 
>    Among many aspects of networks, the network traffic is one of the
>    most complicated managed objectives.  Its volume is rapidly growing
>    along with the Internet explosion.  It is always dynamically
>    changing.  Most network traffic flows only last a few minutes, or
>    even shorter.

That may be true today, but perhaps not in the future. Interactive flows
for audio and video may last much longer, and with RTCWEB they will become
more common. They also present unique difficulties, because a flow may be
very high data rate at one moment in one direction (A is speaking to B)
but then unpredictably the opposite (B is speaking to A). Or a video
conference might switch from presentation (A is speaking to everybody)
to Q/A mode (individuals are speaking to A). The flows will be maintained
but their parameters will change completely.

This makes the problem much more interesting - a measurement made at time T1
will not statistically predict the flow at time T2.

...
> 3.1.  Data of the Network Traffic
...
>    Data within communication protocols  The user contents are
>       encapsulated in layered communication protocols.  Many information
>       are contained within the protocol headers, for example the source
>       and destination IP addresses in the IP header, the port numbers in
>       the TCP/UDP header, etc.  

I think it is useful to mention the traffic class (DSCP) and flow label,
because these are guaranteed to be available even if the payload is
not available. Even the ECN bits might be useful, too.

...
> 5.  Security Considerations

I think that you should discuss Privacy Considerations. There is clearly
a problem, since the data one might capture for ML is exactly the data captured
by commercial or government surveillance. With the new emphasis on resisting such surveillance, the ML approach will have to
find a way to deal with this.
Anonymization of the collected data is one approach that is commonly used in
measurement studies.

Regards
   Brian Carpenter

On 03/06/2016 21:25, [email-masked] wrote:
> 
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> 
> 
>         Title           : Use Cases of Applying Machine Learning Mechanism with Network Traffic
>         Authors         : Sheng Jiang
>                           Bing Liu
>                           Panagiotis Demestichas
>                           Jerome Francois
>                           Giovane C. M. Moura
>                           Pere Barlet
> 	Filename        : draft-jiang-nmlrg-traffic-machine-learning-00.txt
> 	Pages           : 18
> 	Date            : 2016-06-03
> 
> Abstract:
>    This document introduces a set of use cases in which machine learning
>    technologies are applied to network traffic relevant activities,
>    including machine learning based traffic classification, traffic
>    management, etc.
> 
> 
> The IETF datatracker status page for this draft is:
> https://datatracker.ietf.org/doc/draft-jiang-nmlrg-traffic-machine-learning/
> 
> There's also a htmlized version available at:
> https://tools.ietf.org/html/draft-jiang-nmlrg-traffic-machine-learning-00
> 
> 
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org.
> 
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
> 
> _______________________________________________
> I-D-Announce mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/i-d-announce
> Internet-Draft directories: http://www.ietf.org/shadow.html
> or ftp://ftp.ietf.org/ietf/1shadow-sites.txt
>

---

From: Sheng Jiang <[email-masked]>
Date: Tue, 14 Jun 2016 03:16:03 +0000

Hi, Brian,

Thanks for your review and comments. Discussions in lines.

>more common.

There are two aspects for long-last and big traffics (elephant flows): A, giving their granularity, they are important managed objectives and actually easier to be identified; B, giving the current issues on load balancing & resource occupying, there are many proposals to cut the elephant flows into many small flows.

>They also present unique difficulties, because a flow may be
>This makes the problem much more interesting - a measurement made at
>time T1 will not statistically predict the flow at time T2.

For our NML, I guess the target is not to predict any single or small group of flows. The ML is only meaningful in statistics with numeric data. One more thing to be considered is that the statistic regular pattern may only happen in a few specific nodes within the network, such as ingress/egress, router close to server farmer, or router close to certain group of user, etc. It would be a big challenge to develop a generic NML solution without any presetting of any statistic regular patterns. Up to now, almost all the use cases are targeting to very specific scenarios with narrow statistic regular patterns.

>not available. Even the ECN bits might be useful, too.

Agree. New text would be added. Of course, you are welcome to propose text.

>a problem, since the data one might capture for ML is exactly the data
>captured by commercial or government surveillance. With the new
> emphasis on resisting such surveillance, the ML approach will have to
>Anonymization of the collected data is one approach that is commonly 
>used in measurement studies.

Agree. New text would be added. However, this point is much more difficult and controversial.

Best regards,

Sheng

>nmlrg mailing list
>[email-masked]
>https://www.irtf.org/mailman/listinfo/nmlrg