Back to AI Research

AI Research

TopoIntent: Compiling Security Intent into Executab... | AI Research

Key Takeaways

  • TopoIntent is a system designed to automate the creation of enterprise network security architectures.
  • Enterprise security topology design requires translating business intent, regulatory requirements, and risk assumptions into zones, boundary devices, inter-zone paths, and access-control policies.
  • Existing NetOps automation tools mainly operate after this design is fixed, providing limited support for generating structured security topologies from underspecified natural-language requirements.
  • We present TopoIntent, a system that compiles security intent into executable, compliance-checked network topologies.
  • The generated topology is checked against CIS Controls v8.1.2 safeguards visible at the topology layer, while unresolved cases are marked for manual review.
Paper AbstractExpand

Enterprise security topology design requires translating business intent, regulatory requirements, and risk assumptions into zones, boundary devices, inter-zone paths, and access-control policies. Existing NetOps automation tools mainly operate after this design is fixed, providing limited support for generating structured security topologies from underspecified natural-language requirements. We present TopoIntent, a system that compiles security intent into executable, compliance-checked network topologies. It uses a schema contract to constrain generation, retrieves reference architectures from a curated template library via dense-vector search, and applies staged fusion for intent-template alignment and security completion. The generated topology is checked against CIS Controls v8.1.2 safeguards visible at the topology layer, while unresolved cases are marked for manual review. Structural gaps are repaired through additive schema-preserving edits. The final topology is exported to Mininet scripts with kernel-level iptables ACLs, enabling executable reachability and allow/deny tests. Because no public benchmark exists for this requirement-to-topology task, we construct an evaluation set from reference security architecture diagrams. The retrieval set contains 22 templates and 44 synthetic intents across five scenarios, while the held-out set contains 7 templates and 14 intents from finance and government scenarios excluded from retrieval. On the held-out set, additive repair improves topology-visible CIS satisfaction from 0.78 to 1.00 in fewer than 1.5 rounds on average, and one feedback round raises the post-ACL policy pass rate from 0.78 to 0.88.

TopoIntent is a system designed to automate the creation of enterprise network security architectures. It translates natural-language business requirements into structured, executable network topologies that are checked against specific security compliance standards. By moving beyond simple configuration management, the system aims to bridge the gap between high-level security intent and the technical design of zones, boundary devices, and access-control policies.

From Intent to Executable Topology

The system operates through a five-stage pipeline governed by a "SchemaContract," which ensures that data remains consistent as it moves through the design process. First, an LLM parses natural-language requirements into a structured format. Second, the system uses dense-vector search to retrieve relevant reference architectures from a library of 22 curated templates. Third, it fuses the user’s intent with these templates to create a complete design. Fourth, it evaluates the design against topology-visible safeguards from the CIS Controls v8.1.2 framework, performing "additive repairs" to fix structural gaps. Finally, the system exports the design into Mininet scripts, allowing engineers to test reachability and verify that access-control policies behave as intended in an emulated environment.

Compliance-Driven Design

A core feature of TopoIntent is its focus on structural compliance. The researchers identified 22 safeguards within the CIS Controls v8.1.2 framework that can be verified at the topology layer—such as zone boundaries, monitoring points, and filtering devices. By using these as a guide, the system can automatically flag missing security components. If a design fails to meet these standards, the system uses diagnostic feedback to perform targeted, schema-preserving edits rather than regenerating the entire topology. This allows the design to evolve iteratively until it meets the required security posture.

Performance and Evaluation

Because no public benchmark existed for this task, the authors constructed an evaluation set consisting of 7 templates and 14 intents focused on finance and government scenarios. Their results indicate that this additive repair process is effective: on the held-out evaluation set, the system improved topology-visible CIS satisfaction from 0.78 to 1.00 in fewer than 1.5 rounds of feedback. Furthermore, after one round of diagnostic feedback, the post-ACL policy pass rate increased from 0.78 to 0.88.

Considerations for Implementation

The authors note that TopoIntent is designed to assist architects rather than replace them. The system explicitly marks cases requiring manual review when it cannot resolve a compliance gap automatically. Additionally, the system follows a "determinism first" principle, meaning that tasks like node attribute inference and schema validation are handled by rules rather than LLMs to ensure consistency. While the system provides a robust framework for generating and testing security topologies, it does not claim to provide full organizational CIS certification, as many security controls—such as user training or operational procedures—cannot be represented within a network topology.

Comments (0)

No comments yet

Be the first to share your thoughts!