Adaptive Firewall System with Dynamic Rules Generation for Network Security

Abstract

Cyber threats are constantly changing and developing, so organizations need to be able to keep up with those changes with security measures that are not limited to static firewalls. This paper presents an adaptive firewall framework that uses machine learning (ML) and deep learning (DL) methods for the creation of dynamic rules and the ability to detect intrusions in real time. Network traffic features are first normalized using Z-score normalization to provide a stable model. Feature selection is accomplished through Recursive Feature Elimination (RFE) and dimensionality reduction is performed using Principal Component Analysis (PCA) to maintain low computation cost while minimizing the loss of information. For classification, the hybrid model consists of Random Forest and Long Short-Term Memory (LSTM) Algorithms; the Random Forest classifier provides an initial identification of a complex, non-linear relationship, while the LSTM algorithm exploits the temporal characteristics of network traffic to identify sequences of attacks that are changing over time. As a result of the use of this hybrid model, both known and zero-day attacks can be detected without difficulty and the adaptive firewall framework will continue to generate new/enhanced rules while adapting to new threats based on ongoing feedback. Experimental results indicate that the adaptive firewall framework produces a high rate of detection, low rates of false positives, and significantly greater adaptability than traditional firewall systems. These results confirm that using statistical pre-processing, feature optimization and hybrid learning models will provide the basis for the development of next generation adaptive firewall systems.