CAIP: Detecting Router Misconfigurations with Context-Aware Iterative Prompting of LLMs

TL;DR

This paper presents CAIP, a framework that enhances LLM-based router misconfiguration detection by automating context extraction and iterative prompt optimization, significantly improving accuracy over existing methods.

Contribution

Introduction of CAIP, a novel context-aware iterative prompting framework that automates network-specific context extraction for more accurate router misconfiguration detection using LLMs.

Findings

Improves misconfiguration detection accuracy by over 30%.

Uncovers more than 20 previously undetected misconfigurations.

Outperforms traditional model checkers and partition-based LLM approaches.

Abstract

Model checkers and consistency checkers detect critical errors in router configurations, but these tools require significant manual effort to develop and maintain. LLM-based Q&A models have emerged as a promising alternative, allowing users to query partitions of configurations through prompts and receive answers based on learned patterns, thanks to transformer models pre-trained on vast datasets that provide generic configuration context for interpreting router configurations. Yet, current methods of partition-based prompting often do not provide enough network-specific context from the actual configurations to enable accurate inference. We introduce a Context-Aware Iterative Prompting (CAIP) framework that automates network-specific context extraction and optimizes LLM prompts for more precise router misconfiguration detection. CAIP addresses three challenges: (1) efficiently mining relevant context from complex configuration files, (2) accurately distinguishing between pre-defined and user-defined parameter values to prevent irrelevant context from being introduced, and (3) managing prompt context overload with iterative, guided interactions with the model. Our evaluations on synthetic and real-world configurations show that CAIP improves misconfiguration detection accuracy by more than 30% compared to partition-based LLM approaches, model checkers, and consistency checkers, uncovering over 20 previously undetected misconfigurations in real-world configurations.