Researchers from the University of Ottawa and Nokia Bell Labs have identified a new class of threat, termed adversarial intent injection, targeting AI-native 6G networks that utilize intent-based networking (IBN). This attack vector exploits the abstraction inherent in IBN systems, where operators define desired outcomes and software translates these into network policies. The researchers demonstrated that malicious instructions can be hidden among legitimate ones, posing a significant risk to future network architectures.
Intent-based networking relies on machine-readable requests, often in JSON format, which are then converted into network policies. The primary entry point for an adversarial intent injection attack is a compromised API key, allowing an attacker to submit malicious intents disguised as routine updates. Potential consequences include denial of service, privilege escalation, traffic redirection, and the creation of backdoors within the network.
To evaluate this threat, the research team constructed a dataset of 1,100 intents, partially generated with the assistance of a large language model. This dataset included 20 base attack intents, covering scenarios like phishing and data exfiltration, each with nine variants. An example variant involved transforming a rule that drops traffic with logging enabled into one that null-routes traffic with limited logging. To introduce ambiguity, 40 malicious intents were relabeled as benign, and 90 benign intents were relabeled as malicious.
A simple rule-based classifier, built with 88 terms identified as strong discriminators, was used as a baseline. This classifier detected approximately 10% of malicious intents across the full dataset, although 96% of the intents it flagged were indeed malicious. This suggests that simple keyword detection is insufficient for comprehensive protection.
The researchers developed two machine learning detectors designed to identify malicious intent injections by analyzing the sequence and timing of requests. They created four versions of their data, varying the arrival patterns of malicious intents: fixed average pace, random scattering, speeding up over time, and slowing down. The detectors analyze short sequences of up to six consecutive requests, flagging runs that are likely to contain malicious activity for human review.
The first detector, trained on labeled examples of safe and malicious activity, achieved detection rates between 75% and 96% of runs containing malicious requests, depending on the attack pattern. The second detector, which learns only from normal activity and flags deviations, performed best across three of the four attack patterns. However, it struggled with fixed-pace attacks, missing approximately one-third of those runs. Both detectors outperformed an earlier method that evaluated requests individually, which detected roughly 50% to 60% of malicious cases across the four patterns.
Future work planned by the team includes incorporating more diverse JSON policy configurations to better reflect real-world IBN deployments. They also intend to use explainable-AI methods to make the detection decisions of their systems more transparent and interpretable for network operators.
