A Segment-Aware Trust-Calibrated Intelligent Firewall for Adaptive Detection and Containment of Unseen Network Attacks

Intelligent firewalls often use fixed detection thresholds without considering the security requirements of different network segments. This study proposes SegTrust-FW, an adaptive firewall that combines signature matching, Random Forest, and Isolation Forest with segment-specific false-positive budgets and trust-based device admission. Using the official NSL-KDD dataset and 30 independent runs, the proposed framework achieved an F1-score of 0.937 and detected 93.2% of previously unseen attack types at a 5% false-positive budget. Threshold calibration contributed substantially to the performance improvement, while segmentation reduced the potential reach of a compromised host. Hash-chained device admission also detected all 600 simulated tampering attempts. The results demonstrate the potential of combining adaptive detection, device trust, and network segmentation for improved protection against emerging attacks. All evaluations were benchmark- and simulation-based.