Semantic perception intention-driven network guarantee method and framework

Abstract

The invention discloses a semantic perception intention-driven network guarantee method and a framework. S101, in the intention translation process, verification and conflict resolution are firstly carried out on the original intention of a user, and the processed intention is backed up in an intention library before and after a flow table is prepared to be issued; s102, periodically extracting a network intention from the network switch by adopting a bottom-up network intention extraction method; s103, comparing the backed-up original intention with the advanced intention, performing consistency comparison through consistency verification, screening out the intention which cannot be correspondingly matched with any user intention, and judging the intention as a failure intention; and S104, aiming at the failure intention marked in the S103, re-adopting intention translation from top to bottom, and carrying out installation on the failure intention. The method has the functions of automatically detecting and repairing network configuration errors, the problem that advanced intention is inconsistent with underlying configuration semantics due to network changes is relieved, the efficiency and accuracy of network operation and maintenance are improved, and meanwhile cost and time consumption are reduced.

Description

Technical Field

[0001] The present invention belongs to the field of intent-driven network technology, and in particular relates to a semantically-aware intent-driven network assurance method and framework. Background Art

[0002] Traditional network service management methods are still stuck in a static and scripted system framework, which makes it difficult to meet users' growing demand for service flexibility and diversification. The emergence of software-defined networks has redefined the behavior of data plane switches through centralized software control and improved the flexibility of network management, but a huge gap still exists between management complexity and meeting users' dynamic needs. The widening of this gap highlights the urgent need to reduce manual intervention and improve control loop automation.

[0003] In intent-driven networking, users can directly define their service requirements through natural language intents, avoiding the in-depth and complex hardware configuration details. Existing intent-driven network solutions mainly adopt a top-down design framework to refine high-level natural language intents into specific network configuration strategies. However, in the top-down implementation process, the refinement of intents often fails to fully consider the underlying state of the network, especially in terms of the semantic consistency of intents, configurations, and network states, which poses a challenge to ensuring the feasibility and effectiveness of intents.

[0004] Existing top-down IDN research mainly focuses on the following two key technical areas:

[0005] Key Technology 1: To bridge the semantic gap between user intent and the underlying state of the network, previous studies have attempted to narrow this gap through resource negotiation. Using technologies such as ontologies and Resource Description Framework (RDF) graphs, this type of research conducts precise negotiations between underlying network resources and user needs, attempting to more accurately map user intent to network hardware. Some studies also use knowledge graphs to capture attribute changes in network states to achieve semantic alignment between user intent and real-time network conditions, thereby ensuring accurate parsing and correct configuration of user intent in a constantly changing environment.

[0006] Key Technology 2: In order to solve the semantic difference between high-level intent and the underlying state of the network, some studies have adopted a "bottom-up" approach to analyze and trace the underlying configuration of the network, focusing on the details of the network hardware and configuration files. These studies have proposed intent tracing and extraction models, which play a vital role in tracking and interpreting the state and semantics of network intent, and provide key insights for the interpretation of network configuration. Some of these methods use deterministic methods to simplify the understanding and management of network configurations by reverse engineering configuration files, and describe them in the form of network intent language, and are committed to solving network visibility and semantic consistency problems through a bottom-up approach.

[0007] Although current intent-driven network technologies have achieved certain results in narrowing semantic differences and enhancing network status awareness, there are still many challenges.

[0008] First, although existing technologies mainly focus on the semantic differences caused by changes in network hardware, they often ignore the semantic differences caused by factors such as network configuration errors, redundancy, or network hijacking attacks.

[0009] Secondly, the response to network configuration errors is slow, and problems are often not discovered until they cause business interruptions.

[0010] In addition, solving problems caused by semantic gaps mostly requires manual intervention, which not only increases operation and maintenance costs, but also prolongs the processing cycle. The manual troubleshooting process is tedious and error-prone, which increases the burden on operation and maintenance personnel and may sometimes cause more serious problems. Summary of the invention

[0011] In order to overcome the shortcomings of the above-mentioned prior art, the purpose of the present invention is to provide a semantically-aware intent-driven network assurance method and framework, which has the function of automatically detecting and repairing network configuration errors, significantly reducing the need for manual troubleshooting, alleviating the inconsistency problem between high-level intent and underlying configuration semantics caused by network changes, improving the efficiency and accuracy of network operation and maintenance, and reducing costs and time consumption.

[0012] In order to achieve the above object, the technical solution adopted by the present invention is:

[0013] A semantically-aware intent-driven network assurance method includes the following steps:

[0014] S101, during the intent translation process, the user's original intent is first verified and conflicts are resolved. Before and after the flow table is prepared to be issued, the processed intent is backed up in the intent library to ensure intent traceability;

[0015] S102, using a bottom-up network intent extraction method to periodically extract network intent from network switches;

[0016] S103, performing consistency comparison between the original intent backed up in S101 and the high-level intent extracted in S102 through consistency check, screening out intents that cannot be matched with any user intent, and determining them as invalid intents;

[0017] S104, for the failure intent marked in S103, the "top-down" intent translation technology is re-adopted to install the failure intent.

[0018] In S101, when the user declares the network intention, the intention will be translated through a "top-down" intention translation technology; the transformation of high-level intention to network configuration is achieved through intention decomposition, intention verification and conflict resolution. In this process, the intention after intention decomposition, intention verification and conflict resolution is backed up and stored to facilitate subsequent "intention drift" detection.

[0019] The specific steps are:

[0020] Convert the network intent declared by the user into specific system commands or policies, ensure that the intent matches the network capabilities and restrictions, and perform intent translation;

[0021] Perform intent verification to check whether the translated intent meets the system rules and matches the constraints of the underlying hardware;

[0022] Identify conflicts between intent and policies issued by the network; obtain intent by user declaration, store network intent declared by user, and provide bottom-up intent Figure 1 Provides basis for verification.

[0023] In the intent translation, the user declares the natural language service requirements to the framework through the application, usually in the form of text or voice.

[0024] During the top-down intent translation process, the intent verification module will automatically detect whether the translated intent meets the constraints of the underlying network and check whether it conflicts with the current network policy. If the underlying network conditions (such as topology, link bandwidth, latency and other attributes) cannot meet the user's intent, or the user's intent conflicts with the deployed network intent, the intent verification module will immediately send an error warning message to the user.

[0025] After the intent is verified, its record is backed up in the intent library before being sent down for subsequent consistency verification; the policy deployment configures the generated intent policy as a flow table, and sends it down to the programmable switch through the OpenFlow protocol to realize the specific execution of the intent.

[0026] In S102, by adopting a "bottom-up" intent extraction method, network topology information and configuration flow table information of network switches are periodically collected at certain time intervals, and the network configuration is traced and extracted in the form of high-level intent. The extracted intent includes two parallel components: configuration synthesis and situation characterization.

[0027] The configuration synthesis is used to extract all switch flow tables in the software-defined network switch and extract high-level intermediate representations from the configuration flow tables through a bottom-up approach, in preparation for extracting high-level user intent;

[0028] The situational characterization is used to capture and analyze the current state and environment of the system; it usually covers network switch nodes and their connection relationships, as well as real-time switch and link delays, packet loss rates, available bandwidth and other information, providing the necessary background information for bottom-up extraction of intent;

[0029] The high-level intermediate representation obtained by configuration synthesis is integrated with the current state and environment information of situation characterization to form a unified high-level intention representation graph that can represent the user's high-level intention;

[0030] The consistency of the extracted high-level intent representation graph and the original user intent in the intent library is ensured through consistency checking; by comparing the endpoint group information of the policy in the intent library with the endpoint group information of the extracted high-level intent representation graph, it is verified whether there is a semantic deviation in the underlying configuration of the intent, and inconsistent intents will be marked as invalid intents;

[0031] Based on the current situation characterization information, re-issue and deploy strategies for invalid intentions to optimize and correct the original user intentions with consistency deviations.

[0032] In S103, the source IP address and the destination IP address are matched based on the connectivity intent. If all the intents in the intent library can match the high-level intent extracted in S102, it is considered that there is no semantic deviation between the high-level user intent and the underlying network configuration, and the intent has not deviated. If there is a situation in the intent library that cannot be matched with the extracted high-level intent, the intent in the intent library will be marked as an invalid intent, indicating that the intent has drifted.

[0033] In S104, for the identified failure intention, an event-condition-action (ECA)-based mechanism is adopted to re-issue and install the flow table to ensure stable operation and performance optimization of the network.

[0034] An assurance framework based on a semantically-aware intent-driven network assurance approach, including intent "top-down" and intent "bottom-up" parts;

[0035] The "top-down" intention includes sequentially connected intention translation, intention verification, conflict resolution, intention library, strategy deployment, and repair strategy;

[0036] The "bottom-up" intention includes configuration synthesis and situation characterization. The output ends of configuration synthesis and situation characterization are connected to the input end of semantic fusion. The semantic fusion is connected with consistency verification and repair strategy generation in turn.

[0037] The intention is "top-down";

[0038] Intent translation: Converts high-level user or application intent into specific system commands or policies to ensure that intent matches system capabilities and limitations.

[0039] Intent verification: Check whether the translated intent meets the system rules and matches the constraints of the underlying hardware to ensure its feasibility;

[0040] Conflict resolution: Identify conflicts between the translated intent and the deployed network policies to maintain system stability and efficient operation and prevent network performance degradation or functional failure caused by new intent.

[0041] Intent library: stores the translated user intents, which is a bottom-up intent library. Figure 1 Provide basis for verification;

[0042] Policy deployment: convert the intent verified by intent into specific network policies and install them in the network;

[0043] Repair strategy: When a semantic deviation is found between the user intent and the underlying configuration during bottom-up consistency verification, this framework will re-issue and install the strategy based on the intent type to ensure the validity of the intent.

[0044] The intent verification is specifically as follows:

[0045] First, the intent verification module parses the intent input by the user to confirm that it conforms to the defined grammatical rules and identifies potential grammatical errors and incomplete expressions by analyzing the structure of the intent expression.

[0046] Next, the intent verification module performs compliance checks on the translated intent to ensure that it complies with the predefined system policies and constraints;

[0047] Subsequently, the resource availability check verifies whether the current network resources can meet the requirements of the intent, evaluating the network’s bandwidth, computing power, and storage resources to ensure that they are sufficient to support the requested operation;

[0048] In addition, hardware compatibility verification ensures that the intended execution is feasible at the physical level, including checking the device's hardware capabilities, configuration limitations, and technical standards;

[0049] The strategy deployment is specifically as follows:

[0050] First, relevant configuration parameters are extracted from the translated intent, including the target device ID, flow table items, and QoS parameters. These parameters are passed as input to the API request of the SDN controller. After receiving these API requests, the controller converts the policy instructions into configuration commands that can be recognized by the device and sends them to the specified network device through the southbound interface protocol (such as OpenFlow).

[0051] On the device, these policies are installed as specific flow tables and configurations to ensure that network traffic is processed according to the expected rules; the policy deployment module monitors the results of API calls and verifies the correct installation of policies. If necessary, it checks the device status and traffic data to confirm the effectiveness of the policies. In this way, the policy deployment module can dynamically configure and manage policies in the SDN network to quickly respond to network changes and user needs;

[0052] Intent "bottom-up":

[0053] Configuration synthesis: Extract all switch flow tables in a software-defined network switch and extract high-level intermediate representations from the configuration flow tables through a bottom-up approach, in preparation for extracting high-level user intent;

[0054] Situational characterization: Capture and analyze the current state and environment of the system; this usually covers network switch nodes and their connection relationships, as well as real-time switch and link latency, packet loss rate, available bandwidth and other information, providing the necessary background information for bottom-up extraction of intent;

[0055] Semantic fusion: The high-level intermediate representation obtained by configuration synthesis is integrated with the current state and environment information of situation description to form a unified high-level intention representation graph that can represent the user's high-level intention;

[0056] Consistency check: Ensure the consistency between the extracted high-level intent representation graph and the original user intent in the intent library. By comparing the endpoint group information of the policy in the intent library with the endpoint group information of the extracted high-level intent representation graph, verify whether there is a semantic deviation in the underlying configuration of the intent. Inconsistent intents will be marked as invalid intents.

[0057] Repair strategy generation: Based on the current situation characterization information, re-issue and deploy strategies for failed intentions to optimize and correct the original user intentions with consistency deviations.

[0058] Beneficial effects of the present invention:

[0059] 1. Semantic-aware intent-driven network framework and intent drift detection mechanism: By combining top-down intent translation technology with bottom-up network intent traceability and extraction technology, the present invention proposes a practical intent drift detection and repair framework, which alleviates the semantic gap between high-level user intent and underlying network configuration. Based on this framework, the present invention has the ability to automatically detect and repair intent drift in a large-scale software-defined network environment, effectively reducing the reliance of traditional policy management on manual troubleshooting. This mechanism significantly improves the stability of user intent, effectively solves service interruptions caused by configuration errors, and ensures the continuity and reliability of network services.

[0060] 2. Cost reduction and improved operation and maintenance efficiency: By reducing manual intervention and optimizing the intended fault handling process, the present invention can reduce network operation and maintenance costs while improving the efficiency and accuracy of operation and maintenance work. This not only shortens the diagnosis and repair time of network faults, but also improves the overall operating efficiency of the network system, which is expected to bring economic benefits to enterprises and organizations. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 Schematic diagram of the semantically-aware intent-driven network assurance method of the present invention.

[0062] Figure 2 Schematic diagram of the semantically-aware intent-driven network assurance technology framework of the present invention.

[0063] Figure 3 This is a schematic diagram of the entire life cycle protection of the intention.

[0064] Figure 4 This is a schematic diagram of a comparative experiment on video service intent assurance of the present invention. DETAILED DESCRIPTION

[0065] The present invention will be further described in detail below in conjunction with the accompanying drawings.

[0066] like Figure 1 As shown, a semantically-aware intent-driven network assurance method is described in detail, including the following steps:

[0067] S101, when the user declares a high-level network intent, the intent will be refined through a "top-down" intent translation technology; the transformation of high-level intent to network configuration is achieved through intent decomposition, verification and conflict resolution. In this process, this technology will back up and store the intent after decomposition, verification and conflict resolution to facilitate subsequent "intent drift" detection.

[0068] S102, this technology will periodically collect network topology information and configuration flow table information of network switches at certain time intervals; by adopting a "bottom-up" intent extraction technology method, the network configuration is traced and extracted into the form of high-level intent. The bottom-up intent extraction technology alleviates the semantic deviation problem caused by changes in the network environment;

[0069] S103, compare the original intent backed up in S101 with the intent extracted in S102, and match the source IP address and destination IP address based on the connectivity intent. If all intents in the intent library can match the intent extracted in S102, it is considered that there is no semantic deviation between the high-level user intent and the underlying network configuration, and the intent has not deviated. If there is a situation in the intent library that cannot be matched with the extracted intent, the intent in the intent library will be marked as an invalid intent, indicating that the intent has drifted.

[0070] S104, for the invalid intent marked in S103, the "top-down" intent translation technology is re-adopted to install the invalid intent.

[0071] Glossary:

[0072] Network intent: Users declare their needs for network services and configurations through high-level natural language.

[0073] Flow table: In SDN (Software Defined Network), flow table is used to program switches to implement and execute user intent.

[0074] Intent translation: Convert network intent expressed in natural language into instructions or configurations that can be understood and executed by network devices.

[0075] Policy intent: After intent translation, the network intent defined in natural language is converted into specific policy configurations and network operations.

[0076] In S101, when the user declares a high-level network intention, the intention will be refined through a "top-down" intention translation technology; the transformation of the high-level intention to the network configuration is achieved through intention decomposition, intention verification and conflict resolution. In this process, the intention after decomposition, intention verification and conflict resolution is backed up and stored to facilitate subsequent "intention drift" detection.

[0077] The specific steps are:

[0078] Convert high-level user or application intents into specific system commands or policies, ensure that intents match system capabilities and limitations, and perform intent translation;

[0079] Perform intent verification to check whether the translated intent meets the system rules and matches the constraints of the underlying hardware;

[0080] Identify conflicts between intent and policies issued by the network; obtain intent by user declaration, store user policy intent, and provide bottom-up intent Figure 1 To provide a basis for verification, the bottom-up analysis method is used to analyze the network configuration file, and the high-level user intention is automatically extracted therefrom, and the extracted high-level intention is compared with the user's declared intention;

[0081] If verification finds that there is an inconsistency between the user's declared intent and the intent extracted by the underlying configuration, the proposed intent assurance framework will re-issue and install the intent to ensure the validity of the intent within its declaration cycle.

[0082] In the intent translation, the user declares the natural language service requirements to the framework through the application, usually in the form of text or voice.

[0083] During the top-down intent refinement and translation process, the intent verification module will automatically detect whether the translated intent meets the constraints of the underlying network and check whether it conflicts with the current network policy. If the underlying network cannot meet the user's intent, or the user's intent conflicts with the deployed network policy, the intent verification module will immediately send an error warning message to the user.

[0084] After the intent is verified, its record is backed up in the intent library before being sent down for subsequent consistency verification; the policy deployment configures the generated intent policy as a flow table, and sends it down to the programmable switch through the OpenFlow protocol to realize the specific execution of the intent.

[0085] In S102, by adopting a "bottom-up" intent extraction technology method, network topology information and configuration flow table information of network switches are periodically collected at certain time intervals, and the network configuration is traced and extracted in the form of high-level intent. The extracted intent includes two parallel components: configuration synthesis and situation characterization.

[0086] The configuration synthesis is used to extract all switch flow tables in the software-defined network switch and extract high-level intermediate representations from the configuration flow tables through a bottom-up approach, in preparation for extracting high-level user intent;

[0087] The situational characterization is used to capture and analyze the current state and environment of the system; it usually covers network switch nodes and their connection relationships, as well as real-time switch and link delays, packet loss rates, available bandwidth and other information, providing the necessary background information for bottom-up extraction of intent;

[0088] The high-level intermediate representation obtained by configuration synthesis is integrated with the current state and environment information of situation characterization to form a unified high-level intention representation graph that can represent the user's high-level intention;

[0089] The consistency of the extracted high-level intent representation graph and the original user intent in the intent library is ensured through consistency checking; by comparing the endpoint group information of the policy in the intent library with the endpoint group information of the extracted high-level intent representation graph, it is verified whether there is a semantic deviation in the underlying configuration of the intent, and inconsistent intents will be marked as invalid intents;

[0090] Based on the current situation characterization information, re-issue and deploy strategies for invalid intentions to optimize and correct the original user intentions with consistency deviations.

[0091] In S103, the source IP address and the destination IP address are matched based on the connectivity intent. If all the intents in the intent library can match the high-level intent extracted in S102, it is considered that there is no semantic deviation between the high-level user intent and the underlying network configuration, and the intent has not deviated. If there is a situation in the intent library that cannot be matched with the extracted high-level intent, the intent in the intent library will be marked as an invalid intent, indicating that the intent has drifted.

[0092] In S104, for the identified failure intention, an event-condition-action (ECA)-based mechanism is used to re-issue and install the flow table to ensure stable operation and performance optimization of the network. Figure 2 As shown in the figure, the overall architecture of a semantically-aware intent-driven network assurance method is presented. The architecture mainly includes the following processes and related components:

[0093] The key components of the "top-down" process of intent are:

[0094] Intent translation: Converts high-level user or application intent into specific system commands or policies to ensure that intent matches system capabilities and limitations.

[0095] Intent verification: Check whether the translated intent meets the system rules and matches the constraints of the underlying hardware to ensure its feasibility;

[0096] First, the intent verification module performs grammatical parsing on the intent input by the user to confirm that it complies with the defined grammatical rules, and identifies potential grammatical errors and incomplete expressions by analyzing the structure of the intent expression. Next, the intent verification module performs compliance checks on the translated intent to ensure that it complies with predefined system policies and constraints, such as security policies and quality of service (QoS) requirements. Subsequently, the resource availability check verifies whether the current network resources can meet the requirements of the intent, and evaluates the network's bandwidth, computing power, and storage resources to ensure that they are sufficient to support the requested operation. In addition, hardware compatibility verification ensures that the execution of the intent at the physical level is feasible, including checking the hardware capabilities, configuration limitations, and technical standards of the device.

[0097] Conflict resolution: Identify conflicts between translated intent and deployed network policies to maintain system stability and efficient operation and prevent problems such as network performance degradation or functional failure caused by new intent.

[0098] Identifying sources of potential conflicts can be done at multiple levels: first, resource conflicts, such as competition for shared resources such as bandwidth, storage, and computing power. If multiple intents request the same resources at the same time, it may lead to over-allocation of resources or performance degradation. Secondly, policy conflicts, for example, the network path required by an intent may be prohibited by the security policy of another intent. In this case, the priority and compatibility of the policies need to be evaluated by the conflict detection module. Time conflicts are also one of the important considerations. When multiple intents require execution in the same time period, the system needs to evaluate their execution order and possible delay effects.

[0099] Intent library: stores the user's translated intent, which is a bottom-up intent library. Figure 1 Provide basis for verification;

[0100] Policy deployment: Translate the verified intent into specific network policies and install them in the network; first, extract relevant configuration parameters from the translated intent, including target device ID, flow table items, QoS parameters, etc. These parameters are passed as input to the API request of the SDN controller. After receiving these API requests, the controller converts the policy instructions into configuration commands that the device can recognize and sends them to the specified network device through the southbound interface protocol (such as OpenFlow). On the device, these policies are installed as specific flow tables and configurations to ensure that network traffic is processed according to the expected rules. The policy deployment module monitors the results of the API call and verifies the correct installation of the policy. If necessary, it checks the device status and traffic data to confirm the effectiveness of the policy. In this way, the policy deployment module can dynamically configure and manage policies in the SDN network to quickly respond to network changes and user needs.

[0101] Repair strategy: When a semantic deviation is found between the user intent and the underlying configuration during bottom-up consistency verification, this framework will re-issue and install the strategy based on the intent type to ensure the validity of the intent.

[0102] The key processes in the "top-down" process of intention are:

[0103] Declare intent: Users declare their natural language service needs to the framework through applications, usually in the form of text or voice.

[0104] Feedback: During the top-down intent refinement process, if the translated intent does not meet the constraints of the underlying actual situation or conflicts with the existing intent, an error warning message will be fed back to the user.

[0105] Backup: After the user intent is translated and verified, it is backed up in the intent database before being sent for subsequent consistency verification. The database has high security.

[0106] Flow table delivery: Policy deployment configures the generated intent policy into a flow table and delivers it to the programmable switch through the OpenFlow protocol to implement the specific execution of the intent;

[0107] Key components in the bottom-up traceability process:

[0108] Configuration Synthesis: Extract all switch flow tables in a software-defined network switch and extract high-level intermediate representations from the configuration flow tables through a bottom-up approach, preparing for extracting high-level user intent.

[0109] Situational characterization: Capture and analyze the current state and environment of the system; this usually covers network switch nodes and their connection relationships, as well as real-time switch and link latency, packet loss rate, available bandwidth and other information, providing the necessary background information for bottom-up extraction of intent.

[0110] Semantic fusion: The high-level intermediate representation obtained by configuration synthesis is integrated with the current state and environment information of situation characterization to form a unified high-level intent representation graph that can represent the user's high-level intent.

[0111] Consistency check: Ensure the consistency between the extracted high-level intent representation graph and the original user intent in the intent library. By comparing the endpoint group information of the policy in the intent library with the endpoint group information of the extracted high-level intent representation graph, verify whether there is a semantic deviation in the underlying configuration of the intent. Inconsistent intents will be marked as invalid intents.

[0112] Repair strategy generation: Based on the current situation characterization information, re-issue and deploy strategies for failed intentions to optimize and correct the original user intentions with consistency deviations.

[0113] The key processes in the "bottom-up" tracing process of intent:

[0114] Situational awareness: The situational awareness module that runs in the background for configuration synthesis periodically requests updates to the latest information on network configuration policies and network topology through the application programming interface.

[0115] Semantic-aware policy generation: When the consistency check finds that the extracted intent is inconsistent with the intent stored in the intent library, the intent repair policy reasoning will be triggered. This process first analyzes the cause of the inconsistency, which may be due to semantic errors in the intent input by the user, invalid intent caused by changes in network status, or outdated intent version in the intent library. After identifying the problem, the system corrects the inconsistent intent through the policy reasoning mechanism, adjusting parameters, correcting syntax errors, or redefining the intent according to the latest network status and user needs. The corrected intent is rechecked and verified to ensure that it is consistent with other intents in the intent library. Figure 1 The system then generates a new network policy and sends it to the corresponding network devices through the SDN controller’s API interface, updates the flow table and adjusts the configuration to ensure that the device operates according to the revised intent.

[0116] Generate strategy: The generated repair strategy is passed to the internal business map module in the form of an internal business map through the API, and then the "top-down" steps are taken again to deploy it to achieve the recovery of the failure intention.

[0117] Repair: Based on the current situation description information, re-issue and deploy strategies for invalid intents, optimize and correct the original user intents with consistency deviations. The specified strategy will go through the top-down intent processing process again, including intent verification, conflict resolution, intent library backup, and strategy deployment.

[0118] Figure 3 The paper demonstrates the process of intent lifecycle assurance under the framework of a semantic-aware intent-driven network assurance method.

[0119] In this process, the user intent is defined t ∈I, I={i1,i2,...,i m}. The user first declares an intent t The intent is verified and backed up in the intent library through a top-down process, and then sent and deployed on the programmable switch through the southbound interface at time t. t The life cycle of is defined as the period from its declaration to the end of its life cycle, denoted as n. At time t+n, the intention i tThe life cycle ends. During this period, there is a parameter T, which represents the cycle of intent verification. The illustrated cycle T = 1, that is, the reverse high-level intent extraction is performed once every 1 second on the configuration flow table of the underlying switch. Therefore, for an intent with a life cycle of n, it will undergo n reverse high-level intent extractions during its declaration cycle.

[0120] The intent extracted by reverse engineering is expressed as in For each Both will be the same as the original i t Perform a consistency check on the endpoint group. If the check is consistent, then i t It is still valid at time k; if it is inconsistent, it is considered that intention i t Expired.

[0121] Once the intention is determined t If the network fails, the framework proposed in the patent will re-create the intended i based on the current network topology and nodes, as well as the link's latency, bandwidth, packet loss rate and other information. t The process of issuing and deploying is called intention repair strategy generation.

[0122] The generated repair strategy will be verified, backed up, and finally issued and deployed through the southbound interface again through a top-down process to ensure the validity and feasibility of the intent throughout its life cycle.

[0123] like Figure 4 As shown, the simulation experiment results of the technology proposed in the present invention after the intent-driven network suffered from intent drift are demonstrated. The experiment compares the intent framework of ONOS with the intent protection technology framework proposed in the present invention. During the experiment, an end-to-end video output service was established for each of the two intent-driven network frameworks. As shown in (a), before the intent drifted, the two experimental services were transmitted normally, and the transmission rate was about 45Gbits / s. As shown in (c), at the 38th second of the video transmission, the experiment injected a malicious flow table into the switch flow table by simulating a hijacking attack, causing the two video transmission intentions to drift. It can be found that after about 7 seconds, the video transmission service of the intent protection technology framework proposed in the present invention successfully detected the intent drift and issued a recovery strategy, and the user's video transmission service was restored. On the contrary, the intent under the intent framework of ONOS Figure 1 Once the intention drifts, the user's business cannot be restored.

[0124] This paper proposes a new comprehensive intent-driven network architecture, which aims to deeply understand and efficiently deploy network intent by integrating top-down intent translation and bottom-up network policy behavior analysis. This paper focuses on accurately capturing the underlying semantic information of the network, clarifying the natural language intent of network administrators, and reducing the semantic differences between the two through continuous verification. At the same time, an innovative method is introduced to dynamically characterize and maintain network intent to ensure the consistency and stability of intent throughout its life cycle.

[0125] The present invention combines intent translation technology with intent tracing technology and applies them in software-defined networks. An alternative solution is to migrate the ideas of the present invention to the traditional network architecture. By realizing top-down and bottom-up collaboration within the traditional network architecture, the function of the intent-driven network assurance technology proposed in the present invention can be simulated to a certain extent.

[0126] The present invention integrates top-down and bottom-up intent-driven network design architectures: This architecture integrates the top-down intent deployment process while also periodically performing bottom-up high-level intent extraction throughout the entire life cycle of the intent, effectively alleviating the semantic differences between high-level intent and underlying configuration. This design can not only detect and determine the actual situation of high-level intent in the underlying network configuration, but also provide network administrators with real-time intent failure warnings. The process design of the architecture and the innovation of key components constitute the core content of the present invention;

[0127] Analyzing network configuration files using the bottom-up method and automatically extracting high-level user intents therefrom, and comparing the extracted high-level intents with user-declared intents;

[0128] If verification finds that there is an inconsistency between the user's declared intent and the intent extracted by the underlying configuration, the proposed intent assurance framework will re-issue and install the intent to ensure the validity of the intent within its declaration cycle.

[0129] The present invention is based on the consistency verification mechanism of the high-level intent and the extracted intent of the endpoint group: Figure 1 During the consistency check, the present invention adopts a comparison method based on endpoint group information (such as the source and destination host MAC address or IP address) to determine whether there is a semantic deviation between the original intent in the intent library and the endpoint group information of the extracted intent. This mechanism provides an important means to ensure the accuracy and consistency of intent.

Claims

1. A semantically aware intent-driven network assurance method, characterized in that: The steps include: S101, during the intent translation process, the user's original intent is first verified and conflicts are resolved. Before and after the flow table is prepared to be issued, the processed intent is backed up in the intent library to ensure intent traceability; S102, using a bottom-up network intent extraction method to periodically extract network intent from network switches; S103, performing consistency comparison between the original intent backed up in S101 and the network intent extracted in S102 through consistency check, screening out intents that cannot be matched with any user intent, and determining them as invalid intents; S104, for the failure intent marked in S103, the "top-down" intent translation technology is re-adopted to install the failure intent.

2. According to claim 1, a semantically-aware intent-driven network assurance method is characterized in that: In the S101, The specific steps are: Convert the network intent declared by the user into specific system commands or policies, ensure that the intent matches the network capabilities and limitations, and perform intent translation; Perform intent verification to check whether the translated intent meets the system rules and matches the constraints of the underlying hardware; Identify conflicts between intent and the policies issued by the network; The user declares the intent and stores the network intent declared by the user, providing a basis for bottom-up intent consistency verification.

3. According to claim 2, a semantically-aware intent-driven network assurance method is characterized in that: In the intention translation, the user declares the natural language service requirements to the framework through the application, usually in the form of text or voice; During the top-down intent translation process, the intent verification module will automatically detect whether the translated intent meets the constraints of the underlying network and check whether it conflicts with the current network policy. If the underlying network conditions cannot meet the user's intent, or the user's intent conflicts with the deployed network policy, the intent verification module will immediately send an error warning message to the user. After the intent is verified, its record is backed up in the intent library before being sent down for subsequent consistency verification; the policy deployment configures the generated intent as a flow table and sends it down to the programmable switch through the OpenFlow protocol to realize the specific execution of the intent.

4. According to claim 1, a semantically-aware intent-driven network assurance method is characterized in that: In S102, by adopting a "bottom-up" intent extraction method, network topology information and configuration flow table information of network switches are periodically collected at certain time intervals, and the network configuration is traced and extracted in the form of high-level intent. The extracted intent includes two parallel components: configuration synthesis and situation characterization. The configuration synthesis is used to extract all switch flow tables in the software-defined network switch and extract high-level intermediate representations from the configuration flow tables through a bottom-up approach, in preparation for extracting high-level user intent; The situational characterization is used to capture and analyze the current state and environment of the system; it usually covers network switch nodes and their connection relationships, as well as real-time switch and link delay, packet loss rate, and available bandwidth information, providing necessary background information for bottom-up extraction of intent; The high-level intermediate representation obtained by configuration synthesis is integrated with the current state and environment information of situation characterization to form a unified high-level intention representation graph that can represent the user's high-level intention; Ensure the consistency of the extracted high-level intent representation graph with the original user intent in the intent library through consistency checking; By comparing the endpoint group information of the policy in the intent library with the endpoint group information of the extracted high-level intent representation graph, it is verified whether there is a semantic deviation in the underlying configuration of the intent. Inconsistent intents will be marked as invalid intents. Based on the current situation characterization information, re-issue and deploy strategies for invalid intentions to optimize and correct the original user intentions with consistency deviations.

5. According to claim 1, a semantically-aware intent-driven network assurance method is characterized in that: In S103, the source IP address and the destination IP address are matched based on the connectivity intent. If all the intents in the intent library can match the high-level intent extracted in S102, it is considered that there is no semantic deviation between the high-level user intent and the underlying network configuration, and the intent has not deviated. If there is a situation in the intent library that cannot be matched with the extracted high-level intent, the intent in the intent library will be marked as an invalid intent, indicating that the intent has drifted.

6. A semantically-aware intent-driven network assurance method according to claim 1, characterized in that: In S104, for the identified failure intention, an event-condition-action (ECA)-based mechanism is adopted to re-issue and install the flow table to ensure stable operation and performance optimization of the network.

7. An assurance framework for a semantically-aware intent-driven network assurance method according to any one of claims 1 to 6, characterized in that: It includes two parts: "top-down" intention and "bottom-up" intention; The "top-down" intention includes sequentially connected intention translation, intention verification, conflict resolution, intention library, strategy deployment, and repair strategy; The "bottom-up" intention includes configuration synthesis and situation characterization. The output ends of configuration synthesis and situation characterization are connected to the input end of semantic fusion, and semantic fusion is connected with consistency verification and repair strategy generation in turn.

8. The assurance framework of the semantically-aware intent-driven network assurance method according to claim 7, characterized in that: The intention is "top-down"; Intent translation: Converts high-level user or application intent into specific system commands or policies to ensure that intent matches system capabilities and limitations. Intent verification: Check whether the translated intent meets the system rules and matches the constraints of the underlying hardware to ensure its feasibility; Conflict resolution: Identify conflicts between the translated intent and the deployed network policies to maintain system stability and efficient operation and prevent network performance degradation or functional failure caused by new intent. Intent library: stores the translated user intents, providing a basis for bottom-up intent consistency verification; Policy deployment: convert the intent verified by intent into specific network policies and install them in the network; Repair strategy: When a semantic deviation is found between the user intent and the underlying configuration during bottom-up consistency verification, this framework will re-issue and install the strategy based on the intent type to ensure the validity of the intent.

9. The assurance framework of the semantically-aware intent-driven network assurance method according to claim 8, characterized in that: The intent verification is specifically as follows: First, the intent verification module parses the intent input by the user to confirm that it conforms to the defined grammatical rules and identifies potential grammatical errors and incomplete expressions by analyzing the structure of the intent expression. Next, the intent verification module performs compliance checks on the translated intent to ensure that it complies with the predefined system policies and constraints; Subsequently, the resource availability check verifies whether the current network resources can meet the requirements of the intent, evaluating the network’s bandwidth, computing power, and storage resources to ensure that they are sufficient to support the requested operation; In addition, hardware compatibility verification ensures that the intended execution is feasible at the physical level, including checking the device's hardware capabilities, configuration limitations, and technical standards; The strategy deployment is specifically as follows: First, relevant configuration parameters are extracted from the translated intent, including the target device ID, flow table items, and QoS parameters. These parameters are passed as input to the API request of the SDN controller. After receiving these API requests, the controller converts the policy instructions into configuration commands that can be recognized by the device and sends them to the specified network device through the southbound interface protocol (such as OpenFlow). On the device, these policies are installed as specific flow tables and configurations to ensure that network traffic is processed according to the expected rules; the policy deployment module monitors the results of API calls and verifies the correct installation of the policy. If necessary, it checks the device status and traffic data to confirm the effectiveness of the policy. In this way, the policy deployment module can dynamically configure and manage policies in the SDN network to quickly respond to network changes and user needs.

10. The assurance framework of the semantically-aware intent-driven network assurance method according to claim 7, characterized in that: Intent "bottom-up": Configuration synthesis: Extract all switch flow tables in a software-defined network switch and extract high-level intermediate representations from the configuration flow tables through a bottom-up approach, in preparation for extracting high-level user intent; Situational characterization: Capture and analyze the current state and environment of the system; this usually covers network switch nodes and their connection relationships, as well as real-time switch and link latency, packet loss rate, available bandwidth and other information, providing the necessary background information for bottom-up extraction of intent; Semantic fusion: The high-level intermediate representation obtained by configuration synthesis is integrated with the current state and environment information of situation description to form a unified high-level intention representation graph that can represent the user's high-level intention; Consistency check: Ensure the consistency between the extracted high-level intent representation graph and the original user intent in the intent library. By comparing the endpoint group information of the policy in the intent library with the endpoint group information of the extracted high-level intent representation graph, verify whether there is a semantic deviation in the underlying configuration of the intent. Inconsistent intents will be marked as invalid intents. Repair strategy generation: Based on the current situation characterization information, re-issue and deploy strategies for failed intentions to optimize and correct the original user intentions with consistency deviations.

Images