PaperlayerView exact revision on arXiv

Source-linked AI summary

On Identifying Adversarial Intent Injection in AI-Native 6G Networks

Nilesh Chakraborty, Petar Djukic, Burak Kantarci

arXiv:2609.12144v1cs.NIcs.CRcs.LG

TL;DR

Malicious intents can be disguised within benign IBN traffic, and their distribution and timing create a context-based detection problem. The paper models four injection strategies and proposes TF-IDF-based supervised CNN and benign-only AutoEncoder paths. The CNN reports average recall of 0.89 and F1-score of 0.93, while the AutoEncoder reports average recall of 0.87 and F1-score of 0.89 for increasing and decreasing injection strategies.

  • Problem

    Malicious intents can mimic legitimate configurations, while the paper identifies temporal distribution patterns as an underexplored cue for detecting intent injections.

    Source: §I · p. 1

  • Method

    The framework models four injection strategies and uses TF-IDF sequences with a supervised CNN and a one-class AutoEncoder trained on benign samples.

    Source: §I · pp. 1–2

  • Results

    The CNN reports average recall 0.89 and F1-score 0.93 across scenarios; the AutoEncoder reports average recall 0.87 and F1-score 0.89 against increasing and decreasing injection strategies.

    Source: §V · p. 6

  • Takeaways & Limitations

    The reported comparison favors sequence-aware, context-based modeling over the single-intent classification approach used by DIET.

    Source: C. Comparative Results · p. 6

    The authors plan to extend the dataset with more diverse and nuanced JSON-based policy configurations to better reflect real-world IBN environments.

    Source: §V · p. 6

Abstract

from arXiv · show

AI-native 6G networks have brought Intent-Based Networking (IBN) to the forefront, enabling high-level goals to be translated into network configurations. However, this abstraction opens new attack surfaces, primarily adversarial intent injection, where malicious policies are disguised within benign intent flows. The detection of attack instances might become significantly more difficult if the adversaries adopt a stealthy mode of malicious intent injection. With all these in mind, we first define a fine-grained threat model that facilitates the threat of malicious intent injection in an AI-native network. Alongside, we investigate four malicious intent injection strategies$-$ stealth-mode, random distribution, increasing frequency, and decreasing frequency- and propose a dual-path detection framework: (i) a CNN using TF-IDF features for supervised malicious intent detection, and (ii) an AutoEncoder trained exclusively on benign data for one-class malicious intent detection. Our evaluation demonstrates strong detection performance, with accuracy improving to 0.97 (~9\% gain) and F1-score to 0.98 (~36\% gain) over the state-of-the-art baseline.

I. Introduction

The paper frames adversarial intent injection as a security risk in automated IBN, where malicious configurations can mimic legitimate intents. It proposes modeling temporal injection patterns and detecting them with complementary supervised and one-class models.

I. Introduction

  • An attacker can submit a look-alike intent that interferes with legitimate flow rules, then withdraw it and leave the original intent functionally ineffective in the data plane.The paper notes that undetected attacks may lead to misconfigurations or more sophisticated cyberattacks.Source: §I · p. 1
  • The threat model treats malicious intents as injections into benign traffic with varying frequency patterns, including stealth-mode and gradual changes in activity.The authors identify distribution and timing across intent sequences as contextual cues for malicious behavior.Source: §I · p. 1
  • The proposed threat model targets the IBN intent acquisition stage and covers stealth, random, decreasing-frequency, and increasing-frequency injection strategies.The paper describes frequency as an explicitly modeled practical threat dimension.Source: §I · p. 1
  • The dual-path framework combines TF-IDF features with a supervised CNN and a one-class AutoEncoder trained only on benign intent sequences.Both models use sliding windows to represent temporal context and detect localized, correlated manipulations.Source: §I · p. 2
  • The benign-trained AutoEncoder exceeds 0.85 accuracy and F1-score in most scenarios, while the supervised CNN exceeds 0.95 for both metrics in several cases.The AutoEncoder is reported as effective for detecting previously unseen threat patterns.Source: §I · p. 2

II. Background and Related Work

This section introduces the threat model and frames related work as a way to identify gaps in security for intent-driven network automation. The model centers on malicious intents injected through vulnerable APIs and distinguishes four temporal patterns.

II. Background and Related Work

  • The section establishes the proposed threat model and reviews related work to identify existing gaps.The threat model focuses on the intent acquisition stage of the IBN pipeline.Source: §II · p. 2

A. Threat Model

  • An attacker using a compromised API key can inject malicious intents that resemble routine updates and may enable denial of service, privilege escalation, traffic redirection, or persistent backdoors.The model considers exploitation of the intent ingestion layer or vulnerable APIs in JSON- or TOSCA-based IBN systems.Source: A. Threat Model · p. 2, Figure 1 · p. 2
  • The threat model distinguishes stealth injection with a fixed-rate Poisson arrival, increasing and decreasing rates, and uniform random placement across the stream.These strategies add a temporal dimension to intent injection.Source: A. Threat Model · p. 2

B. Related work

Prior work has explored IBN security and malicious-intent detection, but the cited rule-based approach analyzes intents statically. This paper positions context and injection distribution as cues for detecting temporal attack behavior.

B. Related work

  • The cited rule-based detector classifies out-of-scope intents as malicious but does not model temporal variation or stealthy injection strategies.The related-work discussion also identifies limited prior exploration of security risks in intent-driven automation.Source: B. Related work · p. 2
  • The paper varies injection strategies across datasets while holding intent content fixed, using the sequence and spacing of malicious samples to capture behaviors such as stealthy probing and bursty attacks.The authors position this as among the first context-based approaches to malicious-intent detection.Source: B. Related work · p. 2

III. Methodology

The methodology detects malicious intent injections from sequences and their distribution patterns rather than from individual intents alone. It uses TF-IDF features with supervised CNN classification and one-class AutoEncoder reconstruction.

III. Methodology

  • The framework analyzes intent sequences and distribution patterns to capture adversarial behavior that may not be observable at the individual-intent level.The two complementary paths use TF-IDF-based features for supervised CNN classification and one-class AutoEncoder reconstruction.Source: §III · pp. 2–3
  • TF-IDF preserves distinctions among discrete policy actions, whereas dense embeddings such as Word2Vec may blur operationally different terms.The text gives ALLOW, BYPASS, and ENFORCE as examples of distinct actions.Source: §III · p. 3
  • A 1D CNN is used with sliding windows to detect short-range dependencies, with weight sharing and architectural simplicity presented as advantages under limited data.The paper contrasts this design with LSTMs, which target longer dependencies and are described as more parameter-complex and prone to overfitting in that setting.Source: §III · p. 3
  • The Conv1D AutoEncoder learns benign-flow temporal structure from TF-IDF sequences and flags deviations through reconstruction error.The approach is designed to capture localized sequential dependencies rather than treat samples independently.Source: §III · p. 3

A. Supervised Model

The supervised pipeline converts intents into TF-IDF features, groups them into contextual windows, and trains a 1D CNN with imbalance-aware loss and inference thresholding.

A. Supervised Model

  • Intent streams are converted to TF-IDF vectors, grouped in six-intent sliding windows, and labeled malicious when any intent in a window is malicious.The data is split 75%/25% using random seed 41.Source: A. Supervised Model · p. 3
  • Class weights emphasize the minority class, while focal loss focuses training on hard-to-classify samples.The focal-loss formulation uses the predicted probability for the true class, a class-weighting factor, and a focusing parameter.Source: A. Supervised Model · p. 3
  • A 1D CNN is optimized to detect temporal patterns in short intent sequences, and an elevated inference threshold is used to reduce false positives.The pipeline evaluates accuracy, precision, recall, and F1-score.Source: A. Supervised Model · p. 3

B. One-class learning Model

The one-class model reconstructs intent windows from a compact representation and flags windows whose reconstruction error exceeds a benign-data threshold; the evaluation compares experiments with prior findings.

B. One-class learning Model

  • The AutoEncoder uses an encoder-decoder architecture, extracting localized semantic-temporal patterns and reconstructing each input window.A compact latent representation captures salient features; inference flags windows exceeding a high-percentile reconstruction-loss threshold derived from benign windows.Source: B. One-class learning Model · p. 3
  • Windows whose mean absolute reconstruction error exceeds a high-percentile threshold from benign windows are flagged as potential malicious injections.The model is trained exclusively on benign sequences.Source: B. One-class learning Model · p. 3

IV. Performance Evaluation

  • The performance evaluation presents experiments on the intent dataset and compares findings with the closely related work reported in.The authors describe as the only existing work closely related to their contribution, to the best of their knowledge.Source: §IV · p. 3

A. Dataset Introduction

The dataset combines benign and malicious intents with varied attack transformations and label noise, while characterizing injection spacing and testing whether keywords alone distinguish malicious samples.

A. Dataset Introduction

  • 1,100 intents comprise 250 malicious and 850 benign records, with malicious samples generated under four adversarial conditions.The dataset is partially assisted by a pre-trained LLM and is described as comparable in scale to the proprietary 755-intent dataset in.Source: A. Dataset Introduction · p. 3
  • The t-SNE visualization shows benign and malicious samples across datasets for 1,095 windows of size six, with temporal dependencies affecting training and testing.Benign samples are blue (#B) and malicious samples red (#M).Source: Figure 2 · p. 4
  • 20 manually verified base intents are expanded into nine variants each, using protocol- and operation-level transformations that preserve attack objectives while altering configuration attributes.Examples span DoS, phishing, malware deployment, data exfiltration, and unauthorized access; transformations include evasive routing and logging behaviors.Source: A. Dataset Introduction · p. 4
  • 40 malicious intents are relabeled benign and 90 benign intents malicious to introduce contextual ambiguity and require models to rely on semantic reasoning rather than surface patterns.The final dataset contains 250 malicious and 850 benign intents.Source: A. Dataset Introduction · p. 4
  • 0.79 accuracy and 0.10 recall: a classifier using only strong keywords has low recall, indicating explicit keywords are insufficient for reliable detection.The rule-based classifier also reports 0.96 precision and 0.18 F1-score on the full dataset.Source: A. Dataset Introduction · p. 4
  • λ measures the mean number of intervening benign intents; estimated rates are approximately 3.40 for stealth, 3.41 for random, 1.08 for decreasing-frequency, and 3.01 for increasing-frequency injection.Stealth, random, and increasing-frequency strategies have similar, relatively sparse spacing, whereas decreasing-frequency injection is significantly denser.Source: A. Dataset Introduction · pp. 4–5

B. Evaluation Results

Detection recall varies by injection strategy: increasing-frequency injection has the highest recall for both models, while stealth-mode injection is most difficult for the AutoEncoder. Larger sequence windows improve accuracy and F1-score for both models.

B. Evaluation Results

  • Increasing sequence-window size improves accuracy and F1-score for both supervised and one-class models.The sliding-window size ranges from 1 to 6, and sequences are labeled malicious when they contain at least one malicious intent.Source: B. Evaluation Results · p. 5
  • The supervised detector applies a 1D CNN to TF-IDF intent sequences, while the one-class detector reconstructs benign sequences and flags losses above the 85th percentile.TF-IDF features include semantic tokens and numeric fields; the CNN uses a 0.7 prediction threshold to reduce false positives.Source: B. Evaluation Results · p. 5
  • Recall reaches 0.96 (CNN) and 0.98 (AutoEncoder) under increasing-frequency injection, while stealth-mode recall is lowest for the AutoEncoder at 0.66.CNN recall is lowest under random injection, at 0.76.Source: B. Evaluation Results · p. 5

C. Comparative Results

Both proposed models outperform DIET, particularly on recall and F1-score. The CNN leads F1-score in stealth and decreasing-frequency settings, while the AutoEncoder leads recall in three distributions.

C. Comparative Results

  • Fig. 3 tracks accuracy and F1-score against window size across four distributions; Table I lists top-eight TF-IDF terms and weights for three representative intents.Source: Figure 3 · p. 5, Table I · p. 6
  • The CNN achieves the highest F1-score under stealth and decreasing-frequency settings, with near-best performance in the other cases.The AutoEncoder achieves the highest recall under random, increasing-frequency, and decreasing-frequency settings.Source: C. Comparative Results · pp. 5–6
  • Both proposed models outperform DIET, particularly in recall and F1-score; DIET recall remains 0.49–0.60.Table II compares the models across four malicious-intent distributions and reports accuracy, precision, recall, and F1-score.Source: C. Comparative Results · p. 5, Table II · p. 6
  • The benign-trained AutoEncoder achieves the highest recall under random, increasing-frequency, and decreasing-frequency settings.The paper interprets this as evidence that sequence-based anomaly detection can capture deviations from benign intent-flow patterns without malicious training examples.Source: C. Comparative Results · p. 6
  • The results favor sequence-aware, context-based modeling over DIET’s single-intent classification approach.The comparison is reported across four malicious-intent distributions.Source: C. Comparative Results · p. 6

V. Conclusion and Future Work

The paper models intent-acquisition attacks across four malicious-intent distributions and proposes supervised CNN and one-class AutoEncoder detection. The CNN performs consistently across scenarios, while future work targets broader policy configurations and interpretability.

V. Conclusion and Future Work

  • The work targets the IBN intent-acquisition stage with a dataset covering four attack distributions and a dual-path CNN and AutoEncoder framework.Source: §V · p. 6
  • CNN averages recall 0.89 and F1-score 0.93 across scenarios; the AutoEncoder averages recall 0.87 and F1-score 0.89 and is particularly effective against increasing- and decreasing-frequency strategies.Source: §V · p. 6
  • Future work will add more diverse JSON-based policy configurations and use explainable AI to improve interpretability.The stated aim is to better reflect real-world IBN environments and increase transparency and trust in detection decisions.Source: §V · p. 6
Loading 2609.12144v1…