Hi,
Here is my suggestion.

Use case N+1: Application (and/or DDoS) detection
        Description: Detect the application (or attack) from network
packets (HTTPS or plain) Collect the history traffic data and identify a
service or attack (ex: Skype, Viber, DDoS attack etc.)
        Process: 1. Data collection (e.g. traffic sample of application to
be detected or attack dump); 2. Training Model (includes data correlation
from different parts of the network); 3. Real-time data capture and input;
4. Output prediction; 5. Online or periodically updating model parameters
according to changes in the application (or attack style)
        Data Format:   Time: [Timestamp, ...]
                                Data Packet: [Packet Header, optional:
Packet Content or the first few bytes: src/dst ip, src/dst port, frame
length/number, ...]
                                Direction: IN / OUT
                                Route : [R1, R2, ..., RN]
                                Traffic: [T0, T1, T2, ..., TN]

        Message :       Request: ask for the data
                                Reply: Identification of application
                                Notice: For notification or others
                                Policy: Control policy


Best regards,
Aydin

On Wed, Aug 2, 2017 at 3:35 PM, Ciavaglia, Laurent (Nokia - FR/Nozay) <
laurent.ciavaglia@nokia-bell-labs.com> wrote:

> Hello,
>
> Hint: it would be nice to contact the NMRG chairs regarding the dedicated
> session you are mentioning.
> Also, participants of the NMRG could/should be interested/aware and could
> eventually contribute to the effort.
>
> Thanks, Laurent (as NMRG co-chair).
> ---
>
> -----Original Message-----
> From: IDNET [mailto:idnet-bounces@ietf.org] On Behalf Of yanshen
> Sent: Wednesday, August 02, 2017 12:12 PM
> To: idnet@ietf.org
> Subject: [Idnet] IDN dedicated session call for case
>
> Dear all,
>
> Since we plan to organize a dedicated session in NMRG, IETF100, for
> applying AI into network management (NM), I’d try to list some Use Cases
> and propose a roadmap and ToC before Nov.
>
> These might be rough. You are welcome to refine them and propose your
> focused use cases or ideas.
>
> Use case 1: Traffic Prediction
>         Description: Collect the history traffic data and external data
> which may influence the traffic. Predict the traffic in short/long/specific
> term. Avoid the congestion or risk in previously.
>         Process: 1. Data collection (e.g. traffic sample of
> physical/logical port ); 2. Training Model; 3. Real-time data capture and
> input; 4. Predication output; 5. Fix error and go back to 3.
>         Data Format:    Time : [Start, End, Unit, Number of Value,
> Sampling Period]
>                                 Position: [Device ID, Port ID]
>                                 Direction: IN / OUT
>                                 Route : [R1, R2, ..., RN]  (might be
> useful for some scenarios)
>                                 Service : [Service ID, Priority, ...]
> (Not clear how to use it but seems useful)
>                                 Traffic: [T0, T1, T2, ..., TN]
>         Message :       Request: ask for the data
>                                 Reply: Data
>                                 Notice: For notification or others
>                                 Policy: Control policy
>
> Use case 2: QoS Management
>         Description: Use multiple paths to distribute the traffic flows.
> Adjust the percentages. Avoid congestion and ensure QoS.
>         Process: 1. Data capture (e.g. traffic sample of physical/logical
> port ); 2. Training Model; 3. Real-time data capture and input; 4. Output
> percentages; 5. Fix error and go back to 3.
>         Data Format:    Time : [Timestamp, Value type (Delay/Packet
> Loss/...), Unit, Number of Value, Sampling Period]
>                                 Position: [Link ID, Device ID]
>                                 Value: [V0, V1, V2, ..., VN]
>         Message :       Request: ask for the data
>                                 Reply: Data
>                                 Notice: For notification or others
>                                 Policy: Control policy
>
> Use case N: Waiting for your Ideas
>
> Also I suggest a roadmap before Nov if possible.
>
> ### Roadmap ###
> Aug. : Collecting the use cases (related with NM). Rough thoughts and
> requirements Sep. : Refining the cases and abstract the common elements
> Oct. : Deeply analysis. Especially on Data Format, control flow, or other
> key points
> Nov.: F2F discussions on IETF100
> ### Roadmap End ###
>
> A rough ToC is listed in following. We may take it as a scope before Nov.
> Hope that the content could become the draft of draft.
>
> ###Table of Content###
> 1. Gap and Requirement Analysis
>         1.1 Network Management requirement
>         1.2 TBD
> 2. Use Cases
>         2.1 Traffic Prediction
>         2.2 QoS Management
>         3.3 TBD
> 3. Data Focus
>         3.1 Data attribute
>         3.2 Data format
>         3.3 TBD
> 4. Aims
>         4.1 Benchmarking Framework
>         4.2 TBD
> ###ToC End###
>
>
> Yansen
>
> _______________________________________________
> IDNET mailing list
> IDNET@ietf.org
> https://www.ietf.org/mailman/listinfo/idnet
> _______________________________________________
> IDNET mailing list
> IDNET@ietf.org
> https://www.ietf.org/mailman/listinfo/idnet
>