TopoIntent: Compiling Security Intent into Executable, Compliance-Checked Network Topologies

• URL: http://arxiv.org/abs/2608.13389v1
• Date: Thu, 13 Aug 2026 15:49:37 GMT
• Title: TopoIntent: Compiling Security Intent into Executable, Compliance-Checked Network Topologies
• Abstract summary: We present TopoIntent, a system that compiles security intent into executable, compliance-checked network topologies.<n>The generated topology is checked against CIS Controls v8.1.2 safeguards visible at the topology layer, while unresolved cases are marked for manual review.<n>Because no public benchmark exists for this requirement-to-topology task, we construct an evaluation set from reference security architecture diagrams.
• Score: 5.557526676711524
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Enterprise security topology design requires translating business intent, regulatory requirements, and risk assumptions into zones, boundary devices, inter-zone paths, and access-control policies. Existing NetOps automation tools mainly operate after this design is fixed, providing limited support for generating structured security topologies from underspecified natural-language requirements. We present TopoIntent, a system that compiles security intent into executable, compliance-checked network topologies. It uses a schema contract to constrain generation, retrieves reference architectures from a curated template library via dense-vector search, and applies staged fusion for intent-template alignment and security completion. The generated topology is checked against CIS Controls v8.1.2 safeguards visible at the topology layer, while unresolved cases are marked for manual review. Structural gaps are repaired through additive schema-preserving edits. The final topology is exported to Mininet scripts with kernel-level iptables ACLs, enabling executable reachability and allow/deny tests. Because no public benchmark exists for this requirement-to-topology task, we construct an evaluation set from reference security architecture diagrams. The retrieval set contains 22 templates and 44 synthetic intents across five scenarios, while the held-out set contains 7 templates and 14 intents from finance and government scenarios excluded from retrieval. On the held-out set, additive repair improves topology-visible CIS satisfaction from 0.78 to 1.00 in fewer than 1.5 rounds on average, and one feedback round raises the post-ACL policy pass rate from 0.78 to 0.88.

Related papers

• SENTINEL-RL: Offloading Topological Reasoning from LLM Agents in the Security Operations Center [0.0]
  Sentinel-RL is an agentic-SOC architecture that decouples topological reasoning from semantic reasoning.<n>We instantiate the system on the LANL Comprehensive, Multi-Source Cyber-Security Events dataset and the Indiana University Quartz HPC cluster.
  arXiv  Detail & Related papers  (2026-09-03T17:49:12Z)
• Grounded Normative Rule Generation with Structured Search [47.28595196084396]
  We formalize the problem as Grounded Normative Rule Synthesis (GNRS)<n>We introduce GNRS-Search, a framework that utilizes Markov Chain Monte Carlo (MCMC) sampling to optimize a discrete, five-slot And-Or Graph (AOG)<n>We evaluate our approach on GNRS-Bench, a benchmark spanning 116 controlled goals across eight scene families, and RealCharterBench, which evaluates transfer to 53 real-derived policy tasks with hidden source clauses.
  arXiv  Detail & Related papers  (2026-08-23T05:43:42Z)
• Dynamic Capability Scoping for Enterprise AI Agents: A Synthetic Dataset and Three-Source Permission Architecture [0.0]
  We argue that capability scoping must follow a dynamic least-privilege principle and be treated as a prevention mechanism before a detection.<n>A credential that does not exist in an agent's context cannot be misused regardless of the agent's reasoning.<n>We contribute a synthetic dataset of 600 enterprise task prompts grounded in a multi-department company policy.
  arXiv  Detail & Related papers  (2026-07-24T16:08:03Z)
• From Attack Simulation to SIEM Rule: Deterministic Detection-as-Code Synthesis with Probe-Level Traceability [51.56484100374058]
  Security teams simulate attacks against their own systems to check whether their monitoring would catch a real intruder.<n>A human bridges that gap by hand, reading each finding and writing the corresponding Sigma rule.<n>We show this translation can be partially automated when probes are drawn from a locked corpus.
  arXiv  Detail & Related papers  (2026-06-03T14:26:25Z)
• An Organization-Scoped LLM Agent Runtime Architecture for Regulated Cybersecurity Operations [0.3013679260442808]
  Regulated cybersecurity lack a runtime substrate that enforces organization-level scope.<n>Recent large language model (LLM) agent systems report strong results on isolated cybersecurity tasks.<n>This paper proposes an organization-scoped agent runtime architecture for financial cybersecurity.
  arXiv  Detail & Related papers  (2026-05-28T21:51:38Z)
• Citation-Closure Retrieval and Per-Rule Attribution for Real-World Regulatory Compliance Question Answering [54.97384993676565]
  We formalize Regulatory Compliance QA with RegOps-Bench, a novel benchmark featuring an Operational Knowledge Graph derived from complex national R&D regulations.<n>RefWalk traverses cross-document citations, fuses multi-view candidates via max-based aggregation, and enforces per-rule attribution to explicitly map claims to sources.
  arXiv  Detail & Related papers  (2026-05-28T10:38:38Z)
• Securing LLM Agents Need Intent-to-Execution Integrity [49.490963596514185]
  We argue that securing LLM agents requires defining an end-to-end correctness property that specifies when an agent's execution faithfully reflects the user's intent.<n>We observe that LLM agents are structurally analogous to compilers, where security violations correspond to mis-executions that do not preserve user intent.<n>We derive four integrity properties that must hold simultaneously: emphTool Integrity, emphInstruction Integrity, emphJudgment Integrity, and emphData Flow Integrity.
  arXiv  Detail & Related papers  (2026-05-16T12:53:31Z)
• GoAT-X: A Graph of Auditing Thoughts for Securing Token Transactions in Cross-Chain Contracts [52.51342355102833]
  Cross-chain bridges, the critical infrastructure of the multi-chain ecosystem, have become a primary target for attackers.<n>Existing defenses, such as bytecode-level static analysis, are ill-equipped to handle the semantic complexity of cross-chain interactions.<n>We propose GoAT-X, a framework that shifts automated cross-chain smart contracts auditing from pattern matching toward systematic first-principles verification.
  arXiv  Detail & Related papers  (2026-04-27T11:34:21Z)
• From Inference Routing to Agent Orchestration: Declarative Policy Compilation with Cross-Layer Verification [10.651054435747385]
  The Semantic Router DSL is a non-Turing-complete policy language deployed in production for per-request inference.<n>This paper extends the same language from stateless, per-request routing to multi-step agent routing.
  arXiv  Detail & Related papers  (2026-03-28T15:04:31Z)
• ElephantBroker: A Knowledge-Grounded Cognitive Runtime for Trustworthy AI Agents [45.88028371034407]
  ElephantBroker is an open source cognitive runtime that unifies a Neo4j knowledge graph with a Qdrant vector store.<n>The system implements a complete cognitive loop (store, retrieve, score, compose, protect, learn) comprising a hybrid five source retrieval pipeline.
  arXiv  Detail & Related papers  (2026-03-26T07:03:12Z)
• Agentproof: Static Verification of Agent Workflow Graphs [0.0]
  Agent frameworks increasingly encode tool-using behavior as explicit workflow graphs, yet safety enforcement remains a runtime concern.<n>This paper presents Agentproof, a system that automatically extracts a unified abstract graph model from four major agent frameworks.<n>Unlike general-purpose model checkers, Agentproof requires no manual modeling.
  arXiv  Detail & Related papers  (2026-03-20T13:56:20Z)
• TopoEdge: Topology-Grounded Agentic Framework for Edge Networking Code Generation and Repair [1.8860840010379987]
  TopoEdge is a framework for software-defined networking (SDN) configuration generation and repair.<n>TopoEdge represents each target topology as a router-level graph and embeds it using a contrastively trained graph neural network (GNN)<n>The target topology, retrieved reference topology, and reference driver are assembled into a topology-grounded retrieval-augmented generation context (TopoRAG)
  arXiv  Detail & Related papers  (2026-02-28T09:36:48Z)
• SOPBench: Evaluating Language Agents at Following Standard Operating Procedures and Constraints [59.645885492637845]
  SOPBench is an evaluation pipeline that transforms each service-specific SOP code program into a directed graph of executable functions.<n>Our approach transforms each service-specific SOP code program into a directed graph of executable functions and requires agents to call these functions based on natural language SOP descriptions.<n>We evaluate 18 leading models, and results show the task is challenging even for top-tier models.
  arXiv  Detail & Related papers  (2025-03-11T17:53:02Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.