Artificial Intelligence in Next-Generation Firewalls for Discriminating Cyber Attacks from Legitimate Service Traffic Surges
DOI:
https://doi.org/10.54878/9bv6m266Keywords:
next-generation firewall, artificial intelligence, DDoS detection, flash crowd, service traffic surge, intrusion prevention, deep learning, software defined networking, false-positive control, traffic discriminationAbstract
Next-generation firewalls (NGFWs) sit on the critical path between public networks and production services. Their most consequential error is no longer a missed signature; it is the inability to tell a malicious flood from a genuine surge in legitimate demand. Flash crowds, seasonal campaigns, media-driven spikes, and elastic microservice fan-out can resemble distributed denial-of-service (DDoS) traffic in volume while remaining economically and operationally valid. Static access-control lists, fixed rate limits, and signature catalogs therefore produce an unacceptable trade-off: either they under-block stealthy application-layer attacks or they over-block paying users. This article reviews, compares, and synthesizes peer-reviewed evidence from 2020 onward on machine-learning and deep-learning methods that can be embedded in NGFW and software-defined enforcement points to discriminate attacks from legitimate service-intensity bursts. We organize the literature into statistical filters, classical classifiers, representation-learning hybrids, sequential models, and two-tier designs that first cheaply detect a burst and then classify its intent. Published detectors regularly report accuracy above 98% on CICDDoS2019 and related traces, yet most benchmarks omit a dedicated flash-event class, which inflates apparent performance and leaves the operationally hardest decision under-tested. Building on that gap, we propose AID-NGFW, a three-tier architecture that couples entropy and cumulative-sum screening with a calibrated three-class discriminator (benign, flash crowd, attack) and a policy engine that drops malicious flows while scaling or shaping legitimate surges. Comparative tables and figures compile reported accuracies, F1-scores, datasets, and latency–accuracy trade-offs. We argue that the scientific and engineering priority is no longer binary attack detection in isolation, but reliable, low-latency, and explainable discrimination under encrypted traffic, class imbalance, concept drift, and adversarial mimicry.
References
Aljuhani, A. (2021). Machine learning approaches for combating distributed denial of service attacks in modern networking environments. IEEE Access, 9, 42236–42264. https://doi.org/10.1109/ACCESS.2021.3062909
Cisco. (2020). Cisco annual Internet report (2018–2023) white paper. Cisco Systems. https://www.cisco.com/c/en/us/solutions/collateral/executive-perspectives/annual-internet-report/white-paper-c11-741490.html
Cloudflare. (2025, January 21). DDoS threat report for 2024 Q4. The Cloudflare Blog. https://blog.cloudflare.com/ddos-threat-report-for-2024-q4/
Liang, J., & Kim, Y. (2022). Evolution of firewalls: Toward securer network using next generation firewall. In 2022 IEEE 12th Annual Computing and Communication Workshop and Conference (CCWC) (pp. 752–759). IEEE. https://doi.org/10.1109/CCWC54503.2022.9720435
Balarajah, B., Rossenhoevel, C., & Monkman, B. (2023). Benchmarking methodology for network security device performance (RFC 9411). RFC Editor. https://doi.org/10.17487/RFC9411
Ahmad, Z., Khan, A. S., Shiang, C. W., Abdullah, J., & Ahmad, F. (2021). Network intrusion detection system: A systematic study of machine learning and deep learning approaches. Transactions on Emerging Telecommunications Technologies, 32(1), e4150. https://doi.org/10.1002/ett.4150
Kilincer, I. F., Ertam, F., & Sengur, A. (2021). Machine learning methods for cyber security intrusion detection: Datasets and comparative study. Computer Networks, 188, 107840. https://doi.org/10.1016/j.comnet.2021.107840
David, J., & Thomas, C. (2021). Discriminating flash crowds from DDoS attacks using efficient thresholding algorithm. Journal of Parallel and Distributed Computing, 152, 79–87. https://doi.org/10.1016/j.jpdc.2021.02.019
Mittal, M., Kumar, K., & Behal, S. (2023). Deep learning approaches for detecting DDoS attacks: A systematic review. Soft Computing, 27(18), 13039–13075. https://doi.org/10.1007/s00500-021-06608-1
Yungaicela-Naula, N. M., Vargas-Rosales, C., & Pérez-Díaz, J. A. (2021). SDN-based architecture for transport and application layer DDoS attack detection by using machine and deep learning. IEEE Access, 9, 108495–108512. https://doi.org/10.1109/ACCESS.2021.3101650
Wei, Y., Jang-Jaccard, J., Sabrina, F., Singh, A., Xu, W., & Camtepe, S. (2021). AE-MLP: A hybrid deep learning approach for DDoS detection and classification. IEEE Access, 9, 146810–146821. https://doi.org/10.1109/ACCESS.2021.3123791
Cil, A. E., Yildiz, K., & Buldu, A. (2021). Detection of DDoS attacks with feed forward based deep neural network model. Expert Systems with Applications, 169, 114520. https://doi.org/10.1016/j.eswa.2020.114520
Ahuja, N., Singal, G., Mukhopadhyay, D., & Kumar, N. (2021). Automated DDOS attack detection in software defined networking. Journal of Network and Computer Applications, 187, 103108. https://doi.org/10.1016/j.jnca.2021.103108
Sahoo, K. S., Tripathy, B. K., Naik, K., Ramasubbareddy, S., Balusamy, B., Khari, M., & Burgos, D. (2020). An evolutionary SVM model for DDOS attack detection in software defined networks. IEEE Access, 8, 132502–132513. https://doi.org/10.1109/ACCESS.2020.3009733
Elsayed, M. S., Le-Khac, N.-A., Dev, S., & Jurcut, A. D. (2020). DDoSNet: A deep-learning model for detecting network attacks. In 2020 IEEE 21st International Symposium on “A World of Wireless, Mobile and Multimedia Networks” (WoWMoM) (pp. 391–396). IEEE. https://doi.org/10.1109/WoWMoM49955.2020.00072
Assis, M. V. O., Carvalho, L. F., Lloret, J., & Proença, M. L., Jr. (2021). A GRU deep learning system against attacks in software defined networks. Journal of Network and Computer Applications, 177, 102942. https://doi.org/10.1016/j.jnca.2020.102942
Gadallah, W. G., Ibrahim, H. M., & Omar, N. M. (2024). A deep learning technique to detect distributed denial of service attacks in software-defined networks. Computers & Security, 137, 103588. https://doi.org/10.1016/j.cose.2023.103588
Ouhssini, M., Afdel, K., Agherrabi, E., Akouhar, M., & Abarda, A. (2024). DeepDefend: A comprehensive framework for DDoS attack detection and prevention in cloud computing. Journal of King Saud University - Computer and Information Sciences, 36(2), 101938. https://doi.org/10.1016/j.jksuci.2024.101938
Ismail, Mohmand, M. I., Hussain, H., Khan, A. A., Ullah, U., & Zakarya, M. (2022). A machine learning-based classification and prediction technique for DDoS attacks. IEEE Access, 10, 21443–21454. https://doi.org/10.1109/ACCESS.2022.3152577
Ferrag, M. A., Friha, O., Maglaras, L., Janicke, H., & Shu, L. (2021). Federated deep learning for cyber security in the Internet of Things: Concepts, applications, and experimental analysis. IEEE Access, 9, 138509–138542. https://doi.org/10.1109/ACCESS.2021.3118642
Rajper, A., Paraman, N. B., Marsono, M. N., & Rajper, N. J. (2024). iCuSMAT-DT: A two-tier detection mechanism for high-rate DDoS attacks and discriminating benign flash traffic in software-defined networks. In 2024 International Conference on Smart Applications, Communications and Networking (SmartNets) (pp. 1–8). IEEE. https://doi.org/10.1109/SmartNets61466.2024.10577729
Tinubu, C. O., Sodiya, A. S., Ojesanmi, O. A., Adeleke, E. O., & Adebowale, A. (2022). DT-Model: A classification model for distributed denial of service attacks and flash events. International Journal of Information Technology, 14(6), 3077–3087. https://doi.org/10.1007/s41870-022-00946-5
Devi, N. N., & Singh, K. J. (2025). Detecting and differentiating the DDoS and flash events using adaptive deep learning models. Applied Soft Computing, 171, 112669. https://doi.org/10.1016/j.asoc.2024.112669
Bharathi, N. A., Parthasarathi, R., & Vetriselvi, V. (2024). Deep learning based bursty traffic discrimination and management using sandpile model. Journal of Scientific & Industrial Research, 83(10), 1075–1085. https://doi.org/10.56042/jsir.v83i10.4981
European Union Agency for Cybersecurity. (2023). ENISA threat landscape 2023. ENISA. https://www.enisa.europa.eu/publications/enisa-threat-landscape-2023
Shieh, C.-S., Lin, W.-W., Nguyen, T.-T., Chen, C.-H., Horng, M.-F., & Miu, D. (2021). Detection of unknown DDoS attacks with deep learning and Gaussian mixture model. Applied Sciences, 11(11), 5213. https://doi.org/10.3390/app11115213
Cloudflare. (2026). 2025 Q4 DDoS threat report: A record-setting 31.4 Tbps attack. The Cloudflare Blog. https://blog.cloudflare.com/ddos-threat-report-2025-q4/
NETSCOUT. (2025). NETSCOUT DDoS threat intelligence report. NETSCOUT Systems. https://www.netscout.com/threatreport/
