Automated Generation of Compliance Checked Network Topologies

Summary & Methodology Analysis

TopoIntent functions as a synthesis engine that bridges the gap between high level natural language intent and concrete network infrastructure. The pipeline begins with intent analysis to map requirements into a structured topology schema, followed by dense vector search (a method of representing text as numeric arrays for semantic similarity matching) to pull relevant reference architectures from a library via Qdrant. The core engine then fuses these templates with the user intent, addressing any missing architectural gaps before subjecting the configuration to a compliance check based on CIS Controls v8.1.2. The system relies on models including Qwen2.5-72B-Instruct, InternVL3.5-38B, Qwen2.5-VL-72B, and Gemini 2.5 Pro to manage these complex parsing and alignment tasks. When the initial topology fails compliance or connectivity checks, the system performs additive repair, which applies minimal schema preserving edits to align the design with policy standards. This process effectively raises the CIS satisfaction score from 0.78 to 1.00 in under 1.5 rounds. To ensure the generated topology behaves as intended in terms of reachability and ACL filtering, TopoIntent exports the design to Mininet for emulation. An ablation (a study comparing the system with and without specific components) demonstrates that integrating this emulation feedback cycle increases the post ACL policy pass rate from 0.78 to 0.88 after a single round. The system is limited by the fact that it only assesses structural safeguards visible at the topology level rather than providing full organizational CIS certification. Furthermore, the Mininet emulation is not production grade and does not account for complex stateful firewalls or cloud control plane logic.