1. A method comprising: obtaining, at a device, packet data descriptive of authorized traffic of a network; generating, at the device, rule elements based on the packet data; determining, at the device, a first distance measure based on a comparison of a first rule element of the rule elements and a second rule element of the rule elements, wherein the first distance measure corresponds to a numerical distance between at least one of internet protocol addresses or media access control addresses; generating a consolidated rule element by combining the first rule element and the second rule element based on the comparison; and generating, at the device, firewall filter rules for the network based on the consolidated rule element.