JoWUA

Abstract

Increasingly, existing cybersecurity infrastructures struggle against complex attacks like Advanced Persistent Threats (APTs), polymorphic malware, encrypted attacks, and zero-day attacks, rendering them ineffective against traditional signature-based and rule-based firewalls. This paper presents a new intelligent AI-based firewall architecture incorporating hybrid deep learning, explainable AI (XAI), federated learning (FL) and multi-agent reinforcement learning (MARL) to enable adaptive and private threat detection on mobile and interactive networks. An end-to-end CNN-LSTM-Autoencoder model was designed and implemented to learn the spatial and temporal characteristics of network traffic, effectively detecting the anomalous traffic patterns indicative of novel attacks. SHAP and LIME techniques were then adopted to produce transparent and interpretable security decisions and federated learning was utilized to enable secure, collaborative sharing of threat intelligence among different organizations without sharing confidential data. Multiple well-known benchmark datasets were used for performance evaluation along with a massive proprietary dataset, SRM-TFC-2024, consisting of 127 million records and spanning the classification and analysis of network flows across various traffic types and attacks, as well as the more established ones, CICIDS2017, UNSW-NB15, NSL-KDD, and CSE-CIC-IDS2018. The experimental results exhibited consistent and high detection rates on all datasets, with classification accuracies between 79% to 82%, precision varying from 87% to 92%, recall from 84% to 90%, F1-score from 85% to 90%, and the false positive rate remained very low between 1% and 3%. The rate of zero-day threat detection was 82% on bothCICIDS2017 and SRM-TFC-2024 datasets, indicating the high potential of the anomaly-based detection method, and the integrated end-to-end system, which consists of the architecture of CNN-LSTM-Autoencoder, federated learning, and Multi-Agent Reinforcement learning, is called QX-FedMARL. Through comparison, the QX-FedMARL firewall works best compared to other rules-based NGFWs. The comparative analysis showed that the QX-FedMARL firewall performs significantly better than the other rule-based NGFW, signature-based IDS, ML-based Firewall, and AI-NGFW architectures with classification precision of 92.0%, recall of 90.0% and the highest F1-score of 91.0% on the tested datasets. These findings suggest that the combined approach of deep learning, explainable AI, federated intelligence and adaptive reinforcement learning presents a robust, scalable, and transparent cybersecurity framework for next-generation intelligent, autonomous firewall systems.