LEAD-Drift: Real-time and Explainable Intent Drift Detection by Learning a Data-Driven Risk Score

TL;DR

LEAD-Drift is a real-time, explainable framework that detects intent drift proactively in networks by predicting future risk scores, enabling earlier alerts and reducing false alarms.

Contribution

It reformulates intent drift detection as a supervised learning problem with a neural network, introduces multi-horizon modeling, and employs SHAP for explainability, advancing proactive network assurance.

Findings

Provides 17.8% earlier warnings than baselines

Reduces alert noise by 80.2%

Improves operational network reliability

Abstract

Intent-Based Networking (IBN) simplifies network management, but its reliability is challenged by "intent drift", where the network's state gradually deviates from its intended goal, often leading to silent failures. Conventional approaches struggle to detect the subtle, early stages of intent drift, raising alarms only when degradation is significant and failure is imminent, which limits their effectiveness for proactive assurance. To address this, we propose LEAD-Drift, a framework that detects intent drift in real time to enable proactive failure prevention. LEAD-Drift's core contribution is reformulating intent failure detection as a supervised learning problem by training a lightweight neural network on fixed-horizon labels to predict a future risk score. The model's raw output is then smoothed with an Exponential Moving Average (EMA) and passed through a statistically tuned threshold to generate robust, real-time alerts. Furthermore, we enhance the framework with two key features for operational intelligence: a multi-horizon modeling technique for dynamic time-to-failure estimation, and per-alert explainability using SHAP to identify root-cause KPIs. Our evaluation on a time-series dataset shows LEAD-Drift provides significantly earlier warnings, improving the average lead time by 7.3 minutes (+17.8\%) compared to a distance-based baseline. It also reduces alert noise by 80.2\% compared to a weighted-KPI heuristic, with only a minor trade-off in lead time. These results demonstrate that LEAD-Drift as a highly effective, interpretable, and operationally efficient solution for proactive network assurance in IBN.