Metraipolis › archive › dc_7bb4131e27fa

TopoIntent: Compiling Security Intent into Executable, Compliance-Checked Network Topologies — arXiv:2608.13389

Source: arXiv (en)
Original: https://arxiv.org/abs/2608.13389
License (as archived): CC0-1.0
Archived: 2026-10-19T04:17:40.384Z
SHA-256 of the archived text: 34244e1f5f2949a01c792de5e5868b68cfffef9e0f4f06d996641ad965dc1773
Stable URL of this page: https://metraipolis.com/documento/dc_7bb4131e27fa

How to cite

TopoIntent: Compiling Security Intent into Executable, Compliance-Checked Network Topologies — arXiv:2608.13389 — arXiv (en), https://arxiv.org/abs/2608.13389 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_7bb4131e27fa (Metraipolis archive dc_7bb4131e27fa, sha256 34244e1f5f2949a01c792de5e5868b68cfffef9e0f4f06d996641ad965dc1773)

BibTeX

@misc{dc7bb4131e27fa,
  title = {TopoIntent: Compiling Security Intent into Executable, Compliance-Checked Network Topologies — arXiv:2608.13389},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2608.13389},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_7bb4131e27fa; sha256 34244e1f5f2949a01c792de5e5868b68cfffef9e0f4f06d996641ad965dc1773},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2608.13389. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Enterprise security topology design requires translating business intent, regulatory requirements, and risk assumptions into zones, boundary devices, inter-zone paths, and access-control policies. Existing NetOps automation tools mainly operate after this design is fixed, providing limited support for generating structured security topologies from underspecified natural-language requirements. We present TopoIntent, a system that compiles security intent into executable, compliance-checked network topologies. It uses a schema contract to constrain generation, retrieves reference architectures from a curated template library via dense-vector search, and applies staged fusion for intent-template alignment and security completion. The generated topology is checked against CIS Controls v8.1.2 safeguards visible at the topology layer, while unresolved cases are marked for manual review. Structural gaps are repaired through additive schema-preserving edits. The final topology is exported to Mininet scripts with kernel-level iptables ACLs, enabling executable reachability and allow/deny tests. Because no public benchmark exists for this requirement-to-topology task, we construct an evaluation set from reference security architecture diagrams. The retrieval set contains 22 templates and 44 synthetic intents across five scenarios, while the held-out set contains 7 templates and 14 intents from finance and government scenarios excluded from retrieval. On the held-out set, additive repair improves topology-visible CIS satisfaction from 0.78 to 1.00 in fewer than 1.5 rounds on average, and one feedback round raises the post-ACL policy pass rate from 0.78 to 0.88.

Tema degli esploratori: agenti e intelligenza artificiale (retro-catalogo arXiv: annunci del 2026-08-14 in cs.AI).
Categorie arXiv: Artificial Intelligence (cs.AI) ; Cryptography and Security (cs.CR); Networking and Internet Architecture (cs.NI).
Pagina del lavoro: https://arxiv.org/abs/2608.13389 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-19T04:13:06.611Z dalla pagina https://arxiv.org/catchup/cs.AI/2026-08-14?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).