Bridging High-Level Intent and Network Execution: Detecting Violations and Intent Drift Through Low-Level Traffic Analysis

Abstract

Intent-Based Networking (IBN) structures a core management pillar for autonomous 6G networks by translating high-level administrative goals into autonomous configurations, yet a critical validation gap persists between declarative intent and data-plane execution. This paper investigates this gap by formalizing low-level flow headers into standardized 7-tuple vectors, establishing an Internal Low-Level Intent (ILI) telemetry interface. Leveraging an empirical dataset of 100.91 million flow records from a distributed honeynet, we evaluate three administrative policy regimes (Strict, Balanced, and Permissive) across two metrics: Policy Violations ($V$) and Intent Drift ($D$). Our results expose a distinct Compliance Paradox where widening policy permissiveness systematically suppresses violation counts, yet underlying operational intent drift remains mostly invariant. This demonstrates that conventional, violation-centric tracking are unreliable. Furthermore, an empirical case study show that ILI metrics structural violations can inform closed-loop orchestrators to dynamically recalculate and enforce low-level rules that maintain high-level operational intent.