Intention-driven network management method and system based on large language model

Abstract

The invention relates to the technical field of network management, and discloses an intent-driven network management method and system based on a large language model (LLM). The method comprises the following steps: receiving a natural language intention of a network administrator, analyzing the intention by utilizing a pre-trained large language model, extracting a key target and constraint, generating a configuration scheme of a TCP / IP or QUIC protocol based on an analysis result and a network protocol knowledge base, and ensuring the effectiveness and safety of configuration through a network constraint verification module. And the configuration passing the verification is applied to the network system. The system comprises an intention input module, an LLM analysis module, a configuration generation module, a verification module, an application module and the like. According to the invention, through conversion from automation intention to configuration, the network management process is simplified, the management efficiency and flexibility are improved, the method is especially suitable for multi-parameter optimization scenes of protocols such as TCP / IP and QUIC, and intelligent network management is realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of computer network technology and artificial intelligence, particularly to the field of network management technology, and more particularly to a method and system for implementing efficient management of intent-driven networks (IDN) using the natural language understanding and reasoning capabilities of large language models (LLM).

[0002] The present application aims to address the complexity and inefficiency of traditional network management methods, simplify network operation processes, and significantly improve the automation and intelligence levels of network management. It also optimizes the performance of complex network protocols such as TCP / IP and QUIC to meet the stringent requirements of modern network environments for agility, reliability, and performance. BACKGROUND

[0003] With the rapid development and widespread application of cloud computing, the Internet of Things, 5G communication, and edge computing technologies, the global network scale is expanding at an unprecedented rate, with network topology becoming increasingly complex and business traffic exhibiting high dynamicity and unpredictability. In this context, traditional network management models are facing unprecedented challenges.

[0004] For a long time, network administrators have relied on command-line interfaces (CLI) and simple network management protocol (SNMP) and other traditional tools for network device configuration, monitoring, and maintenance. Although CLI is powerful, its operation method is extremely tedious. Administrators need to memorize a large number of complex and often slightly different underlying command sets for different vendor devices. For example, configuring a complex BGP routing policy or deploying MPLS traffic engineering tunnels may involve inputting dozens or even hundreds of lines of commands, which not only consumes time and effort but also is extremely prone to human errors such as spelling mistakes, parameter omissions, and logical contradictions. This may further lead to network interruptions, performance degradation, or even security vulnerabilities, causing significant economic losses and operational risks. In addition, CLI operations are difficult to scale and automate, and in the case of large-scale network changes or rapid response to business demands, they are inefficient and have become a key bottleneck restricting network agility.

[0005] SNMP mainly focuses on network monitoring and basic state queries, although it provides some management capabilities, its configuration management functions are limited, and its polling-based working mode produces significant network overhead and management delay when facing large-scale and highly dynamic networks, making it difficult to meet real-time and refined management needs.

[0006] To overcome the shortcomings of traditional network management methods, the concept of IDN emerged and has received widespread attention in the industry. The core concept of IDN is to elevate the focus of network management from "how to do it" to "what to do." Administrators simply describe the network's desired business objectives or operational status in a high-level, declarative manner, such as "ensure low-latency communication for video conferencing application A" or "isolate network access between production and test environments," without having to worry about the underlying implementation steps and command details. The IDN system is responsible for automatically translating these high-level intents into specific network device configurations. Through continuous monitoring, verification, and adjustment, it builds a closed-loop system to ensure that the network status always aligns with the administrator's intent.

[0007] However, despite the promising prospects of IDN, in practice, its core component, "intent translation," faces significant challenges. Efficiently and accurately mapping the high-level, and sometimes ambiguous, intent inherent in human natural language into machine-executable, conflict-free, and multi-constrained network configurations is a critical challenge that must be addressed for the implementation of IDN technology. Existing IDN solutions often rely on predefined templates or complex policy engines, which offer limited flexibility and intelligence, making them incapable of handling complex and ever-changing intent and network scenarios.

[0008] Breakthroughs in LLMs offer hope for overcoming the challenge of translating IDN intent. LLMs, such as the GPT series and the Llama series, are pre-trained on massive amounts of text and code data, demonstrating impressive capabilities in natural language understanding, generation, summarization, translation, question-answering, and even code writing. These LLMs possess powerful contextual learning and zero- or few-shot reasoning capabilities, promising to serve as "universal translators" and "intelligent reasoning engines" connecting human natural language intent with machine-executable instructions.

[0009] Combining LLM's exceptional natural language processing capabilities with IDN's automation framework holds enormous potential. LLM understands administrators' network requirements expressed in everyday language, extracts key elements, and, combined with network domain expertise, generates corresponding network configuration scripts or API calls. This is particularly true in protocol optimization scenarios like TCP / IP and QUIC, which involve numerous tunable parameters and complex coupling relationships between them. LLM can help the system understand the complexity of multi-objective optimization and explore optimal parameter combinations, thereby improving network performance.

[0010] Despite its promising prospects, applying LLM directly to the serious field of network configuration is not easy, and a series of challenges must be faced and addressed.

[0011] Accuracy and reliability, LLMs have "hallucination" problems, which can generate configurations that appear reasonable but are actually incorrect or invalid. How to ensure that the configurations generated by LLMs are 100% correct in syntax and logic is the primary challenge.

[0012] Domain knowledge fusion, general LLMs lack deep network professional knowledge, such as subtle differences of specific protocols, configuration specifications of vendor devices, and best practices of network operation. How to effectively inject these domain knowledge into LLMs to make them have the ability of network experts is crucial.

[0013] Security and compliance, network configuration is directly related to network security. How to ensure that the configurations generated by LLMs comply with established security policies and compliance requirements, and prevent the generation of configurations that may introduce security risks, is a challenge that cannot be ignored.

[0014] Context understanding and long-range dependence, network intentions usually involve complex context and cross-device dependencies, while the context window of LLMs is limited. How to handle large-scale, long-range dependent network intentions is a technical difficulty.

[0015] Closed loop and self-adaptation, network status is dynamic, how to let LLMs participate in closed-loop management, and make configuration adjustments and self-optimization according to real-time feedback, is the key to realizing truly intelligent management.

[0016] In summary, there is an urgent need to develop a new network management method and system that can fully utilize the advantages of LLMs while overcoming the challenges of their application in the network field, and build an intention-driven network management system that can reliably analyze natural language intentions, generate safe and effective configurations combined with network knowledge, and realize automatic deployment and closed-loop self-optimization, thereby completely changing the status quo of network operation and promoting network management into a new era of intelligentization. SUMMARY

[0017] The purpose of the present application is to overcome the problems of existing network management technologies, such as complex operation, easy to make mistakes, low automation level, and the efficiency and accuracy challenges faced by existing IDNs in the intention translation process. The present application aims to propose an intention-driven network management method and system based on large language models, which greatly simplifies the interaction between humans and networks by introducing the powerful natural language processing and reasoning capabilities of LLMs, improves the automation and intelligence level of network configuration, management, and optimization, and ensures the security and effectiveness of network configuration.

[0018] To achieve the above purpose, the present application provides the following technical solution: an intention-driven network management method based on a large language model, the method comprising: The receiving module obtains the network intent description input by the network administrator or the upper application in natural language form through a web interface, a chat robot, an API, etc. natural language interface; The intent description can be unstructured and contain performance targets, business requirements, security policies, and related constraints expected to be achieved for the network; for example, input "on Monday to Friday 9:00-18:00, prioritize the end-to-end delay of certain video conference applications A and application B to be less than 80ms, bandwidth not less than 20Mbps, and ensure that all QUIC traffic uses TLS 1.3 encryption, while avoiding affecting the normal access of the financial system".

[0019] The parsing module uses a pre-trained large language model adapted and fine-tuned through network domain knowledge to deeply analyze the received natural language intent; This process aims to convert ambiguous, high-level human language into precise, structured machine-understandable representations; this module is responsible for extracting key information from the intent, including but not limited to target services, performance indicators and their thresholds, security requirements, device ranges, constraints, and understanding their logical relationships and priorities, and finally outputting structured network intent representations using JSON, YAML, or custom data structures.

[0020] The configuration generation module intelligently generates specific configuration schemes or complete network configurations for the target network environment based on the structured network intent representation output by the parsing module and deeply integrates a specially constructed network protocol knowledge base; The network protocol knowledge base is a key component of the invention, it is not just a collection of static documents, but a dynamic knowledge system containing complex dependency relationships between protocol parameters, configuration specifications and command syntax for different network device manufacturers, best practices for network performance optimization, historical operation and maintenance experience, and formal rules.

[0021] The verification module strictly verifies the configuration scheme or network configuration output by the configuration generation module in multiple layers and multiple dimensions to maximize the correctness, effectiveness, security, and compliance of the configuration scheme.

[0022] The application module automatically deploys the configuration scheme confirmed by the verification module to physical devices or virtual devices through the network orchestrator. The deployment process uses standard southbound interface protocols to interact with network devices.

[0023] Preferably, the natural language intent analysis specifically includes: Use the context self-attention mechanism built into the LLM to identify IP addresses, VLAN IDs, application names, protocol types, and "allow", "prohibit", "optimize", "guarantee" action instructions in the intent text; By dynamically constructing an intent decision tree or similar directed graph structure, high-level business goals are decomposed into a series of measurable and executable network configuration sub-tasks at each level; In combination with the RFC protocol standard text, network design documents, and historical operation order data stored in the knowledge base, the LLM's reasoning ability is used to disambiguate and quantify ambiguous words and vague expressions in the intent, such as "high bandwidth" being specified as ">100Mbps" based on application type and historical data.

[0024] Preferably, the construction and utilization method of the network protocol knowledge base includes: Using retrieval enhancement generation technology, massive TCP / IP, QUIC protocol RFC documents, official configuration guides, technical white papers, and community forum discussions of various mainstream network equipment manufacturers, and other unstructured text data are vectorized and stored in block form in a vector database. When the LLM needs relevant knowledge, it can quickly retrieve the most relevant text fragments as context input to enhance the accuracy of the generated content; Through LoRA, Prompt Tuning, and other parameter-efficient fine-tuning (PEFT) techniques, the pre-trained LLM is adapted to the field, allowing it to better understand network-specific terminology, abbreviations, configuration syntax, and underlying logic, and establishing the ability to reason about the collaborative influence between protocol parameters; Integrate a formal verification rule base to clearly define the legal value range of protocol parameters, mutual exclusion constraints between parameters, and security baselines that must be adhered to in a logical language.

[0025] Preferably, the verification module further includes: The syntax checking submodule uses JSON Schema, YANG Model, or specific vendor configuration parsers to strictly verify the format and syntax of the configuration scripts or API payloads generated by the LLM.

[0026] The dynamic simulation submodule simulates the deployment of the generated configuration scheme in an isolated network sandbox environment. By injecting simulated traffic, potential risks such as traffic scheduling conflicts, routing loops, excessive CPU and memory usage, and their expected impact on network performance are detected.

[0027] The formal verification submodule abstracts the network topology structure as a directed graph or Kripke structure, and describes network policies and security requirements as formal specifications. Using model detection tools, the network model after deployment configuration is exhaustively or symbolically traversed through the state space to mathematically prove whether the configuration scheme meets all security and compliance policies, such as "specific subnet A can never access subnet B."

[0028] Preferably, the specific execution process of the formal verification submodule is as follows: Abstraction of devices, links, interfaces, etc. in the current network into a directed graph model G=(V, E); Based on the generated configuration scheme and the existing network state, a configuration influence propagation matrix M is constructed to describe how the configuration changes affect the network state; Using a model detection tool, the network model and LTL / CTL specification are taken as input, and all reachable state spaces are systematically traversed to check whether there is a state path that violates the specification, thereby ensuring that there is no loop, no congestion hotspot, and no policy conflict.

[0029] Preferably, the closed-loop feedback adjustment comprises: After deployment, real-time collection of network key performance indicators and device state data is performed through network telemetry technology; The actual performance data collected is continuously compared with the intended target defined by the administrator in the receiving module, and the performance deviation is calculated; When the performance deviation exceeds the pre-set threshold or a network anomaly is detected, the system automatically triggers the LLM re-optimization process; The LLM generates an incremental parameter correction scheme based on the current deviation, real-time network state, and historical experience, rather than a complete reconfiguration, to reduce the impact on the network; All historical decisions, configuration changes, performance feedback, and final results are recorded to form a continuously growing experience base, which is used to iteratively update the configuration rules, optimization strategies, and formal rules in the network protocol knowledge base, realizing the continuous learning and self-evolution of the system.

[0030] The application also provides an intent-driven network management system based on a large language model, comprising: A natural language interface unit as the interactive front end of the user and the system, providing a Web GUI, a chat robot, a command line tool, or an API interface for receiving unstructured intent instructions input by the administrator and converting them into text sequences processable by the LLM after preprocessing; An intent analysis engine, the core intelligent component of the system, integrates a pre-trained LLM adapted to the network field and necessary network field adapters; it performs the intent analysis and reasoning functions in the aforementioned method to convert natural language into structured intent; A multi-protocol configuration generator responsible for generating configuration schemes based on structured intent, with built-in parameter optimization models for core protocols such as TCP / IP and QUIC, and supporting configuration template generation and conversion capabilities across multiple mainstream vendor devices; A network protocol knowledge base as a support for intent analysis and configuration generation, storing vast amounts of network knowledge and providing efficient retrieval interfaces; The verification sandbox platform provides a secure test environment, integrates a network simulator, a configuration checker, a policy verifier and a formal verification tool chain, and is used for performing multi-level verification in the foregoing method; The orchestration execution unit is responsible for interacting with a real network environment, and safely issues the verified configuration instructions to physical or virtual network devices through various southbound interface protocols; The intent guarantee controller continuously monitors network operation indicators by connecting a network monitoring system, compares the indicators with original intents, drives a closed-loop optimization process, and can generate an operation and maintenance report.

[0031] Preferably, the intent analysis engine adopts a hierarchical architecture: The basic layer provides the core natural language processing capability of the general pre-trained LLM; The domain adaptation layer fine-tunes through LoRA (Low-Rank Adaptation) or other PEFT technologies, efficiently injecting professional knowledge and configuration logic of the network domain into the basic layer LLM; The decision enhancement layer may integrate a policy network of reinforcement learning, continuously optimizing the mapping efficiency and effect from intent to configuration through interaction with the simulation environment or real network, so as to make better decisions when facing complex or unknown scenarios.

[0032] Preferably, the multi-protocol configuration generator includes: A protocol parameter inference model based on graph neural network (GNN) is used to capture and understand the complex and nonlinear interdependence between parameters in network protocols; A vendor syntax converter can accurately convert the abstract or general configuration representation generated by the LLM into executable CLI commands or API calls for specific vendor devices; A performance prediction component based on a time series model is used to predict the possible trend of network KPI changes after application-specific parameter adjustment before configuration deployment, providing forward-looking guidance for configuration selection.

[0033] The present application also provides an electronic device, such as a high-performance server, a network controller, a cloud management platform node or a dedicated network management workstation. The electronic device includes at least one or more processors, one or more memories and a computer program stored in the memory. When the processor is configured to execute the computer program, it can implement all or part of the steps of the intent-driven network management method based on the large language model described above, and drive the various modules in the system to work together.

[0034] Compared with the prior art, the present application has the following advantages: By supporting natural language interaction, the complexity of network configuration and management is greatly simplified, making it possible for network administrators to intuitively and efficiently express their management intentions without the need to remember and input a large number of complex command lines, significantly reducing the requirement for the depth of administrator professional skills and shortening the training period.

[0035] End-to-end automated conversion, verification and deployment from high-level intentions to specific network configurations are realized, significantly reducing the human intervention link and thus greatly reducing the risk of network failure caused by human operation errors and greatly accelerating the response speed of network service deployment and changes.

[0036] The system can more quickly understand and respond to changing network conditions or emerging business needs. When it is necessary to adjust the network strategy or deploy new services, the administrator only needs to describe the new intention in natural language, and the system can quickly generate and deploy the corresponding configuration, making the network have unprecedented agility and adaptability.

[0037] With the powerful information processing and reasoning ability of LLM and the combination of a specially constructed network knowledge base, the application can effectively handle complex scenarios that traditional methods cannot handle, especially in the performance optimization of multi-parameter and strongly coupled protocols such as TCP / IP and QUIC, and can explore and generate more optimal configuration schemes.

[0038] By introducing multi-level and multi-dimensional verification modules including syntax checking, semantic logic, network constraints, dynamic simulation and formal verification, it is ensured that the network configuration scheme generated by LLM is fully verified before deployment, maximizing the effectiveness, security and compliance of the configuration and preventing the introduction of potential risks.

[0039] By building a closed-loop management system with continuous monitoring, deviation analysis and feedback adjustment, not only can the network state always meet the administrator's established intentions, but also by recording historical data and results, using the learning ability of LLM, continuously updating the knowledge base and optimizing the strategy, realizing the continuous learning and self-evolution of the system, making the network management more and more intelligent. BRIEF DESCRIPTION OF DRAWINGS

[0040] Figure 1 A workflow diagram of an intention-driven network management method based on a large language model provided by the application.

[0041] Figure 2 A structural diagram of an intention-driven network management system based on a large language model provided by the application.

[0042] Figure 3 A construction process diagram of a network protocol knowledge base in the intention-driven network management method.

[0043] Figure 4Workflow diagram of the verification module in the intent-driven network management method. DETAILED DESCRIPTION

[0044] The technical solutions in the embodiments of the present application will be described more clearly and completely below with reference to the drawings in the embodiments of the present application. It must be understood that the described embodiments are only some preferred embodiments of the present application, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments in the present application without making creative efforts should be considered as falling within the scope of protection pursued by the present application.

[0045] Embodiment 1 Please refer to Figure 1 The core process of the intent-driven network management method based on a large language model provided by the present application is described in detail as follows: S101, receiving an intent, the system receives the input of a network administrator through its natural language interface unit.

[0046] The interface can be a Web-based graphical user interface, which contains a text input box or a conversation window; it can also be a chat robot integrated into an enterprise chat platform; or an application programming interface for calling by an automated script or a third-party system.

[0047] The natural language intent input by the administrator (or user) can be various, and the main information includes key targets, performance indicators, constraint conditions, semantic association relationships, security policies, etc. This step is responsible for preliminarily processing these inputs and passing them to the next step. As shown in Table 1, the input natural language is preliminarily classified according to the preset intent type of the system.

[0048] Table 1

[0049] S102, analyzing the intent, after the intent analysis engine receives the natural language intent, it starts its core LLM to perform deep analysis.

[0050] In this embodiment, after the intent analysis engine receives the natural language intent, it starts its core LLM to perform deep analysis to extract key targets, constraint conditions and semantic association relationships, and generate a structured network intent representation, including: Entity and relationship recognition: The LLM first leverages its powerful contextual self-attention mechanism and pre-trained knowledge to identify key network entities and action target instructions in the text, and extract key targets, constraints, and semantic association relationships based on key network entities and action target instructions. For example, an LLM fine-tuned in the network domain can identify IP addresses, VLAN IDs, application names, protocol types, and other key network entities in the intent text, as well as "allow," "prohibit," "optimize," "guarantee," and other action instructions, and thus more accurately understand "delay," "bandwidth," "QoS," "ACL," and other professional terms.

[0051] Intent decomposition and structuring: For complex intents, the system dynamically constructs an intent decision tree to decompose natural language intents into a series of (one or more) measurable and executable network configuration sub-tasks. For example, the key network entities in the performance guarantee type intent in S101 include the video conference server cluster in City 1 data center, City 2 office, QUIC, etc., and the action target instructions include during working hours (Monday to Friday, 9:00-18:00), priority guarantee, ensuring the security of its QUIC traffic to the highest level, low delay (<50ms), high bandwidth (>500Mbps), etc., which will be decomposed into sub-tasks including: Identify APP-A / APP-B traffic (may require DPI or IP / port-based identification); Configure QoS policy to set high priority queue; Configure bandwidth reservation or traffic shaping; Configure encryption policy for QUIC (e.g., enable TLS 1.3, select strong encryption suite); Apply time policy; Apply source / destination address policy.

[0052] Disambiguation and quantification: The LLM combines information from the network protocol knowledge base to reason. For example, the RFC documents and best practices in the knowledge base can help the LLM quantify "high bandwidth" to a specific value, or when faced with the ambiguous intent "ensure security," retrieve relevant firewall rules, IPSec VPN, TLS configuration, and other security policies for selection. If the intent is not clear, the system can even ask the administrator through the natural language interface unit to obtain more information.

[0053] Generate structured representation: The analysis results are converted into a precise, machine-readable structured network intent representation that at least contains key targets, constraints, and semantic association relationships. This can be a JSON object: JSON { "intent_id": "vidconf_001", "description": "App A / App B QoS&Security", "targets": [ {"type": "application", "value": " App A "}, {"type": "application", "value": " App B "} ], "scope": { "source": "10.10.1.0 / 24", "destination": "Shanghai_Office_Range" }, "actions": [ {"type": "qos", "priority": "high", "latency_max_ms": 50, "bandwidth_min_mbps": 500}, {"type": "security", "protocol": "QUIC", "level": "highest", "tls_version": "1.3"} ], "constraints": [ {"type": "time", "days": ["Mon", "Tue", "Wed", "Thu", "Fri"], "start": "09:00", "end": "18:00"} ] Wherein, "intent_id" represents the intent identifier, "description" represents the intent type and description, "targets", "scope" represent the semantic association relationship, "actions" represent the key target, and "constraints" represent the constraint condition.

[0054] S103, generating configuration, the multi-protocol configuration generator receives the structured intent, and starts the configuration generation process.

[0055] ​Knowledge base retrieval, the system first uses keywords in the intent representation to retrieve relevant document snippets, configuration templates, and best practices from the network protocol knowledge base. RAG techniques ensure that the LLM can access the most relevant and accurate information when generating configurations.

[0056] Parameter inference and scheme design, the LLM, based on the retrieved knowledge and its own reasoning capabilities, begins to design a specific configuration scheme. It needs to consider the dependency between parameters, the syntax differences of manufacturers, and the priority of intentions. For example, in order to guarantee low latency, the LLM may choose a specific congestion control algorithm and adjust the buffer size of TCP / QUIC; in order to ensure security, it will choose the appropriate encryption algorithm and key length.

[0057] Configuration code generation, the LLM converts the designed scheme into specific configuration code. The manufacturer syntax converter plays a role here, converting general logic into specific device commands. For example, generate QoS configuration commands for a certain brand of router, and generate security policies for a certain brand of firewall, as follows: ! QoS Example (Simplified) class-map match-any APP-A_APP-B match protocol App-A match protocol App-B policy-map QOS_POLICY class APP-A_APP-B priority percent 50 set dscpef class class-default fair-queue interface GigabitEthernet0 / 1 service-policy output QOS_POLICY Performance prediction, when generating multiple possible configuration schemes, the performance prediction component can evaluate the performance impact of each scheme, helping the LLM choose the optimal scheme.

[0058] S104, verify the configuration, the verification sandbox platform tests the generated configuration rigorously.

[0059] Syntax check, using YANG (Yet Another Next Generation) model or vendor-provided tools to check if the configuration command or API call is syntactically correct.

[0060] Semantic and logical check, checking if the parameter values are within a reasonable range, the logic is self-consistent, and there is no conflict with existing IP addresses, VLANs.

[0061] Network constraint compliance detection, checking if the configuration violates higher-level network policies, such as security zone division, routing domain isolation, etc.

[0062] Dynamic simulation, loading the configuration into a network simulator, running simulated traffic, and observing network behavior. For example, checking if the QoS policy really provides priority for APP-A traffic, and the security policy correctly prevents illegal access without introducing loops or black holes.

[0063] Formal verification, for high-risk or critical business configurations, start formal verification. Input the network model and security policy into the model detection tool. The tool will prove that the configuration will not violate these key policies under any possible circumstances with mathematical rigor.

[0064] S105, application and closed loop, iteratively update the configuration rules in the network protocol knowledge base, optimize the policy and formal rules, and realize the self-evolution of the system.

[0065] Automatic deployment, once the configuration passes all the verification, the orchestration execution unit will develop a deployment plan, and through modern southbound interfaces such as NETCONF, gNMI, or CLI commands through SSH when necessary, push the configuration to the target network device.

[0066] Continuous monitoring, intent assurance controller starts working. It collects key indicators of network devices in real time through telemetry systems, such as interface traffic, CPU / memory utilization, delay, jitter, packet loss rate, security events, etc.

[0067] Deviation detection and re-optimization, the controller compares real-time data with the original intent. If it finds that the deviation continues to exceed the preset threshold, it will trigger the LLM re-optimization process. The specific comparison process is as follows: Explicit intent target: the system first extracts all quantifiable performance indicators and constraints that need to be followed from the intent input by the administrator initially. In the example in the patent, the intent target is "to guarantee end-to-end delay less than 80ms and bandwidth not less than 20Mbps for video conference applications A and B". This "80ms delay" and "20Mbps bandwidth" are the baseline for comparison.

[0068] Real-time data collection: The intent assurance controller continuously collects real-time key performance indicators and status data from network devices through network telemetry. These data are very detailed and can include traffic latency for specific applications, throughput for specific ports, CPU usage, etc.

[0069] Data matching and performance deviation calculation: The controller matches the collected real-time data with the preset intent targets (such as the key targets contained in natural language intents) and calculates the deviation. For example, it continuously measures the traffic of application A and application B passing through the specified interface, calculates the real-time end-to-end latency and occupied bandwidth, and then compares the measured value, such as 95ms latency, with the intent target 80ms latency, to calculate the performance deviation of 15ms latency exceeding the standard.

[0070] Setting trigger thresholds: Not any minor fluctuation will immediately trigger optimization. The system will preset a "deviation threshold". For example, only when the latency exceeds 80ms for 5 consecutive minutes or the bandwidth is lower than 20Mbps for multiple times within 10 minutes, it is considered that there is a significant deviation that needs to be intervened. This can prevent the system from overreacting to the transient jitter of the network.

[0071] Incremental correction, the LLM receives deviation information and current network state analysis reasons, and generates an incremental correction scheme, such as adjusting QoS queue weight or switching to a backup link. This correction scheme also needs to be verified before deployment.

[0072] Learning and evolution, the entire process including intent, configuration, verification result, performance feedback, and correction scheme are recorded and used to update the network protocol knowledge base. This enables the system to learn from success and failure, and make more intelligent decisions in the future when facing similar situations.

[0073] Embodiment 2 Please refer to Figure 2 The various modules of the system 200 of the present application work together to realize a complete process from natural language to closed-loop network management.

[0074] The natural language interface unit 210 provides a friendly user interface, supporting text, voice, and even future multi-modal input. It is responsible for preliminary input processing and user session management.

[0075] The intent analysis engine 220, as the core intelligent agent, has a layered architecture that ensures its strong capabilities. The basic layer LLM provides general language capabilities; the domain adaptation layer uses technologies such as LoRA to make LLM understand network terminology with relatively small cost; the decision enhancement layer enables it to find the best strategy through learning in a simulated environment without explicit instructions or insufficient knowledge base coverage, and has the ability to creatively solve problems.

[0076] Network protocol knowledge base 230, which is the reference book of the system, the RAG mechanism enables it to dynamically obtain information; fine-tuning enables it to understand information; and the formal rule base sets the bottom line for its behavior. It is a dynamically optimized knowledge system that is constantly updated through closed-loop feedback.

[0077] Multi-protocol configuration generator 240, which can not only generate configurations, but also understand the complex relationships within protocols through GNN, predict the future through time series models, and adapt to various network devices through converters.

[0078] Verification sandbox platform 250 provides a zero-risk test environment, with layers of checks from syntax, logic, simulation to formal verification, to ensure that every configuration shipped is safe, reliable and effective.

[0079] Orchestration execution unit 260, as the executor of the system, is proficient in various languages for communicating with network devices, and is used to automatically deploy verified configuration schemes to target network devices to ensure that configurations are accurately delivered and applied.

[0080] Intention guarantee controller 270, as the guardian of the system, continuously monitors the network to ensure that the intentions of administrators or users are continuously met, and timely alerts and correction processes are initiated when deviations occur.

[0081] Example 3 This example aims to elaborate the construction process of the network protocol knowledge base in the present invention, and how the intention analysis engine deeply utilizes the knowledge base. Through key technologies such as retrieval enhancement, efficient fine-tuning of generation and parameters (PEFT), etc., it realizes accurate understanding and deep analysis of complex network intentions. Please refer to Figure 3 .

[0082] The construction of the network protocol knowledge base is a continuous and systematic engineering, which starts from the collection of massive and heterogeneous professional knowledge in the network field. The system regularly obtains the latest data from multiple globally recognized authoritative sources through efficient network crawlers and API interfaces. These sources mainly include: RFC official standard documents about TCP / IP, QUIC, BGP, MPLS, etc. core protocols published by IETF (Internet Engineering Task Force) and others; official configuration guides, command reference manuals, technical white papers, and the latest product errata published by network equipment vendors; network architecture design and operation best practice documents publicly released by large network operators and head enterprises; and high-quality discussions and solutions about network troubleshooting and configuration optimization mined from industry technology forums and professional communities. In addition, the system also integrates historical operation and maintenance work orders, network change records, and fault root cause analysis reports accumulated internally after desensitization, and incorporates these valuable practical experiences into the knowledge base.

[0083] The collected raw data formats vary, such as PDF, HTML, and plain text. The system first performs data cleaning processes to convert them into a standardized plain text format. Next, to facilitate subsequent processing, the system uses an advanced semantic segmentation strategy to replace the traditional fixed-length segmentation. This strategy can understand the context of the text and intelligently segment long documents into knowledge pieces of moderate size and complete logical semantics.

[0084] After segmentation, the system uses a powerful text embedding model to accurately convert each knowledge piece into a high-dimensional vector that represents its semantic information. These vectors are finally stored in a vector database designed for efficient similarity retrieval and indexed quickly.

[0085] To enable the general LLM to understand network domain-specific terminology and complex logic, the system uses the LoRA technology in parameter-efficient fine-tuning. This process first requires building a high-quality fine-tuning dataset, which typically contains thousands to tens of thousands of "instruction-response" sample pairs. These samples are carefully designed to cover multiple key tasks, such as network terminology explanation, natural language intent to structured data conversion, and general configuration strategy to vendor-specific configuration command translation.

[0086] During LoRA fine-tuning, the system does not update the LLM's large original parameters, but injects trainable, extremely low-rank adaptation matrices into its core Transformer structure. The training process only updates these newly added, extremely low-parameter matrices, efficiently injecting network domain-specific knowledge and configuration logic into the LLM at extremely low computational and time costs, making it a network expert model.

[0087] When a network intent, e.g. “Ensure all QUIC traffic is encrypted with TLS 1.3”, is input to the intent parsing engine, its internal RAG-based workflow kicks in. First, the LoRA-fine-tuned LLM can quickly identify the core requirement “QUIC traffic security configuration” and the key entity “TLS 1.3” in the intent.

[0088] Subsequently, the system converts the keywords such as “QUIC and TLS 1.3 security configuration” into query vectors and performs a high-speed similarity search in the vector database of the network protocol knowledge base. The database immediately returns several knowledge fragments most relevant to the query, which may include: mandatory requirements in RFC 9001 standard that QUIC protocol must use TLS 1.3 for encryption, specific commands and parameters in a certain vendor’s firewall configuration guide on how to create a QUIC security policy and specify the TLS version, and detailed discussions in an industry best practice document on the recommended TLS 1.3 high-strength encryption suite. The system then splices these retrieved, highly relevant knowledge fragments as contextual information with the original intent text input by the administrator to form an enhanced prompt word with more abundant information and more explicit context.

[0089] Finally, this enhanced prompt word is input to the LoRA-fine-tuned LLM for final reasoning generation. At this moment, the LLM not only has internalized domain knowledge through fine-tuning, but also obtains precise reference materials for the current specific problem, as if it is taking an “open-book exam”. Therefore, it can generate a very precise and detailed structured intent representation (JSON) that not only contains the basic {"protocol": "QUIC", "tls_version": "1.3"}, but also further refines to a recommended list of encryption suites according to best practices, such as: {"cipher_suites":["TLS_AES_128_GCM_SHA256","TLS_CHACHA20_POLY1305_SHA256"]}. Through this innovative combination of Retrieval-Augmented Generation (RAG) and Parameter Efficient Fine-Tuning (PEFT), the invention effectively overcomes the two core defects of outdated knowledge and lack of domain knowledge commonly existing in general large language models, enabling it to accurately, reliably and deeply understand complex network management intents, laying a solid and intelligent foundation for subsequent highly automated configuration generation and closed-loop management.

[0090] Embodiment 4 This embodiment aims to elaborate the detailed workflow of the verification module after receiving the configuration scheme, especially the collaborative working process of the dynamic simulation submodule and the formal verification submodule, to ensure the correctness, effectiveness and security of the configuration scheme before deployment. Please refer to Figure 4 .

[0091] In this embodiment, the QoS configuration generated in the following scenario is taken as the object to be verified.

[0092] Guaranteeing video conference application: input "on Monday to Friday 9:00-18:00, prioritize the end-to-end delay of less than 80ms, bandwidth of not less than 20Mbps for certain video conference applications A and B, and ensure that all QUIC traffic uses TLS 1.3 encryption, while avoiding affecting the normal access of the financial system".

[0093] When the "configuration generation module" outputs the QoS configuration script for the video conference application according to the intent, the verification task is started. First, the verification sandbox platform receives the configuration scheme and its associated structured intent representation (JSON object). By parsing the intent, the platform clearly defines the core goals of this verification, including the performance indicators that need to be achieved, such as the end-to-end delay of application A and application B traffic being less than 80ms, and the bandwidth being higher than 20Mbps; and the constraints that must be followed, such as the financial system's access being completely unaffected, and all QUIC traffic needing to use the TLS 1.3 protocol for encryption.

[0094] The first step of the verification process is the syntax and semantic check, which is performed by the syntax checking submodule. This submodule loads the YANG model corresponding to the target network device. YANG, as a data modeling language, can precisely define the structure, type and constraints of configuration data. In the syntax checking stage, the submodule strictly verifies whether the generated CLI commands, such as class-map, policy-map, service-policy, etc., fully comply with the command specifications of the target device operating system, and checks for spelling errors, missing parameters or improper formats, etc. The next semantic checking stage further checks the reasonableness of parameter values. For example, for the configuration "priority percent 50", the system will combine the information about the maximum reservable bandwidth of the interface in the knowledge base to judge whether reserving 50% is an invalid value that exceeds the physical limit or violates the policy. At the same time, it will verify whether the DSCP value "ef" used in the configuration is a valid mark supported by the device, to ensure that the configuration is logically correct and executable.

[0095] After passing basic syntax and semantic verification, the configuration plan enters the dynamic simulation verification phase. This phase is conducted by the dynamic simulation submodule in a completely isolated network sandbox environment. This sandbox is a digital twin environment built using professional network simulation software, consistent with the actual production network topology. The system first automatically deploys the QoS configuration to be verified to the virtual router within the sandbox.

[0096] Subsequently, a traffic generator is activated, which simulates and injects three types of key traffic based on the application profiles stored in the knowledge base: the first type is target traffic, which simulates the real video streams of application A and application B; the second type is background traffic, which is used to simulate the mixed traffic of other ordinary services in the network to test the effectiveness of QoS policies in complex environments; the third type is constrained traffic, which specifically simulates the financial system's access to the database to verify whether the new configuration has any unexpected negative impact on it.

[0097] During the entire traffic injection period, the Intent Assurance Controller connects to the sandbox environment, collects key performance indicators (KPIs) of the virtual network interface in real time, and accurately measures the end-to-end latency, jitter, actual bandwidth, and packet loss rate of the target traffic.

[0098] After the simulation is complete, the system rigorously compares the collected actual performance data with the performance targets initially intended. For example, for the target traffic, a configuration solution will be considered to have passed dynamic simulation verification only if the latency of Application A and Application B traffic remains stable below 80ms, the bandwidth meets the 20Mbps requirement, and the packet loss rate of the financial system traffic remains zero.

[0099] For high-risk intentions involving core security policies or critical business isolation, the system will also initiate the highest-level "Formal Verification Submodule" for final confirmation. For example, for intentions such as "avoiding impacting normal access to financial systems" or "isolating production and test environments," formal verification provides mathematical-level security assurance.

[0100] First, the system abstracts network topology, routing tables, firewall rules, and more into a precise mathematical model, such as a directed graph G = (V, E). Then, security policies expressed in natural language, such as "Finance system traffic cannot be dropped" or "The production environment can never access the test environment," are converted into a rigorous formal logic language, such as Linear Temporal Logic (LTL). For example, the former can be expressed as G (pkt.src_ip ∈ Finance_Subnet → F pkt.dest_ip ∈ Finance_DB_Server), which logically implies "Under any global state, as long as a packet originates from the Finance subnet, it will eventually reach the Finance database server."

[0101] Subsequently, the system calls a specialized model checking tool (e.g., Batfish) with the constructed network model and LTL specification as inputs. The tool exhaustively or symbolically traverses and explores the state space of all possible reachable states of the model, and mathematically rigorously proves that the network does not violate any defined security specification under any possible packet forwarding path after the new QoS configuration is applied.

[0102] Finally, only when a configuration scheme successfully passes all levels of verification from syntax and semantic checking, dynamic simulation verification to formal verification, the orchestration and execution unit is formally authorized to deploy it to the real physical network environment. This series of rigorous multi-dimensional verification processes maximizes the safety and reliability of network changes, and eliminates potential risks before deployment.

Claims

1. An intent-driven network management method based on a large language model, characterized in that: The method comprises: Obtain the input natural language intent and perform preliminary classification of the input natural language intent according to the preset intent type; Parsing the natural language intent using a pre-trained large-scale language model, extracting the key objectives, constraints, and semantic associations contained in the natural language intent, and generating a structured network intent representation based on the preliminary classification results; Based on the structured network intent representation and in combination with a network protocol knowledge base, a configuration solution for the TCP / IP or QUIC protocol is generated; wherein the network protocol knowledge base includes protocol parameter dependencies, vendor configuration specifications, and performance optimization strategies; Performing syntax verification, semantic logic verification, and network constraint compliance testing on the generated configuration scheme to ensure the security and effectiveness of the configuration scheme; and Automatically deploy verified configuration solutions to target network devices and continuously monitor network status for closed-loop feedback adjustments.

2. The intent-driven network management method based on a large language model according to claim 1 is characterized in that The pre-trained large-scale language model is used to parse the natural language intent, extract the key objectives, constraints, and semantic associations contained in the natural language intent, and combine the results of the preliminary classification to generate a structured network intent representation, including: Identifying key network entities and action target instructions in the natural language intent through the contextual self-attention mechanism of the large language model; Decomposing the natural language intent into one or more executable network configuration subtasks; Combining the RFC protocol text and historical operation and maintenance data in the network protocol knowledge base to eliminate the ambiguity and vague expressions of the natural language intent; Combining the key network entities and action target instructions in the natural language intent and the results of the preliminary classification, a structured network intent representation containing key goals, constraints and semantic associations is generated.

3. The intent-driven network management method based on a large language model according to claim 1, characterized in that The method of combining the network protocol knowledge base to generate a configuration solution for the TCP / IP or QUIC protocol includes: By configuring web crawlers and API interfaces, we can collect massive amounts of raw data containing network domain expertise from official standard documents including TCP / IP or QUIC protocols, official configuration guides from network equipment manufacturers, operation and maintenance best practice documents from carriers, industry technical forums, and historical operation and maintenance work orders and reports within the enterprise. Clean the collected raw data, convert it into a standardized plain text format, and split long documents into knowledge fragments of appropriate size that contain complete logical semantics; Using the text embedding model, each knowledge fragment is converted into a high-dimensional vector and stored in a vector database to establish a fast index; Adopting LoRA technology to perform domain adaptation on the pre-trained large language model, so that the large language model can understand professional terms, abbreviations, configuration syntax, and establish the ability to reason about the synergistic influence relationship between protocol parameters; Identifying core requirements and key entities in the natural language intent using the large language model, identifying keywords in the core requirements and key entities, converting the identified keywords into query vectors, performing similarity search in the vector database, and returning the most relevant knowledge fragments; The retrieved knowledge fragments are used as context information and spliced ​​with the original natural language intent text to form enhanced prompt words; The enhanced prompt word is input into the large language model fine-tuned by LoRA for inference generation, the configuration scheme is output, and the configuration scheme is converted into a corresponding configuration code based on the type of the target network device.

4. The intent-driven network management method based on a large language model according to claim 1, characterized in that The grammatical verification, semantic logic verification and network constraint compliance detection of the generated configuration scheme include: Receive the configuration scheme and its associated structured intent representation, and perform the natural language intent parsing operation to determine the performance indicators to be achieved; Loading the YANG model corresponding to the target network device, verifying whether the generated CLI command complies with the command specification of the target device operating system, and verifying the rationality of the parameter values ​​corresponding to the performance indicators; Performing dynamic simulation verification on the configuration scheme in a network sandbox environment; activating a traffic generator to simulate and inject target traffic, background traffic, and constrained traffic based on the application profile stored in the network protocol knowledge base to verify whether the configuration solution produces unexpected negative effects; Actual performance data corresponding to key traffic in dynamic simulation is collected, and the actual performance data is compared with the performance indicators that need to be achieved through the natural language intent analysis operation to determine whether the configuration solution passes the dynamic simulation verification.

5. The intent-driven network management method based on a large language model according to claim 1, characterized in that The closed-loop feedback adjustment includes: After deployment, network telemetry data is collected in real time to compare actual performance with the key targets contained in the natural language intent. When the deviation exceeds a threshold, triggering the large language model to perform a re-optimization operation and generate an incremental correction plan; Record historical decisions and results, and iteratively update configuration rules and optimization strategies in the knowledge base.

6. An intent-driven network management system based on a large language model, characterized in that include: A natural language interface unit is used to receive an unstructured input intent and perform preliminary classification of the input natural language intent according to a preset intent type; An intent parsing engine, which uses a pre-trained large-scale language model to parse the natural language intent, extract the key goals, constraints, and semantic associations contained in the natural language intent, and generate a structured network intent representation based on the results of the preliminary classification. A multi-protocol configuration generator, based on the structured network intent representation and combined with the network protocol knowledge base, generates a configuration solution for the TCP / IP or QUIC protocol; The network protocol knowledge base includes protocol parameter dependencies, manufacturer configuration specifications, and performance optimization strategies; Verification sandbox platform, used to perform syntax verification, semantic logic verification and network constraint compliance detection on the generated configuration scheme to ensure the security and effectiveness of the configuration scheme; The orchestration execution unit is used to automatically deploy the verified configuration solution to the target network device; and Intent assurance controller, which continuously monitors network status and makes closed-loop feedback adjustments.

7. The intention-driven network management system based on a large language model according to claim 6, characterized in that: The intent parsing engine is also used to identify key network entities and action target instructions in the natural language intent through the contextual self-attention mechanism of the large language model; and decompose the natural language intent into one or more executable network configuration subtasks; the intent parsing engine also combines the RFC protocol text and historical operation and maintenance data in the network protocol knowledge base to eliminate the ambiguity and vague expressions of the natural language intent; the intent parsing engine is also used to combine the key network entities and action target instructions in the natural language intent and the results of preliminary classification to generate a structured network intent representation containing key goals, constraints and semantic associations.

8. The intention-driven network management system based on a large language model according to claim 6, characterized in that: The multi-protocol configuration generator is used to collect massive amounts of raw data containing network domain expertise from official standard documents containing TCP / IP or QUIC protocols, official configuration guides of network equipment manufacturers, operation and maintenance best practice documents of operator companies, industry technical forums, and historical operation and maintenance work orders and reports within the company through configured web crawlers and API interfaces; the multi-protocol configuration generator cleans the collected raw data, uniformly converts it into a standardized plain text format, and cuts long documents into knowledge fragments of moderate size and containing complete logical semantics; the multi-protocol configuration generator uses a text embedding model to convert each knowledge fragment into a high-dimensional vector and stores it in a vector database to establish a fast indexing engine. The multi-protocol configuration generator uses LoRA technology to perform domain adaptation on the pre-trained large language model, enabling the large language model to understand professional terms, abbreviations, and configuration syntax, and establish the ability to reason about the synergistic influence relationship between protocol parameters. The multi-protocol configuration generator uses the large language model to identify the core requirements and key entities in the natural language intent, and identifies keywords in the core requirements and key entities. It also converts the identified keywords into query vectors and performs a similarity search in the vector database to obtain the most relevant knowledge fragments. The multi-protocol configuration generator uses the retrieved knowledge fragments as context information and splices them with the original natural language intent text to form enhanced prompt words. The enhanced prompt words are input into the large language model fine-tuned by LoRA for inference generation; the multi-protocol configuration generator outputs the configuration scheme based on the inference result, and converts the configuration scheme into corresponding configuration code based on the type of the target network device.

9. The intention-driven network management system based on a large language model according to claim 6, characterized in that: The intent assurance controller is used to collect network telemetry data in real time after deployment and compare the deviation between actual performance and the key targets contained in the natural language intent; when the deviation exceeds a threshold, the large language model is triggered to perform re-optimization operations and generate an incremental correction plan.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory, wherein: When the processor executes the program, the steps of the method according to any one of claims 1 to 5 are implemented.

Images