1. A method comprising: obtaining, at a device, packet data descriptive of authorized traffic of a network; generating, at the device, rule elements based on the packet data; consolidating, at the device, at least some of the rule elements based on distance measures associated with the rule elements; and generating, at the device, firewall filter rules for the network based on the consolidated rule elements.