Artificial Intelligence in Next-Generation Firewalls for Discriminating Cyber Attacks from Legitimate Service Traffic Surges

Abstract

Next-generation firewalls (NGFWs) sit on the critical path between public networks and production services. Their most consequential error is no longer a missed signature; it is the inability to tell a malicious flood from a genuine surge in legitimate demand. Flash crowds, seasonal campaigns, media-driven spikes, and elastic microservice fan-out can resemble distributed denial-of-service (DDoS) traffic in volume while remaining economically and operationally valid. Static access-control lists, fixed rate limits, and signature catalogs therefore produce an unacceptable trade-off: either they under-block stealthy application-layer attacks or they over-block paying users. This article reviews, compares, and synthesizes peer-reviewed evidence from 2020 onward on machine-learning and deep-learning methods that can be embedded in NGFW and software-defined enforcement points to discriminate attacks from legitimate service-intensity bursts. We organize the literature into statistical filters, classical classifiers, representation-learning hybrids, sequential models, and two-tier designs that first cheaply detect a burst and then classify its intent. Published detectors regularly report accuracy above 98% on CICDDoS2019 and related traces, yet most benchmarks omit a dedicated flash-event class, which inflates apparent performance and leaves the operationally hardest decision under-tested. Building on that gap, we propose AID-NGFW, a three-tier architecture that couples entropy and cumulative-sum screening with a calibrated three-class discriminator (benign, flash crowd, attack) and a policy engine that drops malicious flows while scaling or shaping legitimate surges. Comparative tables and figures compile reported accuracies, F1-scores, datasets, and latency–accuracy trade-offs. We argue that the scientific and engineering priority is no longer binary attack detection in isolation, but reliable, low-latency, and explainable discrimination under encrypted traffic, class imbalance, concept drift, and adversarial mimicry.