Automated firewall feedback from network traffic analysis

A device, comprising

• at least one processor;
• and
• a memory communicatively coupled to the at least one processor, wherein the memory stores instructions that, when executed by the at least one processor, cause the at least one processor to perform operations comprising:
• capturing network traffic data, the network traffic data comprising a plurality of traffic records;
• grouping traffic records selected from the plurality of traffic records, wherein the grouped traffic records comprise first and second traffic records comprising corresponding first and second source address identifiers, first and second source port identifiers, first and second destination address identifiers, and first and second destination port identifiers respectively;
• identifying first and second network interfaces associated with the first and second traffic records based on the first and second source address identifiers;
• associating first and second security rule populations corresponding to the first and second network interfaces;
• and
• determining a direction of network traffic comprising identifying an ingress node based on the first and second security rule populations.

A system comprising:

• a network traffic database that captures a plurality of network traffic records generated on a private cloud-based computer network;
• and
• a server, coupled to a processor, and configured to execute instructions that cause the server to perform operations comprising:
• grouping traffic records selected from the plurality of traffic records, wherein the grouped traffic records comprise first and second traffic records comprising corresponding first and second source address identifiers, first and second source port identifiers, first and second destination address identifiers, and first and second destination port identifiers respectively;
• identifying first and second network interfaces associated with the first and second traffic records based on the first and second source address identifiers;
• associating first and second security rule populations corresponding to the first and second network interfaces;
• and
• determining a direction of network traffic comprising identifying an ingress node based on the first and second security rule populations.