Skip to main content

LUP Student Papers

LUND UNIVERSITY LIBRARIES

Investigation on reinforcement learning for dynamic firewall configuration and its effect on edge devices

Gustavsson, Erik LU and Lundstedt, Ludwig (2026) EITM01 20261
Department of Electrical and Information Technology
Abstract
Cybersecurity has never been more relevant than it is today, as attacks become
increasingly sophisticated. To keep devices safe from threats, a new type of smart
firewall has become an active area of research. This type of firewall can dynami-
cally configure itself based on incoming network traffic using reinforcement learn-
ing. This research has shown promising results; however, its impact on resource
usage on edge devices with limited hardware resources has not been properly in-
vestigated. In this thesis, we will investigate how different reinforcement learning
models (DQN, Double DQN, Dueling DQN, and 3DQN) and levels of complexity
affect the performance of smart firewalls when deployed on edge devices. The re-
sults... (More)
Cybersecurity has never been more relevant than it is today, as attacks become
increasingly sophisticated. To keep devices safe from threats, a new type of smart
firewall has become an active area of research. This type of firewall can dynami-
cally configure itself based on incoming network traffic using reinforcement learn-
ing. This research has shown promising results; however, its impact on resource
usage on edge devices with limited hardware resources has not been properly in-
vestigated. In this thesis, we will investigate how different reinforcement learning
models (DQN, Double DQN, Dueling DQN, and 3DQN) and levels of complexity
affect the performance of smart firewalls when deployed on edge devices. The re-
sults indicate that models with 10k-50k parameters achieve the optimal trade-off
between F1 score, memory usage, and inference time. (Less)
Popular Abstract
In today’s world, the number of electronic devices used in homes, companies, and
society continues to grow. As a result, potential opportunities for cyberattacks
are also increasing.
Furthermore, as cybersecurity evolves to protect individuals from attacks, the
attackers find new ways to bypass these protections, resulting in a constantly
shifting landscape. This, combined with the growing number of attack entry points
as more electronic devices are added, creates a fast-moving, complex environment.
These connected electronic devices, commonly known as Internet of Things
(IoT) devices, are primarily protected by firewalls, rules within the devices that
decide what traffic is allowed or blocked. Some of these IoT devices are... (More)
In today’s world, the number of electronic devices used in homes, companies, and
society continues to grow. As a result, potential opportunities for cyberattacks
are also increasing.
Furthermore, as cybersecurity evolves to protect individuals from attacks, the
attackers find new ways to bypass these protections, resulting in a constantly
shifting landscape. This, combined with the growing number of attack entry points
as more electronic devices are added, creates a fast-moving, complex environment.
These connected electronic devices, commonly known as Internet of Things
(IoT) devices, are primarily protected by firewalls, rules within the devices that
decide what traffic is allowed or blocked. Some of these IoT devices are referred
to as edge devices, meaning devices where data is either created or processed.
Continuously updating firewall rules on such devices is challenging, especially since
different networks carry different traffic, and rules vary across networks and within
devices.
To address this, researchers have introduced a smart firewall that learns from
analyzing local network traffic and automatically adjusts firewall rules as needed.
However, research on this topic is new and non-standardized, making it difficult to
compare progress across studies. These smart firewalls also use machine learning
to make decisions, a rapidly evolving field where new techniques are continually
emerging but have yet to be applied in this context.
This work will therefore implement both established and emerging techniques
and evaluate them in terms of memory usage, inference time, and firewall accuracy.
The goal is to provide a benchmark to guide future research in the field and to
indicate which implementation is most suitable for system needs. (Less)
Please use this url to cite or link to this publication:
author
Gustavsson, Erik LU and Lundstedt, Ludwig
supervisor
organization
course
EITM01 20261
year
type
H2 - Master's Degree (Two Years)
subject
report number
LU/LTH-EIT 2026-1131
language
English
id
9232806
date added to LUP
2026-06-09 13:52:55
date last changed
2026-06-09 13:52:55
@misc{9232806,
  abstract     = {{Cybersecurity has never been more relevant than it is today, as attacks become
increasingly sophisticated. To keep devices safe from threats, a new type of smart
firewall has become an active area of research. This type of firewall can dynami-
cally configure itself based on incoming network traffic using reinforcement learn-
ing. This research has shown promising results; however, its impact on resource
usage on edge devices with limited hardware resources has not been properly in-
vestigated. In this thesis, we will investigate how different reinforcement learning
models (DQN, Double DQN, Dueling DQN, and 3DQN) and levels of complexity
affect the performance of smart firewalls when deployed on edge devices. The re-
sults indicate that models with 10k-50k parameters achieve the optimal trade-off
between F1 score, memory usage, and inference time.}},
  author       = {{Gustavsson, Erik and Lundstedt, Ludwig}},
  language     = {{eng}},
  note         = {{Student Paper}},
  title        = {{Investigation on reinforcement learning for dynamic firewall configuration and its effect on edge devices}},
  year         = {{2026}},
}