—Firewall log classification is important to monitor network traffic. Most firewall log classification via machine learning has shown good result by network -related features and classifier s. However, feature with many dimensions take a lot of time to do classification. In this paper, we applied a method of feature selection using optimized bee swarm optimization with reinforcement learning . We evaluate d average performance by accuracy, macro -averaged precision, macro -averaged recall, and macro -averaged F1 score in 5-stratified folds using a random fores t, k-nearest neighbor , and naï ve bayes classifier . As a results, it could be applied for an automatic firewall log analysis system. Keywords —bee swarm optimization, reinforcement learning I. INTRODUCTION Firewalls of computers are used to ensure that the network is functioning properly and safely. In particular, as the security of personal information [1] becomes more important and robust, it needs to be conscious to protect networks. Firewall logs are key evidence to identify intruder attacks, including insider and outsider threats [2]. In addition to the existing traditional classification methods, with the development of machine learning and deep learning, a study on log classification and intrusion prev ention using it has been conducted [3 –8]. Log analysis and intrusion detection defense should attempt to classify efficiently with fewer parameters for quick response. At this time, the number of features used for classification or regression is based on the researcher's experience. For this reason, research is also being conducted to intensively select the optimal feature and parameter via information gain, and genetic algorithms, and reinforcement learning [9–12]. In this paperi, we performed optimal feature search using the optimized bee swarm optimization algorithm along with reinforcement learning [12, 15]. II. EXPERIMENT A. Data acquisition We used Internet Firewall Data Data Set [1 3] in UCI Machine Learning Repository. The data have 11 features and 4 labels. Total data points are 65532. Data profile and feature information are shown in Table 1 and Table 2. Four label is allow, deny, drop, reset -both, respectively. Table 1: Profile of Dataset Name Data point s Allow 37640 Deny 14987 Drop 12851 Reset -both 54 Total 66532 Table 2: Feature information Name bytes bytes received bytes sent destination port elapsed time NAT destination port packets packets received NAT source port packets sent source port B. Methods 1. Bee swarm optimization algorithm bee swarm optimization algorithm (BSO ) is an algorithm that is inspired by the social behavior of bees. Each bee is an object working together to solve the optimization problem, and they search for the fitness function using a feature combination in iterations. The fitness function of this res earch is set to average accuracy. 2. Reinfor cement learning Reinforcement learning (RL) r efers to an algorithm in which an agent defined in the environment recognizes the current state and finds an action that maximizes the reward among actions. The RL algorithm applied in this paper is Q - learning [14]. Local search and experience of bee replace Q - learning. In this process, the reward is given differently depending on the accuracy of the current and next states. The reward -setting condition is shown Table 3. Table 3: Reward -setting condition Condition Reward if the next state accuracy is higher than the current state next state accuracy if the current state accuracy is high next state accuracy - current state accuracy if the number of features in the current state is greater than the number of features in the next state 1/4 * next state accuracy if the number of features in the current state is less than the number of features in the next state -1/4 *next state accuracy As a result, the agent tries to get the best accuracy while getting fewer features. Moreover, to reduce the space in the search space, we applied the XOR operation on the best solution and the current state solution . 3. Classifier In this paper, We compared performance using several classifier ; random fores t (RF) , k-nearest neighbor (KNN) , and naï ve baye s (Bernoull i NB). III. HYPER -PARAMETER SETTING Table 4 shows the hyper -parameters applied to this experiment. Table 4: Hyper -parameter list s Name Parameter Description Flip 5 To calculate Search Region space Max Chance 3 Number of chances to escape local minima Number of Bee 3 Worker to solve Max iteration 3 Number of total iteration Local iteration 2 Number of iteration in local search alpha 0.8 Learning rate of reinforcement learning gamma 0.3 Discount factor of reinforcement learning epsilon 0.05 Probability of doing random actions The machine learning classifier was used python library called scikit -learn (version 0.24.2 ). hyper -parameter of classifier was used default parameter. IV. RESULT The optimal combination list of features in training set selected by the feature selection method is shown Table 5. Table 5: Optimal feature lists Classifiers Optimal f eature combination list s RF Destination port NAT Source Port NAT Destination Port Bytes Bytes Received Packets Elapsed Time Packets sent Packets received KNN Destination Port NAT Destination Port Bytes Bytes Sent Packets Elapsed Time Bernoull i NB Source Port Bytes Bytes Sent Elapsed Time Packets received And we evaluate accuracy performance each classifier. Table 6 show the best accuracy among combination lists each classifiers. Table 6: Best accuracy (%) Classifiers Best accuracy among combinat ion list s RF 99.87 KNN 99.78 Bernoull i NB 80.22 And we measure random forest performance by average accuracy and average macro -averaged precision (Macro - precision), average macro -averaged recall (Macro -recall), average macro -averaged F1 (Macro -F1) score. We compared the optimal selected feature results with the case of applying all features using random forest . The results are shown in Table 7. Table 7: Comparing all and optimal feature s using RF (%) Feature selected Average Accuracy Macro - precision Macro - recall Macro - F1 All 99.80 93.06 81.71 84.22 Optimal 99.87 96.62 88.73 91.27 V. CONCLUSION In this paper, we classified firewall logs using optimal feature via BSO with reinforcement learning feature selection method. The results of using optimal features outperformed using all features and it could be applied to a firewall log analysis .