Netinspector improves network policy creation with grounded llms
NetInspector: Measuring and Improving LLM Capabilities for Reliable Intent-Based Networking Policy Generation
Cryptography and SecurityNetworking and Internet Architecture
Summary
Managing network rules is hard because networks are big and complicated. The researchers found that large language models can help translate what network operators want into detailed rules, but these models sometimes miss when a new rule breaks security. They discovered this happens because the models don’t remember the actual network layout. To fix this, they built a system called NetInspector that checks rules against live network facts before approving them, making the process safer and more accurate.
What this means in practice
- •For network administrators: Improve automated network policy generation by verifying proposed rules against live topology to reduce security errors.
- •For security operations teams: Enhance detection of policy conflicts by combining language models with real-time network data for safer updates.
Authors
Yuxuan Zhang, Hongxin Hu, Guofei Gu
Abstract
Modern networks are large in scale and heterogeneous in configuration, making manual policy management increasingly impractical. Intent-Based Networking (IBN) addresses this by automating the translation of high-level operator goals into low-level network configurations. Yet existing IBN systems rely on static heuristics and fixed-feature classifiers that generalize poorly to distribution shifts such as new service definitions or evolving phrasing in operator requests. Large Language Models (LLMs), with strong reasoning and translation capabilities demonstrated across many domains, are a natural candidate for IBN policy generation. However, it is unclear whether LLMs can be reliably applied to this task, nor whether their use mitigates or worsens the underlying security risk. In this work, we show that while fine-tuned LLMs excel at intent translation, they exhibit false negative rates when checking whether a proposed intent violates an existing security policy. The root cause is not a lack of logical reasoning capability, but LLMs lack of persistent grounding in network topology and group hierarchy. Motivated by this finding, we introduce NetInspector, a three-layer agentic framework that enforces a verify-then-act protocol, decoupling information retrieval from reasoning so that the LLM focuses on symbolic reasoning while every policy decision is grounded in verifiable network facts retrieved from a live Environment Layer before approval. On NetInspector-Bench, a 2,224-sample synthetic benchmark spanning campus, enterprise, and WAN topologies, NetInspector reduces FNR by over 30\% relative to ungrounded baselines and remains robust under linguistic distribution shifts.