A Secured Intent-Based Networking (sIBN) with Data-Driven Time-Aware Intrusion Detection

TL;DR

This paper introduces a data-driven, machine learning-based intrusion detection system for intent-based networking, enhancing security by identifying tampering through behavioral and time-aware features, validated on real-world data.

Contribution

It presents a novel ML-based intrusion detection approach with engineered time-aware features specifically designed for securing intent-based networks.

Findings

Effective detection of intent tampering demonstrated on real-world datasets.

Achieved high accuracy and low error rates in binary and multi-class classification.

Outperformed existing methods in standard evaluation metrics.

Abstract

While Intent-Based Networking (IBN) promises operational efficiency through autonomous and abstraction-driven network management, a critical unaddressed issue lies in IBN's implicit trust in the integrity of intent ingested by the network. This inherent assumption of data reliability creates a blind spot exploitable by Man-in-the-Middle (MitM) attacks, where an adversary intercepts and alters intent before it is enacted, compelling the network to orchestrate malicious configurations. This study proposes a secured IBN (sIBN) system with data driven intrusion detection method designed to secure legitimate user intent from adversarial tampering. The proposed intent intrusion detection system uses a ML model applied for network behavioral anomaly detection to reveal temporal patterns of intent tampering. This is achieved by leveraging a set of original behavioral metrics and newly engineered time-aware features, with the model's hyperparameters fine-tuned through the randomized search cross-validation (RSCV) technique. Numerical results based on real-world data sets, show the effectiveness of sIBN, achieving the best performance across standard evaluation metrics, in both binary and multi classification tasks, while maintaining low error rates.