A computer-implemented method when executed on data processing hardware causes the data processing hardware to perform operations for training a firewall utilization model , the operations comprising: receiving firewall utilization data for connection requests received by a firewall during a utilization period, the firewall utilization data including hit counts during the utilization period for each sub-rule of a set of sub-rules associated with at least one firewall rule ; generating training data based on the firewall utilization data , the training data including unused sub-rules corresponding to sub-rules having no hits during the utilization period and hit sub-rules corresponding to sub-rules having more than zero hits during the utilization period; training the firewall utilization model on the training data ; for each sub-rule of the set of sub-rules associated with the at least one firewall rule , determining , using the trained firewall utilization model , a corresponding sub-rule utilization probability indicating a likelihood the sub-rule will be used for a future connection request ; determining firewall attribute groupings for the at least one firewall rule , each of firewall attribute groupings including at least one attribute ; determining a first set of the sub-rules associated with the at least one firewall rule based on the firewall attribute groupings ; receiving a plurality of firewall logs associated with connection requests received by the firewall during the utilization period; filtering the plurality of the firewall logs based on a filter criteria ; determining a second set of sub-rules associated with the plurality of firewall logs ; and generating the utilization data based on the first set of sub-rules and the second set of sub-rules . receiving firewall utilization data for connection requests received by a firewall during a utilization period, the firewall utilization data including hit counts during the utilization period for each sub-rule of a set of sub-rules associated with at least one firewall rule ; generating training data based on the firewall utilization data , the training data including unused sub-rules corresponding to sub-rules having no hits during the utilization period and hit sub-rules corresponding to sub-rules having more than zero hits during the utilization period; training the firewall utilization model on the training data ; for each sub-rule of the set of sub-rules associated with the at least one firewall rule , determining , using the trained firewall utilization model , a corresponding sub-rule utilization probability indicating a likelihood the sub-rule will be used for a future connection request ; determining firewall attribute groupings for the at least one firewall rule , each of firewall attribute groupings including at least one attribute ; determining a first set of the sub-rules associated with the at least one firewall rule based on the firewall attribute groupings ; receiving a plurality of firewall logs associated with connection requests received by the firewall during the utilization period; filtering the plurality of the firewall logs based on a filter criteria ; determining a second set of sub-rules associated with the plurality of firewall logs ; and generating the utilization data based on the first set of sub-rules and the second set of sub-rules . <EOS>