Network security analysis for smart appliances

A non-transitory computer-readable storage medium storing executable computer instructions that, when executed by a hardware processor, cause the hardware processor to perform steps comprising:

• receiving network traffic data from a network traffic hub within a local network, the network traffic hub configured to aggregate intercepted network traffic;
• receiving identification data from the network traffic hub identifying a smart appliance on the local network and identifying a current internet address for the smart appliance on the local network;
• computing, for the smart appliance, a score comprising a numeric confidence value representing a probability that the smart appliance is performing a malicious behavior and based on historic network traffic data and identification data associated with a different smart appliance performing malicious behavior;
• when it is determined that the numeric confidence value exceeds a first threshold, blocking subsequent network traffic being sent by or to the smart appliance and sending a notification to a user;
• when it is determined that the numeric confidence value is less than the first threshold but greater than a second threshold, adding the smart appliance to a security watchlist and alerting an operator associated with the network traffic hub of the smart appliance and/or the computed score.

A system comprising:

• a non-transitory computer-readable storage medium storing executable instructions that, when executed, cause the system to perform steps comprising:
• receiving network traffic data from a network traffic hub within a local network, the network traffic hub configured to aggregate intercepted network traffic;
• receiving identification data from the network traffic hub identifying a smart appliance on the local network and identifying a current internet address for the smart appliance on the local network;
• computing, for the smart appliance, a score comprising a numeric confidence value representing a probability that the smart appliance is performing a malicious behavior and based on historic network traffic data and identification data associated with a different smart appliance performing malicious behavior;
• when it is determined that the numeric confidence value exceeds a first threshold, blocking subsequent network traffic being sent by or to the smart appliance and sending a notification to a user;
• when it is determined that the numeric confidence value is less than the first threshold but greater than a second threshold, adding the smart appliance to a security watchlist and alerting an operator associated with the network traffic hub of the smart appliance and/or the computed score;
• and
• a processor configured to execute the instructions.