TopoIntent Compiles Natural-Language Security Intent Into Runnable Mininet Topologies With iptables ACLs

arXiv 2608.13389·low signalXBlueskyLinkedInCopy link

NetOps automation mostly starts after the security topology is designed; TopoIntent generates the design itself from underspecified natural-language requirements, using a schema contract to constrain generation, dense-vector retrieval over a curated reference-architecture template library, and staged fusion for intent-template alignment. Output is checked against CIS Controls v8.1.2 safeguards visible at the topology layer and exported to Mininet scripts with kernel-level iptables ACLs for executable reachability and allow/deny tests. On a held-out set of 7 templates and 14 finance/government intents, additive repair lifts topology-visible CIS satisfaction from 0.78 to 1.00 in under 1.5 rounds on average, and one feedback round raises the post-ACL policy pass rate from 0.78 to 0.88.