Optimizing the ordering of packet-filtering firewalls is crucial to ensure high packet classification efficiency. In this perspective, the literature has investigated the problem either in a static or batch fashion, by estimating traffic statistics and then computing a new rule ordering offline or on demand, or through dynamic approaches following an estimate-and-optimize paradigm and relying on ad-hoc heuristics based on hand-crafted metrics and tuning choices. Therefore, there is a need for novel algorithms that can learn adaptive rule prioritization strategies directly from experience, possibly in a separate environment from the one responsible for decision making. To this aim, this paper presents TwinWall, a digital-twin-based firewall architecture in which a digital optimizer uses reinforcement learning to derive adaptive rule orderings based on the observed traffic, and periodically exports them to the real firewall. In this way, TwinWall reframes the rule-ordering problem as a continuous learning process, where prioritization emerges directly from traffic interaction rather than from predefined optimization algorithms. A prototype implementation of TwinWall was developed and validated on three datasets with different traffic characteristics, including two real packet traces and one synthetic workload generated with the ClassBench benchmarking tools. The obtained results show that the proposed approach can significantly reduce both the number of rule checks and the corresponding packet processing time, and that it outperforms static and frequency-based baseline strategies.
Machine learning, particularly deep learning, has become a prominent approach to network intrusion detection because it can learn patterns from network traffic and adapt to evolving threats. However, most existing Intrusion Detection Systems (IDS) approaches address only one side of the problem: they either classify known attacks from labeled data or detect previously unseen attacks through anomaly detection. In operational network environments, both capabilities are required within a single adaptive system.To address this limitation, we propose a hybrid IDS that combines supervised and unsupervised models in a calibration-aware ensemble designed to detect both known attacks and attack classes absent from the training data. The main contribution of this work is a calibration and decision fusion pipeline that aligns the outputs of heterogeneous models and integrates them into a unified detection decision.Experiments conducted using two benchmark datasets, CIC-IDS2017 and BoT-IoT, across different experimental settings, show that the proposed ensemble is capable of both detecting previously unseen attacks and performing multiclass classification of known attacks, while maintaining comparable multiclass performance despite the increased task complexity. It also improves binary detection performance, indicating that the hybrid design successfully exploits the complementary strengths of supervised classification and unsupervised anomaly detection.
Network Intrusion Detection and Prevention Systems (NIDPSs) play a crucial role in identifying and blocking malicious traffic. In-kernel NIDPSs leveraging extended Berkeley Packet Filter (eBPF) have achieved high detection performance and throughput by operating directly in kernel space. However, eBPF-based NIDPSs face portability challenges across diverse runtime environments, limiting their deployment on kernel-bypassing frameworks such as AF_XDP and the Data Plane Development Kit (DPDK). In this paper, we propose a userspace BPF (uBPF)-based NIDPS empowered by machine learning (ML) algorithms and integrate it with kernel-bypassing frameworks to achieve portability across diverse runtime environments while accurately and efficiently detecting and preventing Distributed Denial of Service (DDoS) attacks. We evaluate the proposed NIDPSs from both DDoS detection performance and packet processing performance perspectives. Evaluation results demonstrate that the proposed NIDPS achieves high classification performance for DDoS detection, while enabling the same uBPF-based detection logic to operate across different packet processing frameworks. Moreover, the uBPF-based NIDPSs running on the DPDK data plane achieve packet processing rates 3.38–8.60× higher than the evaluated in-kernel NIDPS implementations.
