A computer-implemented method when executed on data processing hardware causes the data processing hardware to perform operations for training a firewall utilization model, the operations comprising: receiving firewall utilization data for connection requests received by a firewall during a utilization period, the firewall utilization data including hit counts during the utilization period for each sub-rule of a set of sub-rules associated with at least one firewall rule; generating training data based on the firewall utilization data, the training data including unused sub-rules corresponding to sub-rules having no hits during the utilization period and hit sub-rules corresponding to sub-rules having more than zero hits during the utilization period; training the firewall utilization model on the training data; for each sub-rule of the set of sub-rules associated with the at least one firewall rule, determining, using the trained firewall utilization model, a corresponding sub-rule utilization probability indicating a likelihood the sub-rule will be used for a future connection request; determining firewall attribute groupings for the at least one firewall rule, each of firewall attribute groupings including at least one attribute; determining a first set of the sub-rules associated with the at least one firewall rule based on the firewall attribute groupings; receiving a plurality of firewall logs associated with connection requests received by the firewall during the utilization period; filtering the plurality of the firewall logs based on a filter criteria; determining a second set of sub-rules associated with the plurality of firewall logs; and generating the utilization data based on the first set of sub-rules and the second set of sub-rules. receiving firewall utilization data for connection requests received by a firewall during a utilization period, the firewall utilization data including hit counts during the utilization period for each sub-rule of a set of sub-rules associated with at least one firewall rule; generating training data based on the firewall utilization data, the training data including unused sub-rules corresponding to sub-rules having no hits during the utilization period and hit sub-rules corresponding to sub-rules having more than zero hits during the utilization period; training the firewall utilization model on the training data; for each sub-rule of the set of sub-rules associated with the at least one firewall rule, determining, using the trained firewall utilization model, a corresponding sub-rule utilization probability indicating a likelihood the sub-rule will be used for a future connection request; determining firewall attribute groupings for the at least one firewall rule, each of firewall attribute groupings including at least one attribute; determining a first set of the sub-rules associated with the at least one firewall rule based on the firewall attribute groupings; receiving a plurality of firewall logs associated with connection requests received by the firewall during the utilization period; filtering the plurality of the firewall logs based on a filter criteria; determining a second set of sub-rules associated with the plurality of firewall logs; and generating the utilization data based on the first set of sub-rules and the second set of sub-rules.