Bridging High-Level Intent and Network Execution: Detecting Violations and Intent Drift Through Low-Level Traffic Analysis Tonia Haikal∗ , Shereen Ismail† , Eman Hammad∗
∗ iSTAR Lab at Texas A&M University, College Station, TX 77840, USA.
arXiv:2606.05076v1 [cs.NI] 3 Jun 2026
† Merit Network, Inc., University of Michigan, Ann Arbor, MI 48108, USA.
Abstract—Intent-Based Networking (IBN) structures a core management pillar for autonomous 6G networks by translating high-level administrative goals into autonomous configurations, yet a critical validation gap persists between declarative intent and data-plane execution. This paper investigates this gap by formalizing low-level flow headers into standardized 7-tuple vectors, establishing an Internal Low-Level Intent (ILI) telemetry interface. Leveraging an empirical dataset of 100.91 million flow records from a distributed honeynet, we evaluate three administrative policy regimes (Strict, Balanced, and Permissive) across two metrics: Policy Violations (𝑉) and Intent Drift (𝐷). Our results expose a distinct Compliance Paradox where widening policy permissiveness systematically suppresses violation counts, yet underlying operational intent drift remains mostly invariant. This demonstrates that conventional, violation-centric tracking are unreliable. Furthermore, an empirical case study show that ILI metrics structural violations can inform closedloop orchestrators to dynamically recalculate and enforce low-level rules that maintain high-level operational intent. Index Terms—Intent-Based Networking (IBN), Intent Assurance, 6G, Network Security, Intent Drift, Policy Enforcement, Empirical Traffic Analysis, Honeypot
I. Introduction Intent-Based Networking (IBN) fundamentally redefines network management by shifting operational frameworks from manual, device-specific configuration scripts to goal-oriented, declarative autonomy [1]. Under an IBN framework, network operators/engineers articulate what the network must achieve through highlevel declarative statements, that the control plane is responsible for dynamically computing, compiling, and enforcing as low-level infrastructure configurations [2]. Significant progress has been achieved in architectures that support intent translation pipelines leveraging policy compilers, orchestration graphs, and large language
models (LLM) ingest engines [3]. However, critical issues remain unresolved within the intent validation and closed-loop assurance lifecycles [4]. IBN implements a continuous, closed-loop management lifecycle to automate configuration states through a feedback loop of intent ingestion, automated compilation, policy enforcement, and real-time validation. Current assurance frameworks operate primarily at the control plane, verifying that target configurations have been pushed to software-defined tables [5]. They lack empirical, data-plane native validation models capable of verifying whether live traffic truly conforms to abstract operational policies, where execution is enforced exclusively through low-level flow headers. This paper establishes an empirical-based methodology that treats data-plane flow tuples, comprised of source and destination IP addresses, MAC addresses, transport-layer ports, and protocol headers, as the explicit, atomic execution surface of human intent. We formalize these entities as Internal Low-Level Intents (ILI). By doing so, we introduce a traceable construct that maps high-level abstract policy directly to empirical packet streams, enabling real-time, flow-level assurance. Our methodology utilizes large-scale, high-entropy empirical telemetry collected from an operational distributed HoneyTrap-based honeynet at Merit Network to evaluate the operational behavior of the proposed framework [6]. This environment provides a highly dense and unpredictable traffic stream, serving as an ideal testing ground to analyze the operational bounds of intent-toflow translation under complex, real-world conditions. By mapping three distinct administrative configurations (Strict, Balanced, and Permissive policies) against a comprehensive dataset of 100,913,000 complete-flow records, we systematically evaluate two metrics: Policy Violations (𝑉 ) and Intent Drift ( 𝐷 ).
Accepted for publication in the 2026 IEEE 7th World AI IoT Congress (AIIoT 2026).
This data-driven strategy utilizes low-level network identifiers as a flow-level telemetry interface for continuous data-plane assurance, establishing an empirical baseline that remains invariant across shifting administrative configurations. We identify a distinct decoupling where loosening policy constraints suppresses explicit violation counts, yet the underlying operational deviation, quantified via intent drift, remains static. While conventional monitoring relies on reactive, bottom-up firewall adjustments, mapping low-level structural traffic concentrations within an IBN framework provides the empirical foundation to automatically derive semantic, service-aware policy abstractions. These insights enable the transition to active, closed-loop orchestrators capable of dynamically recalculating and enforcing low-level rules that maintain high-level operational intent despite administrative masking, critical for supporting highly dynamic and multi-tenant 6G environments, The contributions of this work are: (i) formalizing raw headers into 7-tuple vectors to establish an Internal LowLevel Intent (ILI) telemetry interface; (ii) processing 100.91 million real-world flow records to prove that intent drift is policy-invariant; and (iii) demonstrating how structural violation concentrations can provide insights to enable closed-loop orchestrators to dynamically recalculate and enforce low-level rules that maintain high-level operational intent. II. Related Work and Background The closed-loop lifecycle of Intent-Based Networking (IBN) structures an autonomous orchestration process relying on continuous feedback loops spanning intent ingestion, compilation translation, policy enforcement, and telemetry assurance [1], [2]. Substantial research has targeted upstream automation within this architecture to optimize how declarative administrative goals map onto active configurations. Automated policy generation platforms compile high-level demands down to softwaredefined configuration templates [5], while Large Language Model (LLM) pipelines facilitate natural language intent ingestion within network orchestrators [3]. More recently, neurosymbolic AI frameworks have been investigated to enhance contextual execution and service management intelligence [7]. Existing validation systems operate primarily within the control plane via compile-time logic checks, predeployment syntax validation, or structural model parsing. While verifying configuration syntax, they lack empirical, data-plane models to assess policy fidelity under active runtime conditions. This decoupling between
static validation and live execution introduces systemic liabilities, as automated pipelines can mask latent attack surfaces, compilation loops, and policy ambiguities that manifest exclusively at runtime [8]. To evaluate these autonomous network behaviors under realistic conditions, infrastructure-wide intent testing datasets have been generated to map 5G-and-beyond/6G communication traces [9], standard frameworks treat low-level flow identifiers as static configuration artifacts rather than dynamic, actionable objects of intent. Bridging this gap requires continuous, telemetry-driven assessment engines. Active telemetry loops ensure multitenant isolation [10]. This paper unifies these perspectives by treating the live 7-tuple data-plane header as the active, executable unit of translated policy, establishing a granular Internal Low-Level Intent (ILI) telemetry interface for continuous data-plane assurance. Evaluating the performance of an ILI-driven framework is best assessed against high-entropy traffic as benign production or controlled environment traces possess predictable patterns that can mask policy drift. Empirical unsolicited traffic from network telescopes and distributed honeynets provides an ideal high-entropy environment. Such wide-area monitoring captures scanning behaviors, automated multi-vector botnets, darknet trends [11]. In particular, our evaluation leverages empirical subsets of the massive packet traces captured across distributed HoneyTrap infrastructures, which map realworld adversarial probing behaviors [6]. By repurposing this threat telemetry as an adversarial sandbox across alternative policy tiers, we study the limitations of conventional violation metrics. III. Approach and Empirical Results Figure 1 illustrates the architecture of the proposed intent-assurance framework, spanning distributed honeynet telemetry collection, flow construction, policy evaluation, drift measurement, and closed-loop assurance generation. Raw, unsolicited traffic is normalized into structured 7-tuple Internal Low-Level Intent (ILI) vectors to establish an empirical, data-plane native validation layer. By evaluating these observed data-plane primitives against parameterized administrative policy regimes, the framework decouples superficial administrative compliance from underlying operational stability. This provides the critical feedback required for closedloop intent orchestrators to dynamically recalculate lowlevel rules and enforce dynamic reconfigurations within autonomous 6G environments.
Accepted for publication in the 2026 IEEE 7th World AI IoT Congress (AIIoT 2026).
Fig. 1. Workflow of the proposed intent-assurance framework.
A. Semantic Intent Data-Plane Formalization While traditional IBN closed-loop assurance frameworks verify configuration states at the control plane, they lack mechanisms to validate whether live dataplane traffic conforms to high-level policies. In practice, abstract administrative security and operational objectives are stripped of abstraction at the data plane, where execution is enforced exclusively through discrete, lowlevel flow headers. We formalizing raw data-plane flow headers into standardized 7-tuple vectors as a granular Internal Low-Level Intent (ILI) telemetry interface for continuous data-plane assurance: 𝑓 = (𝑠𝑟𝑐𝐼 𝑃, 𝑑𝑠𝑡𝐼 𝑃, 𝑠𝑟𝑐𝑀 𝐴𝐶, 𝑑𝑠𝑡 𝑀 𝐴𝐶, 𝑠𝑟𝑐𝑃𝑜𝑟𝑡, 𝑑𝑠𝑡𝑃𝑜𝑟𝑡, 𝑝𝑟𝑜𝑡𝑜𝑐𝑜𝑙)
These vectors serve as the active, executable unit of translated policy. B. Dataset Flow-Level Telemetry and Vector Projection
TABLE I Dataset summary for intent-assurance analysis. Dataset Attribute Raw data format Organization Processed format Total records Complete-flow records Flow construction fields Flow key fields
Value Nested JSON files Year/Month/Day/Hour Parquet 114.4 million 100,913,000 srcIP, dstIP, dstPort, protocol, timestamp srcIP, dstIP, dstPort, protocol
This key serves to 1) evaluate data-plane compliance against explicit policy constraints and 2) track behavioral deviations relative to an empirical expected baseline. To establish temporal context, Figure 2 maps traffic intensity across matching seasonal windows in 2023 and 2024, demonstrating highly concentrated activity in the earlier months of each operational cycle.
To validate this framework under high-entropy network traffic we leverage a large-scale telemetry corpus collected from a distributed honeynet infrastructure deployed at Merit Network. The raw dataset, structured as nested, time-stratified JSON records, is parsed and normalized into high-performance Parquet repositories. Table I summarizes the dataset attributes, isolating a massive evaluation subset of 100, 913, 000 flow records. For each complete-flow record, the framework applies a projection mapping to derive a standardized flow key: 𝑘𝑒𝑦( 𝑓 ) = (𝑠𝑟𝑐𝐼 𝑃, 𝑑𝑠𝑡𝐼 𝑃, 𝑑𝑠𝑡𝑃𝑜𝑟𝑡, 𝑝𝑟𝑜𝑡𝑜𝑐𝑜𝑙)
Fig. 2. Activity heatmap for January through April for 2023, and 2024.
Accepted for publication in the 2026 IEEE 7th World AI IoT Congress (AIIoT 2026).
C. Data-Driven Policy Construction An IBN Orchestrator must translate abstract, declarative human goals formulated via the Intent Behavioral Language (IBL) into deterministic data-plane enforcement profiles. Rather than relying on arbitrary configurations, we utilize a data-driven approach to identify key service clusters within the network’s operational footprint. As illustrated in Figure 3, initial telemetry analysis reveals that data-plane traffic is not uniformly distributed across the service space; instead, connection volumes cluster heavily around a narrow, predictable subset of destination ports. Port 25565 emerges as a dominant structural outlier, accompanied by distinct administrative and operational vectors including ports 5900 (VNC), 179 (BGP), 22 (SSH), 23 (Telnet), and 445 (SMB).
(port ∈ Prestricted ). This multi-tiered setup allows us to precisely observe how the closed-loop system responds when the formal boundaries of compliance are expanded or contracted. D. Violations vs. Intent Drift Metrics We formalize two data-plane metrics to support assurance: Policy Violation (𝑉 ) and Intent Drift ( 𝐷 ). Let 𝐹𝑜𝑏𝑠 denote the set of observed flow records. Let 𝑃𝑖 ( 𝑓 ) ∈ {0, 1} define the policy predicate for a given administrative tier 𝑖 , returning 1 if 𝑓 is explicitly authorized and 0 if restricted. The predicate is evaluated via destination-port membership in the defined service sets. The total violation count 𝑉𝑖 under policy tier 𝑖 is: 𝑉𝑖 = |{ 𝑓 ∈ 𝐹𝑜𝑏𝑠 : 𝑃𝑖 ( 𝑓 ) = 0}|
This metric captures explicit non-compliance and is highly dependent on the strictness of the active administrative rules. The second metric, Intent Drift ( 𝐷 ) measures behavioral stability independent of active policy bounds. Let 𝐾 denote the global set of observed flow keys. We establish an empirical expected-flow baseline 𝐹𝑏𝑎𝑠𝑒 by isolating the top 𝑘 dominant recurring communication patterns ( 𝑘 = 100): 𝐹𝑏𝑎𝑠𝑒 = Top 𝑘=100 (𝐾)
Then, the total intent drift can be defined as the cardinality of flows whose keys fall outside this baseline: 𝐷 = |{ 𝑓 ∈ 𝐹𝑜𝑏𝑠 : 𝑘𝑒𝑦( 𝑓 ) ∉ 𝐹𝑏𝑎𝑠𝑒 }| Fig. 3. Top Destination Ports by Connection Count.
Rather than enforcing a coarse, monolithic firewall posture, these empirical concentrations justify serviceoriented policy groupings that mirror real-world operational tiers. The IBN Policy Compiler instantiates these behaviors by constructing three nested, mathematically defined administrative policy profiles to evaluate intent enforcement elasticity:
While 𝑉𝑖 fluctuates based on administrative configurations, 𝐹𝑏𝑎𝑠𝑒 remains fixed, allowing the framework to expose hidden operational deviations that satisfy permissive policies but represent structural behavior drift. E. The Compliance Paradox
Evaluating the 100.91 million flow records exposes a fundamental Compliance Paradox. As shown in Figure 4, total policy violations exhibit a strict monotonic PStrict =⇒ {Essential web services: 80, 443} decrease as administrative parameters expand, dropping PBalanced =⇒ PStrict ∪ {Standard remote admin: 22, 179} from 95,024,343 under the Strict tier to 92,988,515 (Balanced) and 87,701,038 (Permissive). However, unPPermissive =⇒ PBalanced ∪ derlying intent drift remains strictly invariant at exactly {Extended operational services: 89,031,223 flows across all policy tiers. These results 21, 23} showcase how conventional compliance tracking via violations can be susceptible to administrative masking; where highly sensitive or high-risk ports identified widening policy permissiveness suppresses violation by the telemetry profiling (e.g., 25565, 445) are desigalerts without reducing actual data-plane drift. nated as explicitly restricted across all operational tiers Accepted for publication in the 2026 IEEE 7th World AI IoT Congress (AIIoT 2026).
Fig. 4. Intent Policy Comparison: Total Violations and Intent Drift.
Fig. 5. Violation Type Distribution Across Intent Policies.
This observation is further investigated in Figure 5, which maps the composition of traffic non-compliance across two mutually exclusive tracking categories: • Non-Allowlisted Port: Flows destined to a port that
is omitted from the active allowlist (port ∉ Pallowed ) but is not flagged as a critical security risk (port ∉ Prestricted ). • Non-Allowlisted + Restricted: Flows that simultaneously violate allowlist constraints and target highly sensitive, explicitly restricted service ports (port ∉ Pallowed ∩ port ∈ Prestricted ). Intent assurance would require analyzing the aggregated sum of both classifications. Across the configurations, the true total volume conforms precisely to the policystrictness hierarchy, moving from 95,024,343 violations under Strict (79,125,864 Non-Allowlisted + 15,898,479 Joint Restricted) down to 92,988,515 under Balanced and 87,701,038 under Permissive. The Figure illustrates that shifting policy parameters changes not only the net alert volume but also the underlying mathematical composition of those violations. For example, under the Strict regime where Pallowed = {80, 443}, standard administrative ports like Port 22 (SSH) are omitted from the allowlist and belong to the restricted set, classifying their traffic under NonAllowlisted + Restricted. When the orchestrator transitions to the Balanced regime, Port 22 is integrated into the expanded allowlist. Consequently, its traffic instantly ceases to trigger violations, reducing the joint-restricted volume by over 7.2 million flows and altering the visible profile of the chart. Shifting administrative definitions merely reclassifies or masks existing flow behaviors without altering the physical traffic matrix.
Fig. 6. Top Violating Destination Ports Across Intent Policies.
F. Temporal Stability and Policy Consistency Figures 7 and 8 establish the temporal stability of these metrics across matching operational windows in 2023 and 2024. While total volumes experience predictable seasonal fluctuations, peaking in January and March before declining in April, the structural policy hierarchy (𝑉Strict > 𝑉Balanced > 𝑉Permissive ) remains immutable over time. The temporal variations in intent drift show statistical independence from the enforced policy regimes, showcasing that underlying data-plane behavioral anomalies can propagate invariant to the security constraints defined by a high-level intents.
Fig. 7. Monthly Policy Violations Across Intent Policies. Accepted for publication in the 2026 IEEE 7th World AI IoT Congress (AIIoT 2026).
Fig. 8. Monthly Intent Drift Across Intent Policies.
Fig. 9. Closed-loop IBN orchestration architecture for autonomous 6G environments, detailing the top-down intent translation engine and bottom-up ILI telemetry verification.
IV. 6G Implications and Future Research Opportunities These empirical findings provide critical architectural insights for designing autonomous orchestration fabrics in production 6G environments. While traditional security mechanisms rely on bottom-up, reactive scripting to remediate anomalous traffic, demonstrating that structural variations in intent drift exhibit statistical independence from active policy regimes confirms that data-plane anomalies propagate invariant to high-level security constraints. Consequently, advanced Intent-Based Networking (IBN) frameworks must translate granular data-plane telemetry into top-down, semantic abstractions that mirror abstract behavioral expectations rather than static configuration states. Decoupled tracking of policy violations (𝑉𝑖 ) and intent drift ( 𝐷 ) via the proposed 7-tuple ILI interface equips closedloop orchestrators with the telemetry primitives required to see past administrative masking. When anomalous flows are exposed beneath loose administrative rules, the orchestration engine leverages the Intent Behavioral
Language (IBL) compiler to bypass configuration errors, dynamically recalculate multi-tenant policies, and push down updated configuration primitives to enforce immediate, behavior-defined operational boundaries across distributed 6G network slices. Moving forward, the conceptual and empirical contributions established in this study delineate three strategic, high-impact research opportunities for autonomous network governance and intent verification architectures. This closed-loop orchestration cycle is architecturalized in Fig. 9, which maps the top-down translation pipeline from high-level user intent down to line-rate data-plane execution elements. The framework demonstrates how the decoupled tracking of policy violations (𝑉𝑖 ) and intent drift ( 𝐷 ) via the Internal Low-Level Intent (ILI) interface explicitly feeds back into the orchestration engine, enabling automated, zero-trust policy synthesis and verification. By shifting the remediation loop from manual configurations to an autonomic feedback fabric, the system continuously ensures alignment between declarative IBL expectations and live physical network states. 1) Dynamic Intent Re-Compilation & Synthesis Engines: A primary challenge in closed-loop IBN is mitigating conflicting configurations during automated runtime remediation. Future work will investigate the continuous compilation mechanics required to translate decoupled ILI drift telemetry back into high-level declarative state changes. This requires designing mathematical synthesis models that dynamically update abstract security parameters without introducing semantic contradictions or violating structural invariants across 6G infrastructures [12]. 2) Contextual Disambiguation: To scale the semantic fidelity of intent assurance in highly dynamic environments, the ILI interface must evolve beyond the static port classification sets evaluated in this study. Enriching ILI with multi-dimensional telemetry context, such as topological path profiles, destination network roles, protocol-specific state machine progression, and multi-temporal correlation patterns across concurrent communication streams, will allow the assurance fabric to accurately distinguish benign, seasonal operational drift from malicious, high-entropy behavioral anomalies. 3) Line-Rate Ingestion and Distributed SmartNIC Execution: Transitioning from offline telemetry profiling to live, line-rate intent assurance demands extreme execution efficiency. Future architectures will focus on mapping the ILI verification pipeline directly onto programmable data planes, exploring distributed consensus
Accepted for publication in the 2026 IEEE 7th World AI IoT Congress (AIIoT 2026).
and high-throughput algorithms to execute 7-tuple flow evaluations at terabit scale. Offloading this verification logic onto P4-enabled switches and SmartNICs will minimize end-to-end rule recalculation latencies and optimize hardware resource utilization during active zero-trust enforcement scenarios. V. Conclusion This paper presented a data-plane flow-level assurance framework for Intent-Based Networking (IBN) by formalizing raw network stream identifiers into standardized 7-tuple vectors, establishing an Internal LowLevel Intent (ILI) telemetry interface. Evaluated against a massive empirical dataset of 100.91 million live flow records, the proposed framework successfully exposed a fundamental validation gap within conventional verification methods. The data demonstrated that as administrative security postures expand from Strict to Permissive configurations, formal Policy Violations (𝑉 ) systematically decrease, whereas the underlying dataplane Intent Drift ( 𝐷 ) remains invariant across all operational setups. This serves to highlight that conventional, violation-centric assurance frameworks suffer from administrative masking, remaining blind to high-entropy behavioral shifts. By tracking violations and behavioral drift, this framework resolves the compliance blind spot, enabling closed-loop IBN orchestrators with the datadriven primitives to bypass administrative masking and automatically enforce more precise, behavior-defined operational boundaries for IBN in 6G infrastructures.
[5] T. A. Khan, A. Muhammad, K. Abbas, and W.-C. Song, “Intentbased networking platform: An automated approach for policy and configuration of next-generation networks,” in Proceedings of the 36th Annual ACM Symposium on Applied Computing (SAC ’21), 2021, pp. 1921–1930. [6] T. Haikal, E. Hammad, and S. Ismail, “Characterizing large-scale adversarial activities through large-scale honey-nets,” arXiv preprint arXiv:2512.06557, 2025, accepted at IEEE UEMCON 2025. [7] L. Colombi, S. Cavicchi, F. Poltronieri, M. Tortonesi, C. Stefanelli, and P. Varga, “Investigating Neurosymbolic AI for Intent-based Service Management,” in 2025 21st International Conference on Network and Service Management (CNSM). IEEE, 2025, pp. 1–6. [8] J. Kim, H. Okhravi, D. J. Tian, and B. E. Ujcich, “Security challenges of intent-based networking,” Communications of the ACM, vol. 67, no. 7, pp. 56–65, 2024. [9] J. Andrade-Hoz, Q. Wang, and J. M. Alcaraz-Calero, “Infrastructure-wide and intent-based networking dataset for 5gand-beyond ai-driven autonomous networks,” Sensors, vol. 24, no. 3, p. 783, 2024. [10] L. Velasco, M. Signorelli, O. G. De Dios, C. Papagianni, R. Bifulco, J. J. V. Olmos, S. Pryor, G. Carrozzo, J. Schulz-Zander, M. Bennis et al., “End-to-End Intent-Based Networking,” IEEE communications Magazine, vol. 59, no. 10, pp. 106–112, 2021. [11] S. Ismail, E. Hammad, W. Hatcher, S. Dandan, A. Alomari, and M. Spratt, “Merit Network Telescope: Processing and Initial Insights From Nearly 20 Years of Darknet Traffic for Cybersecurity Research,” in 2025 IEEE 16th Annual Ubiquitous Computing, Electronics & Mobile Communication Conference (UEMCON), pp. 0873–0879. [12] M. R. Chowdhury, E. Hammad, L. Loven, S. Pirttikangas, A. P. Da Silva, and W. Saad, “A Framework for AI-Native Semantic-Based Dynamic Slicing for 6G Networks,” arXiv preprint arXiv:2510.10756, 2025.
Acknowledgment The research was partially supported by NSF Award Number 2319793, CICI: TCR program, IRIS: Instrumentation for Research and Inter-institutional SOC. References [1] E. Zeydan and Y. Turk, “Recent advances in intent-based networking: A survey,” in 2020 IEEE 91st Vehicular Technology Conference (VTC2020-Spring). IEEE, 2020, pp. 1–5. [2] A. Leivadeas and M. Falkner, “A survey on intent-based networking,” IEEE Communications Surveys & Tutorials, vol. 25, no. 1, pp. 625–655, 2022. [3] A. Mekrache, A. Ksentini, and C. Verikoukis, “Intent-based management of next-generation networks: an llm-centric approach,” IEEE Network, vol. PP, no. 99, pp. 1–1, 2024. [4] I. Zacarias, M. Grunewald, F. Gentzen, X. Masip-Bruin, and A. Jukan, “Enhancing Secure Intent-Based Networking with an Agentic AI: The EU Project MARE Approach,” arXiv preprint arXiv:2604.06856, 2026. Accepted for publication in the 2026 IEEE 7th World AI IoT Congress (AIIoT 2026).