System and method for determining flow specification efficacy

A network monitoring device, comprising:

• one or more databases storing external network data exported from a plurality of external network devices coupled to an external network aimed at a protected network;
• a processor disposed between the external network and the protected network in communication with memory configured to store instructions, wherein the processor upon execution of the instructions is configured to:
• receive, via a first user interface, a first query of the one or more databases storing the external network data;
• retrieve the stored external network data from the one or more databases in response to receipt of the first query;
• apply one or more flow specification rules to the retrieved stored external network data, wherein the one or more flow specification rules are configured to perform one or more flow specification actions on the retrieved stored external network data, wherein each of the one or more flow specification actions corresponds to performing, on the stored external network data, dropping, rate-limiting, traffic accepting, or passing of network traffic;
• find a match of one of the one or more flow specification rules using a matching criteria;
• determine network traffic activity corresponding to the matched one of the one or more flow specification rules;
• identify data from the determined network traffic activity that is respectively dropped, limited, passed or accepted based on the flow specification actions corresponding to the matched one or more flow specification rules;
• and
• generating, by the network monitoring device based on the identified data, a user interface comprising a plurality of lists of ports of external network devices, each list corresponding to a different flow specification action and comprising a plurality of ports of external network devices ordered based on an amount of network traffic impacted by the flow specification action of the list.