TopoIntent: Compiling Security Intent into Executable, Compliance-Checked Network Topologies
TopoIntent is a system that compiles security intent into executable, compliance-checked network topologies. It uses a schema contract to constrain generation, retrieves reference architectures from a curated template library via dense-vector search, and applies staged fusion for intent-template alignment and security completion. The generated topology is checked against CIS Controls v8.1.2 safeguards visible at the topology layer, while unresolved cases are marked for manual review. Structural gaps are repaired through additive schema-preserving edits. The final topology is exported to Mininet scripts with kernel-level iptables ACLs, enabling executable reachability and allow/deny tests. Because no public benchmark exists for this requirement-to-topology task, the authors construct an evaluation benchmark.
TopoIntent is a research system that compiles security intent into executable, compliance-checked network topologies. It uses a schema contract to constrain generation, retrieves reference architectures from a curated template library via dense-vector search, and applies staged fusion for intent-template alignment and security completion. The generated topology is checked against CIS Controls v8.1.2 safeguards visible at the topology layer, while unresolved cases are marked for manual review. Structural gaps are repaired through additive schema-preserving edits. The final topology is exported to Mininet scripts with kernel-level iptables ACLs, enabling executable reachability and allow/deny tests. Because no public benchmark exists for this requirement-to-topology task, the authors construct an evaluation benchmark.
TopoIntent introduces a schema-constrained generation pipeline that combines dense-vector retrieval of reference architectures with staged fusion for intent-template alignment and security completion. It performs compliance checking against CIS Controls v8.1.2 safeguards at the topology layer and repairs structural gaps via additive schema-preserving edits. The output is executable Mininet scripts with kernel-level iptables ACLs, enabling reachability and allow/deny testing. The system addresses the lack of public benchmarks by constructing a new evaluation dataset for requirement-to-topology tasks.
This research targets a gap in NetOps automation: existing tools operate after topology design is fixed, while TopoIntent generates structured security topologies from underspecified natural-language requirements. It could reduce manual effort in enterprise security architecture design and improve compliance alignment. The use of CIS Controls v8.1.2 suggests relevance to organizations needing to demonstrate compliance with common security frameworks.
TopoIntent could lower the cost and time required to design compliant network security topologies, reduce human error in translating business intent to configurations, and provide auditable compliance evidence. It may be valuable for managed security service providers, cloud networking teams, and compliance-driven industries.
Observable next signals include publication of the constructed benchmark, potential open-source release of TopoIntent, and follow-up work extending compliance checking to additional frameworks or integrating with commercial network automation platforms. Adoption by enterprises would require validation on real-world requirements and integration with existing infrastructure-as-code workflows.