Knowledge Graph for Network Traffic Monitoring and Analysis
draft-pang-nmop-kg-for-traffic-monitoring-analysis-03

nmop                                                             R. Pang
Internet-Draft                                              J. Zhao, Ed.
Intended status: Informational                                  S. Zhang
Expires: 7 January 2027                                            W. Lv
                                                                 H. Wang
                                                            China Unicom
                                                             6 July 2026

      Knowledge Graph for Network Traffic Monitoring and Analysis
         draft-pang-nmop-kg-for-traffic-monitoring-analysis-03

Abstract

   This document extends the knowledge graph framework specifically to
   the traffic management domain, demonstrating how knowledge graphs can
   address long-standing traffic management challenges through semantic
   integration and automated reasoning.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at https://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on 7 January 2027.

Copyright Notice

   Copyright (c) 2026 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

Pang, et al.             Expires 7 January 2027                 [Page 1]
Internet-Draft  Knowledge Graph for Network Traffic Moni       July 2026

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents (https://trustee.ietf.org/
   license-info) in effect on the date of publication of this document.
   Please review these documents carefully, as they describe your rights
   and restrictions with respect to this document.  Code Components
   extracted from this document must include Revised BSD License text as
   described in Section 4.e of the Trust Legal Provisions and are
   provided without warranty as described in the Revised BSD License.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  Network Traffic Monitoring and Analysis System  . . . . . . .   2
     2.1.  Multi-Domain Network Environment  . . . . . . . . . . . .   3
     2.2.  Requirements for Unified Monitoring and Analysis  . . . .   4
   3.  Knowledge Graph Applications in Traffic Monitoring and
           Analysis  . . . . . . . . . . . . . . . . . . . . . . . .   5
   4.  Several approaches exist for constructing the knowledge base
           for network traffic monitoring: . . . . . . . . . . . . .   5
     4.1.  Semantic Conversion of YANG Traffic Models  . . . . . . .   6
   5.  Security Considerations . . . . . . . . . . . . . . . . . . .   8
   6.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   8
   7.  Informative References  . . . . . . . . . . . . . . . . . . .   8
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .   8

1.  Introduction

   Network traffic monitoring and analysis are crucial for ensuring
   service quality, detecting anomalies, and optimizing network
   performance.  However, modern networks face increasingly severe
   challenges in managing traffic data from different sources, each with
   its own formats and schemas.  These challenges align with broader
   operational issues identified in [I-D.mackey-nmop-kg-for-netops],
   such as data silos, loss of context, and complex correlation
   requirements.

   This document extends the knowledge graph framework specifically to
   the traffic management domain, demonstrating how knowledge graphs can
   address long-standing traffic management challenges through semantic
   integration and automated reasoning.

2.  Network Traffic Monitoring and Analysis System

Pang, et al.             Expires 7 January 2027                 [Page 2]
Internet-Draft  Knowledge Graph for Network Traffic Moni       July 2026

2.1.  Multi-Domain Network Environment

   Operators' networks typically consist of multiple domains, such as
   home broadband, mobile, IP bearer, and application networks.  These
   domains interconnect to form diverse end-to-end communication paths;
   however, data from each domain is managed by independent systems,
   leading to heterogeneous formats and semantic inconsistencies that
   create data silos.

   *  A Network Traffic Monitoring and Analysis System is therefore
      essential to correlate data across these domains and deliver the
      following functionalities:

   *  End-to-End Quality Degradation Identification: Detect and localize
      quality issues across concatenated network domains.

   *  Internet Traffic Flow Analysis: Trace and analyze traffic flow
      patterns and directions through the network infrastructure.

   *  Performance Optimization through Reasoning: Enable network
      performance optimization through knowledge-based inference.

   *  CDN Optimization Support: Facilitate content delivery network
      layout optimization through rule-based inference mechanisms.

   The core challenge stems from service traffic traversing multiple
   domains.  Although inherent relationships exist between the
   distributed data sources, a single network event is often captured
   using different dimensions and terminologies across separate systems.

                  +--------------------------------------------------------------------------------------------+
                  |                        Network Traffic Monitoring and Analysis System                      |
                  +--------------------------------------------------------------------------------------------+
                                                             |
                                                             |
                  +--------------------------------------------------------------------------------------------+
                  |                        Knowledge Graph for Traffic Monitoring and Analysis                 |
                  +--------------------------------------------------------------------------------------------+
                             |                               |                          |                      |
                             |                               |                          |                      |
           +-------------------------------+    +--------------------+    +---------------------+    +-------------+
           |    Home Broadband Network     |    |   Mobile Network   |    |  IP Bearer Network  |    | Application |
           +-------------------------------+    +--------------------+    +---------------------+    +-------------+
                             |                              |                          |                      |
                             |                              |                          |                      |
           +-------------------------------------------------------------------------------------------------------------+
           |                                                Network                                                      |
           +-------------------------------------------------------------------------------------------------------------+

Pang, et al.             Expires 7 January 2027                 [Page 3]
Internet-Draft  Knowledge Graph for Network Traffic Moni       July 2026

   Figure 1: Network Traffic Monitoring and Analysis System Architecture

2.2.  Requirements for Unified Monitoring and Analysis

   To achieve its intended functionalities, the system necessitates a
   semantic framework capable of unifying disparate data sources while
   preserving domain-specific context and enabling cross-domain
   correlation.  YANG models provide standardized data definitions for
   individual domains, but their cross-domain application poses
   significant challenges.  Discrepancies between models and the use of
   disparate terminology hinder the establishment of logical
   relationships.  Additionally, the natural inflexibility of their
   static tree structure is ill-suited for representing complex network
   dependencies.  Most importantly, this inflexibility impedes automated
   association and reasoning.  These limitations correspond precisely to
   the problems that knowledge graphs are designed to address.  The
   knowledge graph framework for network
   operations [I-D.mackey-nmop-kg-for-netops], based on semantic web
   technologies, provides a structured approach to integrating,
   correlating, and reasoning over heterogeneous data.  By applying
   knowledge graph technology, operators can implement comprehensive
   network traffic monitoring and analysis systems that overcome these
   cross-domain integration challenges.  In the scenario of traffic
   monitoring and analysis based on knowledge graphs, knowledge can be
   categorized into two types according to its source and function:

   *  Internal Network Knowledge: Internal network knowledge primarily
      depicts the objective composition of the network, resource
      correlations, service bearing status, and network events, laying
      an objective factual foundation for traffic monitoring and
      analysis.  For instance, in cross-domain network scenarios, this
      category of knowledge can characterize the traffic path of a
      specific service flow passing through cells- base station - bearer
      routers- mobile core network, and further correlate the operating
      status of associated devices.  When the monitoring system detects
      elevated latency or degraded throughput for user access in a
      certain area, the knowledge graph can link abnormal traffic with
      relevant resource, so as to facilitate impact scope analysis and
      root cause deduction.

   *  Traffic Monitoring & Analysis Knowledge: Traffic monitoring and
      analysis knowledge is mainly derived from accumulated expert
      experience, reviews of historical cases, and specification
      documents related to traffic monitoring and analysis.  For
      example, this type of knowledge can describe the correlation
      between typical traffic anomaly patterns (such as link congestion
      and rising latency) and corresponding troubleshooting strategies.
      With the introduction of such knowledge, the system is capable of

Pang, et al.             Expires 7 January 2027                 [Page 4]
Internet-Draft  Knowledge Graph for Network Traffic Moni       July 2026

      conducting semantic interpretation on multi-source traffic
      observation data and underpinning operation and maintenance
      decision-making.

   TBD.

3.  Knowledge Graph Applications in Traffic Monitoring and Analysis

   To enable comprehensive monitoring and analysis of overall network
   status, operators require a unified semantic representation framework
   that bridges data barriers across network domains.

   Knowledge graph technology can construct a unified ontology model to
   semantically align and associate network entities, events, and their
   relationships, thereby enabling global knowledge integration of
   network data.

   The integration of a knowledge graph fundamentally transforms
   conventional network monitoring and analysis systems into a
   Knowledge-Based System (KBS) architecture.  This transformation
   centers on two core components: the knowledge base and the inference
   engine, which work in tandem to overcome traditional limitations in
   traffic analysis.

   This KBS architecture effectively transforms fragmented data sources
   into an intelligent system capable of semantic reasoning and
   automated analysis, significantly enhancing the efficiency and
   effectiveness of network traffic monitoring and management
   operations.

   TBD.

4.  Several approaches exist for constructing the knowledge base for
    network traffic monitoring:

   FAIR Principles-Based Construction: Knowledge graphs are constructed
   using the Semantic Web technology stack.  Further details on
   knowledge graph construction methodologies can be found in
   [I-D.marcas-nmop-kg-construct].

   YANG Model Conversion: Transforming YANG models into knowledge graph
   representations, maintaining compatibility with existing management
   systems while enabling semantic technology benefits.  This approach
   leverages existing standardization efforts while extending them with
   semantic capabilities.

Pang, et al.             Expires 7 January 2027                 [Page 5]
Internet-Draft  Knowledge Graph for Network Traffic Moni       July 2026

4.1.  Semantic Conversion of YANG Traffic Models

   YANG data models provide structured and machine-readable
   representations of network configuration and operational data[draft-
   zhao-nmop-e2e-traffic-stats-yang-00].  In traffic monitoring
   environments, YANG models can therefore serve as an important source
   for constructing the factual layer of a knowledge graph.  However,
   the hierarchical structure of a YANG data tree does not directly
   represent all semantic relationships required for cross-domain
   traffic analysis.

   The conversion of YANG-based traffic data into a knowledge graph is
   not necessarily a syntactic one-to-one translation of YANG data nodes
   into graph nodes and properties.  Instead, a semantic mapping process
   can be applied to lift YANG-defined data into concepts and
   relationships defined by a traffic monitoring ontology.

   The conversion can be performed at two levels: schema-level semantic
   extraction and instance data mapping.

   At the schema level, YANG containers and lists can be analyzed to
   identify candidate domain concepts.  List keys can be used as part of
   the identifiers of knowledge graph entities.  Leaf nodes can be
   mapped to semantic attributes, while leafrefs can be mapped to
   relationships between entities.  Enumerations and identities can be
   represented as controlled semantic vocabularies.  Reusable YANG
   groupings may also be mapped to reusable ontology patterns.  YANG
   type restrictions, ranges, and units can additionally be used to
   derive validation constraints for the resulting RDF data.

   The semantic role of a YANG node needs to be considered during this
   process.  For example, a list containing traffic statistics for an
   access node represents both a network entity and a traffic
   observation about that entity.  Mapping the complete list entry to a
   single graph entity would preserve the YANG structure but would
   provide limited semantic value.  A semantic conversion can instead
   represent the access node as a network entity and the collected
   statistics as a traffic observation linked to that entity.

   For example:

   YANG access-node-stats | | semantic mapping v
   +--------------------+ | TrafficObservation |
   +--------------------+ | | observedOn hasMetric | | v v
   +------------+ +------------------+ | AccessNode | | TrafficVolume |
   +------------+ | or Performance | | Metric | +------------------+
   Traffic metrics such as inbound traffic volume, outbound traffic
   volume, delay, and packet loss can be represented as measurement

Pang, et al.             Expires 7 January 2027                 [Page 6]
Internet-Draft  Knowledge Graph for Network Traffic Moni       July 2026

   concepts associated with an observation.  Additional semantic
   dimensions, including IP address family, traffic direction,
   application category, and radio access technology, can be represented
   as relationships of the observation.  This approach allows
   observations originating from different YANG branches or different
   YANG models to use a common semantic representation.

   Instance data encoded according to a YANG model can then be collected
   through YANG-based management or telemetry mechanisms and transformed
   into RDF data according to mapping rules.  The mapping process may
   also attach contextual information that is not explicitly represented
   by the original YANG data node, such as collection time, measurement
   interval, data source, and provenance.

   A particular benefit of semantic conversion is the creation of cross-
   domain relationships.  Domain-specific identifiers in YANG data do
   not necessarily directly express relationships between access nodes,
   regions, organizations, service targets, and traffic flows.  The
   knowledge graph can integrate these identifiers with network metadata
   and represent explicit relationships such as "located in", "belongs
   to", "observes target", and "carried by".

   For example:

   Fixed Access Observation | observedOn | Access Node | locatedIn |
   Region ^ | hasScope | Mobile Traffic Observation

   Through these semantic relationships, traffic observations from
   different network domains can be correlated without requiring the
   original YANG models to share the same hierarchical structure.

   As an example, the YANG data model defined in [I-D.zhao-nmop-e2e-
   traffic-stats-yang] contains operational statistics for fixed access,
   mobile, IP bearer, data center, enterprise, and active probing
   domains.  Traffic counters and performance statistics from these
   different branches can be mapped to a common Traffic Observation
   model.  Network metadata and explicit mapping information can then be
   used to associate the observations with common network scopes and
   resources.

   The resulting knowledge graph preserves the values and constraints
   obtained from YANG while introducing explicit semantic relationships
   required for traffic analysis.  Consequently, YANG provides
   standardized structures for collecting traffic observations, while
   the knowledge graph provides a semantic integration layer for
   correlating these observations across network domains and supporting
   knowledge-based inference.

Pang, et al.             Expires 7 January 2027                 [Page 7]
Internet-Draft  Knowledge Graph for Network Traffic Moni       July 2026

   TBD.

5.  Security Considerations

   TBD.

6.  IANA Considerations

   This document makes no requests of IANA.

7.  Informative References

   [I-D.mackey-nmop-kg-for-netops]
              Mackey, M., Claise, B., Graf, T., Keller, H., Voyer, D.,
              Lucente, P., and I. D. Martinez-Casanueva, "Knowledge
              Graph Framework for Network Operations", Work in Progress,
              Internet-Draft, draft-mackey-nmop-kg-for-netops-04, 7
              April 2026, <https://datatracker.ietf.org/doc/html/draft-
              mackey-nmop-kg-for-netops-04>.

   [I-D.marcas-nmop-kg-construct]
              Martinez-Casanueva, I. D., Rodríguez, L. C., and P.
              Martinez-Julia, "Knowledge Graph Construction from Network
              Data Sources", Work in Progress, Internet-Draft, draft-
              marcas-nmop-kg-construct-00, 26 February 2025,
              <https://datatracker.ietf.org/doc/html/draft-marcas-nmop-
              kg-construct-00>.

Authors' Addresses

   Ran Pang
   China Unicom
   Beijing
   China
   Email: pangran@chinaunicom.cn

   Jing Zhao (editor)
   China Unicom
   Beijing
   China
   Email: zhaoj501@chinaunicom.cn

   Shuai Zhang
   China Unicom
   Beijing
   China

Pang, et al.             Expires 7 January 2027                 [Page 8]
Internet-Draft  Knowledge Graph for Network Traffic Moni       July 2026

   Email: zhangs366@chinaunicom.cn

   Wenxiang Lv
   China Unicom
   Beijing
   China
   Email: lvwx28@chinaunicom.cn

   Hongyu Wang
   China Unicom
   Beijing
   China
   Email: wanghy3858@chinaunicom.cn

Pang, et al.             Expires 7 January 2027                 [Page 9]