REINFENSE: semantic intent violation detection and mitigation in intent-driven industrial software-defined networks

Intent-Based Networking (IBN) enables policy-driven automation in industrial Software-Defined Networks (ISDNs), yet introduces a critical security challenge: network behavior may remain statistically normal while violating the semantic meaning of declared operator intents. Such violations are not captured by conventional SDN defenses that rely on anomaly detection or static rule enforcement. This paper presents REINFENSE, an edge-enabled neurosymbolic framework for real-time detection and mitigation of semantic intent violations in industrial SDNs. REINFENSE integrates graph-based traffic learning, symbolic intent validation, and episodic memory context to identify inconsistencies between intended policy semantics and observed behavior. A tri-modal reasoning engine computes an adaptive semantic deviation score to distinguish malicious violations from benign operational drift, and generates intent-consistent mitigation policies through reinforcement-based optimization while preserving Quality-of-Service constraints. SHAP-based and memory-guided explanations further enhance interpretability. Evaluation on Edge-IIoTset, controlled violation scenarios, and live SDN emulation achieved 96.66% accuracy, 0.979 weighted F1, 0.94 macro F1, 0.974 AUC, and 12.4 ms detection delay, demonstrating the effectiveness of REINFENSE for semantic security enforcement in intent-driven industrial edge networks.