Creating graphical models of network security policies and displaying on a network topology graph

A system comprising:

• one or more processors;
• and
• one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform actions comprising:
• receiving, at a computing device, a first security policy for a first network device;
• processing, by the computing device, the first security policy to generate a plurality of first access control entries;
• creating, by the computing device, first graph nodes corresponding to the first access control entries;
• based at least in part on a processing order of the first security policy with respect to the first access control entries on the first network device, linking, by the computing device, the first graph nodes into a graph, wherein the graph includes a direction of flow of the access control entries within the first security policy;
• displaying, by the computing device on a display, the graph, wherein the graph is displayed as an overlay on a network topology graph that includes the first network device;
• and
• based on the graph displayed on the display, detecting an incongruence between the network topology and the first security policy, wherein the incongruence relates to a presence of a host within the network topology graph, and wherein the host is not supposed to be included within the network topology graph based on the first security policy.

One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by one or more processors, cause the one or more processors to perform actions comprising:

• receiving, at a computing device, a first security policy for a first network device;
• processing, by the computing device, the first security policy to generate a plurality of first access control entries;
• creating, by the computing device, first graph nodes corresponding to the first access control entries;
• based at least in part on a processing order of the first security policy with respect to the first access control entries on the first network device, linking, by the computing device, the first graph nodes into a graph, wherein the graph includes a direction of flow of the access control entries within the first security policy;
• displaying, by the computing device on a display, the graph, wherein the graph is displayed as an overlay on a network topology graph that includes the first network device;
• and
• based on the graph displayed on the display, detecting an incongruence between the network topology and the first security policy, wherein the incongruence relates to a presence of a host within the network topology graph, and wherein the host is not supposed to be included within the network topology graph based on the first security policy.