Knowledge Graph for Network Traffic Monitoring and Analysis

2.1. Multi-Domain Network Environment

Operators' networks typically consist of multiple domains, such as home broadband, mobile, IP bearer, and application networks. These domains interconnect to form diverse end-to-end communication paths; however, data from each domain is managed by independent systems, leading to heterogeneous formats and semantic inconsistencies that create data silos.¶

• A Network Traffic Monitoring and Analysis System is therefore essential to correlate data across these domains and deliver the following functionalities:¶

• End-to-End Quality Degradation Identification: Detect and localize quality issues across concatenated network domains.¶

• Internet Traffic Flow Analysis: Trace and analyze traffic flow patterns and directions through the network infrastructure.¶

• Performance Optimization through Reasoning: Enable network performance optimization through knowledge-based inference.¶

• CDN Optimization Support: Facilitate content delivery network layout optimization through rule-based inference mechanisms.¶

The core challenge stems from service traffic traversing multiple domains. Although inherent relationships exist between the distributed data sources, a single network event is often captured using different dimensions and terminologies across separate systems.¶

               +--------------------------------------------------------------------------------------------+
               |                        Network Traffic Monitoring and Analysis System                      |
               +--------------------------------------------------------------------------------------------+
                                                          |
                                                          |
               +--------------------------------------------------------------------------------------------+
               |                        Knowledge Graph for Traffic Monitoring and Analysis                 |
               +--------------------------------------------------------------------------------------------+
                          |                               |                          |                      |
                          |                               |                          |                      |
        +-------------------------------+    +--------------------+    +---------------------+    +-------------+
        |    Home Broadband Network     |    |   Mobile Network   |    |  IP Bearer Network  |    | Application |
        +-------------------------------+    +--------------------+    +---------------------+    +-------------+
                          |                              |                          |                      |
                          |                              |                          |                      |
        +-------------------------------------------------------------------------------------------------------------+
        |                                                Network                                                      |
        +-------------------------------------------------------------------------------------------------------------+

2.2. Requirements for Unified Monitoring and Analysis

To achieve its intended functionalities, the system necessitates a semantic framework capable of unifying disparate data sources while preserving domain-specific context and enabling cross-domain correlation. YANG models provide standardized data definitions for individual domains, but their cross-domain application poses significant challenges. Discrepancies between models and the use of disparate terminology hinder the establishment of logical relationships. Additionally, the natural inflexibility of their static tree structure is ill-suited for representing complex network dependencies. Most importantly, this inflexibility impedes automated association and reasoning. These limitations correspond precisely to the problems that knowledge graphs are designed to address. The knowledge graph framework for network operations [I-D.mackey-nmop-kg-for-netops], based on semantic web technologies, provides a structured approach to integrating, correlating, and reasoning over heterogeneous data. By applying knowledge graph technology, operators can implement comprehensive network traffic monitoring and analysis systems that overcome these cross-domain integration challenges. In the scenario of traffic monitoring and analysis based on knowledge graphs, knowledge can be categorized into two types according to its source and function:¶

• Internal Network Knowledge: Internal network knowledge primarily depicts the objective composition of the network, resource correlations, service bearing status, and network events, laying an objective factual foundation for traffic monitoring and analysis. For instance, in cross-domain network scenarios, this category of knowledge can characterize the traffic path of a specific service flow passing through cells- base station - bearer routers- mobile core network, and further correlate the operating status of associated devices. When the monitoring system detects elevated latency or degraded throughput for user access in a certain area, the knowledge graph can link abnormal traffic with relevant resource, so as to facilitate impact scope analysis and root cause deduction.¶

• Traffic Monitoring & Analysis Knowledge: Traffic monitoring and analysis knowledge is mainly derived from accumulated expert experience, reviews of historical cases, and specification documents related to traffic monitoring and analysis. For example, this type of knowledge can describe the correlation between typical traffic anomaly patterns (such as link congestion and rising latency) and corresponding troubleshooting strategies. With the introduction of such knowledge, the system is capable of conducting semantic interpretation on multi-source traffic observation data and underpinning operation and maintenance decision-making.¶

TBD.¶

4.1. Semantic Conversion of YANG Traffic Models

YANG data models provide structured and machine-readable representations of network configuration and operational data[draft-zhao-nmop-e2e-traffic-stats-yang-00]. In traffic monitoring environments, YANG models can therefore serve as an important source for constructing the factual layer of a knowledge graph. However, the hierarchical structure of a YANG data tree does not directly represent all semantic relationships required for cross-domain traffic analysis.¶

The conversion of YANG-based traffic data into a knowledge graph is not necessarily a syntactic one-to-one translation of YANG data nodes into graph nodes and properties. Instead, a semantic mapping process can be applied to lift YANG-defined data into concepts and relationships defined by a traffic monitoring ontology.¶

The conversion can be performed at two levels: schema-level semantic extraction and instance data mapping.¶

At the schema level, YANG containers and lists can be analyzed to identify candidate domain concepts. List keys can be used as part of the identifiers of knowledge graph entities. Leaf nodes can be mapped to semantic attributes, while leafrefs can be mapped to relationships between entities. Enumerations and identities can be represented as controlled semantic vocabularies. Reusable YANG groupings may also be mapped to reusable ontology patterns. YANG type restrictions, ranges, and units can additionally be used to derive validation constraints for the resulting RDF data.¶

The semantic role of a YANG node needs to be considered during this process. For example, a list containing traffic statistics for an access node represents both a network entity and a traffic observation about that entity. Mapping the complete list entry to a single graph entity would preserve the YANG structure but would provide limited semantic value. A semantic conversion can instead represent the access node as a network entity and the collected statistics as a traffic observation linked to that entity.¶

For example:¶

YANG access-node-stats | | semantic mapping v +--------------------+ | TrafficObservation | +--------------------+ | | observedOn hasMetric | | v v +------------+ +------------------+ | AccessNode | | TrafficVolume | +------------+ | or Performance | | Metric | +------------------+ Traffic metrics such as inbound traffic volume, outbound traffic volume, delay, and packet loss can be represented as measurement concepts associated with an observation. Additional semantic dimensions, including IP address family, traffic direction, application category, and radio access technology, can be represented as relationships of the observation. This approach allows observations originating from different YANG branches or different YANG models to use a common semantic representation.¶

Instance data encoded according to a YANG model can then be collected through YANG-based management or telemetry mechanisms and transformed into RDF data according to mapping rules. The mapping process may also attach contextual information that is not explicitly represented by the original YANG data node, such as collection time, measurement interval, data source, and provenance.¶

A particular benefit of semantic conversion is the creation of cross-domain relationships. Domain-specific identifiers in YANG data do not necessarily directly express relationships between access nodes, regions, organizations, service targets, and traffic flows. The knowledge graph can integrate these identifiers with network metadata and represent explicit relationships such as "located in", "belongs to", "observes target", and "carried by".¶

For example:¶

Fixed Access Observation | observedOn | Access Node | locatedIn | Region ^ | hasScope | Mobile Traffic Observation ¶

Through these semantic relationships, traffic observations from different network domains can be correlated without requiring the original YANG models to share the same hierarchical structure.¶

As an example, the YANG data model defined in [I-D.zhao-nmop-e2e-traffic-stats-yang] contains operational statistics for fixed access, mobile, IP bearer, data center, enterprise, and active probing domains. Traffic counters and performance statistics from these different branches can be mapped to a common Traffic Observation model. Network metadata and explicit mapping information can then be used to associate the observations with common network scopes and resources.¶

The resulting knowledge graph preserves the values and constraints obtained from YANG while introducing explicit semantic relationships required for traffic analysis. Consequently, YANG provides standardized structures for collecting traffic observations, while the knowledge graph provides a semantic integration layer for correlating these observations across network domains and supporting knowledge-based inference.¶

TBD.¶