APPLYING AIOPS TECHNIQUES TO ANALYZE HIGH HIT COUNT FIREWALL RULES FOR IMPROVED NETWORK SECURITY MONITORING

Enterprise firewalls produce millions of log records each day. Manual analysis of thefirewall rule activity is more difficult, time consuming and ineffective to detect abnormalnetwork behaviour. Current firewall management solutions typically produce reports ofhit counts for individual rules, but have little capacity to differentiate between legitimatebusiness activity and potentially suspicious activity, or to predict future firewall behaviour.The research proposes an Artificial Intelligence for IT Operations (AIOps) basedframework for analysis of high hit-count firewall rules for improving network securitymonitoring. The objectives of this research were to identify iconic historical firewalldatasets, to classify firewall traffic based on rule-based criteria, to detect anomalousfirewall activities using the Isolation Forest algorithm, to predict subsequent firewall ruleactivity using ARIMA/SARIMA time-series models, and to develop an interactive KeyPerformance Indicator (KPI) dashboard that can assist firewall administrators inoperational decision-making.The research adopted a quantitative case study approach using production firewalllogs collected from a Palo Alto Next-Generation Firewall deployed within theDemilitarized Zone (DMZ) of XYZ Bank's enterprise network. Historical firewall logscovering a six-month period were analysed to identify representative peak trafficconditions before applying data preprocessing using Pandas and NumPy, anomalydetection using Scikit-learn, and forecasting using Statsmodels. It was implemented inPython and visualized in a dashboard built on Stream lit. Experimental resultsdemonstrated that the proposed framework successfully automated firewall log analysisand provided meaningful operational insights.The Isolation Forest model achieved an accuracy of 60%, a precision of 94%, arecall of 5% and an F1-score of 9% indicating a high precision in identifying suspiciousIIIfirewall traffic while taking a conservative approach to anomaly detection. The ARIMAforecasting model had a Mean Absolute Error (MAE) of 7,336.67 and a Root MeanSquare Error (RMSE) of 8,303.02. This proved that predictive analytics can beincorporated into enterprise firewall monitoring even with a short period of observationfor forecasting.In summary, the proposed AIOps framework successfully integrates datapreprocessing, anomaly detection, traffic forecasting and dashboard visualisation into aunified solution that enhances firewall monitoring, enables proactive network securitymanagement and provides a practical foundation for future intelligent cybersecurityoperations.