Framework For Internet Basic Behavior Metrics

Introduction This document constructs an extensible framework to regulate the metrics and measurement activities in the field of Internet Basic Behavior Measurement, to support comprehensive, effective, and standardized management and monitoring of the Internet. More specific intentions are reflected in the following aspects:

Utilizing unified metrics to support characterization of various network activities and standardized description of the running states of the Internet from the perspective of basic behavior. The characterizations of network activities help managers to control the operation of the network and supports locating existing or possible anomalies and threat activities in the networks. The standardized description of the running state of the Internet can support the preservation of the running tracks and prediction of the overall or partial running states of the Internet.
Supporting the sharing and analysis for various intents of measurement results through the standardization of measurement activities and the description of metrics, thereby improving the use efficiency of measurement results and expanding its use scope.
This document is more inclined to support engineering, practice, and application in the field of Internet Basic Behavior measurement, and provide analytical data for scientific research in this field
This document is more inclined to support accurate description and normative expression of the measurement results of Internet Basic Behavior and does not involve the discussion of measurement methods, measurement accuracy, application intention, etc.

Terminology The following list gives definitions that need to be clarified in the development of this framework.

Internet Basic Behavior Measurement: A process of quantifying the characteristics and laws of the subjects in Internet architecture when networks are running. In principle, measurements taken in simulated network environments are not Internet Basic Behavior Measurements.
Internet Basic Behavior Metric: The meaning and manifestation of results of Internet Basic Behavior measurements (hereinafter referred to as "Metric"). Describing the elements of basic Internet behavior metrics is the main purpose of this document, and the relevant content will be given in Sections 4-7.
Internet Basic Behavior Measurement Activity: A series of operations performed to measure specific Internet Basic Behavior Metrics (hereinafter referred to as "Measurement Activity"). The Internet Basic Behavior Measurement Activity consists of two phases: (i) Acquisition of Internet Basic Behavior Measurement Source Data. It refers to obtaining traffic and operating data from the Internet, including original or time-stamped packet (header) sequences, flow records, flow tables, routing tables and MIBs, etc., hereinafter referred to as "Measurement Source Data"; (ii)Modeling analysis. Modeling analysis is the mapping from Measurement Source Data objects to Metric instances. The scheme used to do this mapping is called the "Analysis Model".

Because a Metric instance could be obtained from different types of Measurement Source Data and by different Analysis Models, the details of methods of obtaining Measurement Source Data and modeling analysis will not be discussed in this document. Other elements of Measurement Activities will be detailedly described in Section 8. The description and requirements of measurement activities can ensure the operability of Metrics and the storability of measurement results.

Criteria For Internet Basic Behavior Metrics Metrics MUST be useful for the safe operation and management of the Internet. This document does not provide any Metric but provides a framework for defining and describing what a Metric SHOULD be like. Metrics MAY be developed individually or in groups by the proposers as specifications conforming to this framework (hereinafter referred to as "Metric Specification"). In each Metric Specification, the following items SHOULD be explained:

The purpose and significance of setting up this metric. The purpose and value of the Metric in Internet management, security control, and other aspects SHOULD be described.
The specific content of Metric's elements listed in Section 7.
A Measurement Activity case including Measurement Source Data objects and Analysis Model adopted, conforming to the format specified in Section 8. Because all Metrics MUST be measurable, that is, the proposer of the metric SHOULD ensure that at least one Measurement Source Data and Analysis Model can support the measurement of the Metric.
Other supplementary contents which are not included in the above three items MUST be explained.

Metric Subject As the measurement is oriented to Internet Basic Behavior, Metrics SHOULD have clear behavior Subjects. Subjects SHOULD have clear meanings in the Internet architecture and can work continuously and stably in the long term. Based on the existing Internet architecture, this document divides all Subjects into two categories: the basic protocols and the network components that support the operation of the Internet. The details are given below.

Basic Protocols The basic protocols that MAY be used as the Metric subjects include:

Routing protocols All interdomain routing protocols and intradomain routing protocols with RFC standards that are used on the Internet, including BGP, etc.
Network-layer protocols IP and ICMP.
Transport-layer protocols TCP, UDP, and other RFC-specified transport-layer protocols that can be carried by IP packets.
DNS protocol

It SHOULD be further noted that all link-layer protocols and all application-layer protocols that do not belong to the above protocols SHOULD NOT be regarded as the subjects of Internet Basic Behavior Metrics because they could be easily changed and replaced.

Network Components The network components that MAY be used as Metric subjects include the following categories:

Device Including Network Device and End System Device;
Link Channels that connect devices;
Network Collections of devices and links that can communicate with each other using private IP addresses;
Service Application-oriented software system that runs over the Internet;
AS Groups of routers, links, and networks with the same AS number under the control of one administrator.

Representation of Subjects To formally represent subjects, this section provides each subject a unique name for identification and description.

Basic Protocols Basic protocols are abbreviated by the protocols' names, such as TCP, UDP, IP, ICMP, BGP, DNS, etc.

Network Components The network components are represented by the subjects' names or abbreviations:

Device:"NetDevice" or "EndDevice"
Link:"Link"
Network:"Network"
Service:"Service"
AS:"AS"

Metric Topic To facilitate management and use, Metrics could be separated into several topics by semantics, including routing measurement, topology measurement, performance measurement, domain name resolution measurement, traffic measurement, and other measurement topics. The scope of Metric Topics MAY be expanded as needed. The meanings and scope of the existing topics are described as follows:

Routing Measurement Metrics oriented to routing information, routing protocols, and routers' attributes that are running on the Internet fall within this topic.

Topology Measurement Metrics oriented to connectivity between devices, networks, and ASes on the Internet fall within this topic.

Performance Measurement This topic includes three typical directions:

IP Performance Measurement Metrics that measure the performance of IP networks in the actual operation of the Internet during data transmission are IP Performance Metrics.

Network Device Performance Measurement Metrics that measure the individual performance of devices on the Internet in operation and data transmission are network device performance Metrics.

Service Performance Measurement Metrics of the time required by the server software running on the Internet to complete specific service tasks are service performance Metrics.

Domain Name Resolution Measurement Metrics of service attributes and capabilities for DNS servers on the Internet fall within this topic.

Traffic Measurement Traffic refers to the sequence of IP packets obtained from the running network without active injection of test traffic. The specification of the process of acquiring, compressing, and storing traffic is outside the scope of this document. Metrics based on traffic acquisition fall within the topic of traffic measurement. In principle, all Metrics under this topic SHOULD only be obtained based on passive measurement methods, however, some special metrics, such as DNS response time for resolving IP addresses, end-to-end packet loss, etc., may also be obtained based on traffic, but they are not part of the topic of traffic measurement.

Metric Entity Metric entities are elements of the Internet architecture that can carry the results of measurements. Measurement Activities MAY be carried out for different entity objects under the fixed entity types. Standardizing the description of metric entities facilitates the storage, use, and fusion of measurement results.

Classes of Metric Entities Any metric entity that carries the Internet Basic Behavior Measurement is a stable and uniquely identifiable existence on the Internet. Metric Entities include but are not limited to the following seven categories:

End System (EndSystemClass) Devices that have reachable routing IP addresses on the Internet and are connected to the network as end hosts, such as servers, clients, IoT devices, etc. When used as entity objects that carry Metrics, they SHALL be classified into this metric entity class and are directly identified by IP addresses.
IP Prefix (IPPrefixClass) The network parts of the IP addresses when using CIDR, which are identified in the form of "IP address/prefix-length".
Connection Point (ConnPointClass) The endpoints of transport layer connections on the Internet, which are identified in the form of "IP address: port". The value of port is an integer falling in 0..65535, which indicates the "port" field in TCP and UDP header.
Network Device (NetDeviceClass) Devices used to forward IP packets on the Internet, including routers, switches, and access devices. We use a structure with 8 fields to identify a network device - vendor identification, vendor type, AS number, equipment type, longitude, latitude, MAC, and spare information. We suggest using the vendor number (OID) in the MIB to represent the producer identification, and the equipment type SHOULD be one of Router | Switch | AccessPoint | Others. For routers and switches, MAC and spare information are optional. If the first six fields cannot distinguish two devices, the optional fields could be used to support this distinction. For AP devices, longitude, latitude, and spare information are optional.
Autonomous System (ASClass) As described in Section 4.2, we suggest identifying autonomous systems by the corresponding AS numbers.
Link (LinkClass) A link refers to a single link-layer connection between two network devices or between an end system and a network device. A link is identified by an IP address pair.
Path (PathClass) A path is a sequence of links that connect end to end. It is identified by the sequence of IP addresses.

Description of Metric Entity Classes This section provides a JSON-based description of the seven entity types defined in the previous section.

Data Types The data types used in the description include:

string - indicates a string of finite length;
string63 - indicates string with no more than 63 characters;
unsigneddInt - indicates integer ranging from 0 to 2^32-1;
unsignedShort - indicates integer ranging from 0 to 2^16-1;
float - indicates floating number;
bool - indicates boolean value;
inetAddress - indicates Ipv4 or ipv6 address. An ipv4 address is represented as a string in dotted-decimal notation. An ipv6 address is represented as a string in standard notation (hexadecimal numbers connected with ":").
prefixLength - indicates the prefix length of an ipv4 or ipv6 address. For the ipv4 address prefix, it is an integer ranging from 0 to 32. For the ipv6 address prefix, it is an integer ranging from 0 to 128.

Formal Description In the following JSON-based description, "(data type | entity type)" denotes the value of this data type or entity type, "[data type | entity type]" denotes an array of this data type or entity type. Refer to 6.2.1 for data type description and 6.1 for entity type description.

End System
IP Prefix
Connection Point
Network Device
Autonomous System
Link
Path ip2->ip3->...), 1 indicates bidirectional" } ]]>

When a new entity type of Internet Basic Behavior metrics is added, its name, description, and formal description SHOULD be given in the above form at the same time.

Elements of A Metric Metric Specifications under the framework MUST clarify the following elements:

Name "Name" is the identifier of a Metric that MUST be unique in the context of all relevant Internet Basic Behavior Measurement fields. It is suggested to use English words connected with "_" that reflect the core semantics of the metric. If the topic to which the Metric belongs has special naming requirements for the Metrics under the subject's independent framework, the naming of this Metric SHOULD comply with its requirements.
Representation "Representation" describes the data structure of the quantitative results of a metric. It includes the types of number, string, network address, set and undirected graph, etc. It is RECOMMEDED that the proposer of the metric SHOULD describe them in JSON.
Topic "Topic" SHOULD be specified as one of "Routing Measurement", "Topology Measurement", "DNS Measurement", "Traffic Measurement" or "Performance Measurement" (See Section 5 for details).
Subject "Subject" is a non-empty set of metric subjects(See section 4 for details).
Entity "Entity" is a structure of entity types that hosts this metric (See Section 6 for details). JSON is the RECOMMENDED format for this structure's description. The entity types in a structure can be the same or different.
Semantics "Semantics" is the meaning of the metric containing the description of each element in the data structure given by the "Representation" element. It MAY be a descriptive definition or a model representation based on mathematical symbols. The description of metric semantics MUST be basic, normative, and unambiguous no matter what method is adopted. For items whose value range includes numerical values, the metric unit to be used MUST also be given, which MUST be in international metric units.
Attribute "Attribute" consists of two sub-elements: a) Basic attribute. According to the semantics and characteristics of the metric, the value SHOULD be one of structural| characteristic|sample|other. A Metric composed of one or more entity objects of different entity types (see Section 6 for entity types) and contains a relatively stable specific structural relationship among entity objects is called a structural metric, such as networks' topologies; a metric that describes the inherent characteristics of an entity object is called a characteristic metric, such as the capacity of a link. A characteristic metric is relatively stable so could also be called a static metric; the metric based on a specific Measurement Source Data and analyzed by the Analysis Model is called a sample Metric; Metrics that can not be described by the above attributes are uniformly called other metrics. The proposer of such metrics SHOULD try to give appropriate explanations and descriptions of other metrics. b) Fusible attribute. Fusible attribute refers to whether the measurement result of this metric could perform the fusion activities. For the definition and related content of the fusion activity, see Section 9.
Parameter "Parameter" is a set of parameters (name & type) that MUST be used during the measurement, which MAY be empty. For example, the agreement on unit time， the bandwidth usage threshold when congestion occurs, etc. The semantics of these parameters SHOULD be reflected in the metric's "Semantics" element. The parameter set is RECOMMEDED to be given in JSON.
Others The metric's description information that is not included in the above elements but MUST be explained. This element would be empty if there is no need.

Internet Basic Behavior Measurement Activity Measurement Activities MUST only be carried out for Metrics that have completed Metric Specifications. A Measurement Activity SHOULD be described as an 8-tuple [Measurement Activity's Name, Metric's Name, Metric's Parameter, measurement method, measurement point, entity object, Measurement Source Data, measurement results]. The front 7 items are the attributes of the Measurement Activity, that is, each Measurement Activity instance MUST have a unique identification, and only be oriented to one Metric at the same measurement point, using the same measurement method and under the conditions with the same parameters; the measurement result is a collection of triples like [measurement time, entity object, measurement value].

Attributes of Measurement Activity

Measurement Activity Name It refers to the identifier of the Measurement Activity, which uniquely identifies the Measurement Activity. A measure activity name is ADVISED to be expanded based on the name or number that can uniquely identify the organizations or individuals that perform the measurement. The organizations or individuals who perform the Measurement Activity SHALL be responsible for the measurement results and have the obligation to further explain the measurement results when necessary.
Metric It refers to the name of the Metric targeted by this Measurement Activity(see Section 7 for details).
Metric Parameter It refers to the specific value of each parameter described in the "Parameter" element of the Metric Specification in this Measurement Activity. The "Parameter" element is referred to Article 8 in Section 7.
Measurement Method It refers to the description of the Analysis Model used in this Measurement Activity, that is, the algorithm or model used in the process of mapping a Measurement Source Data object into a Metric value, which is described in natural language or pseudocode. The Analysis Model is defined in section 2.
Measurement Point It refers to the network location where the Measurement Source Data is obtained.
Entity Object It refers to a sequence of network entity objects that carry the Metric. The type of all entity objects in the sequence MUST be consistent with the description of the Metric element "Entity" in the corresponding Metric Specification. If the measurement is performed for different entity objects, the value of this attribute is null and will be marked in "Measurement Results".
Measurement Source Data It refers to a description of the Measurement Source Data used in this Measurement Activity and acquired at the measurement point, which follows the definition in section 2, along with the parameters associated with these Measurement Source Data (e.g., the sampling rate for passively collecting traffic).

Measurement Result When the "entity object" attribute of the Measurement Activity is non-null, the measurement result of the Measurement Activity is a sequence of 2-tuples [measurement time, measurement value], otherwise, the measurement result is a sequence of triples [measurement time, measurement value, entity object]. A more specific explanation is as follows:

The value type of the measurement value MUST be consistent with the "Representation" element in the Metric Specification for which the measurement is performed. See Section 7 for the "Representation" element.
The measurement time is the time to obtain the " measurement value", expressed in a 2-tuple [start time, duration]. If the duration is zero, the measurement time is instantaneous; Otherwise, it's a period. The RECOMMENDED default time unit is second. Otherwise, it SHOULD be specified. In general, the measurement time is obtained based on the Measurement Source Data.
Entity objects: as described in Article 6 in Section 8.1.

Metric Fusion The procedure of processing the measurement results or fusion results through combination, statistics, etc. is called metric fusion, such as the combination of topology graphs, the mean or median of the sample metrics, etc. Metric fusion is carried out by metric fusion activities towards completed Measurement Activities or fusion activities. Metric fusion activities are described as a 6-tuple: [fusion activity name, Metric, description, fusion object, fusion model, fusion result]. The detailed description is as follows:

Fusion Activity Name It refers to an identifier of the fusion activity. It is used to uniquely identify the fusion activity. It is ADVISED to be expanded based on the name or number that uniquely identifies the organizations or individuals performing this fusion activity and distinguished from the Measurement Activity name through a standard suffix. The organizations or individuals that carry out this fusion activity are responsible for the result of this fusion and have the obligation to further explain the results of the fusion as needed.
Metric It refers to the Metric for which the fusion activity is oriented, as described in Article 1) in Section 7. In particular, sub-element b) of the "Attribute" elements of the Metric in the fusion activity SHOULD be marked as " Fusible".
Description It refers to a general description of the intention of this fusion activity and other matters that need to be explained.
Fusion Object The measurement results and fusion results of the collection of completed measurement activities and fusion activities are the fusion objects of this fusion activity. It SHOULD be noted that all the results of measurement activities and fusion activities that are fusion objects MUST have the same metric. In general, the measurement results have the same structure.
Fusion Model It refers to the description of the Analysis Model (or algorithm) used in this fusion activity.
Fusion Result It is as same as measurement result.

Security Considerations TBD

IANA Considerations This document has no actions for IANA.