Threat notifications and remedies for home networks

A method of operation of a gateway, comprising:

• monitoring network traffic of a network on the gateway to identify a security threat;
• receiving a notification that the network traffic indicates the security threat to the network, the notification identifies an IP address associated with the security threat;
• analyzing the security threat using a threat intelligence platform containing a collection of information related to known security threats;
• selecting a mitigation procedure for the security threat according to the threat intelligence platform;
• initiating a security response associated with a security policy, the security response being scoped to traffic associated with the identified IP address by applying the security policy to network traffic having the identified IP address as a source address and a destination address, the security response including the mitigation procedure, wherein the mitigation procedure prevents further activity by the security threat by blocking the identified IP address;
• and
• outputting the notification associated with the security response to a device.

A gateway device, comprising:

• a processing system that includes processor circuitry and memory circuitry that stores code, the processing system configured to cause the gateway device to:
• monitor network traffic of a network on the gateway device to identify a security threat;
• receive a notification that the network traffic indicates the security threat to the network, the notification identifying an IP address associated with the security threat;
• analyze the security threat using a threat intelligence platform containing a collection of information related to known security threats;
• select a mitigation procedure for the security threat according to the threat intelligence platform;
• initiate a security response associated with a security policy, the security response being scoped to traffic associated with the identified IP address by applying the security policy to network traffic having the identified IP address as a source address and a destination address, the security response including the mitigation procedure, wherein the mitigation procedure prevents further activity by the security threat by blocking the identified IP address;
• and
• output the notification associated with the security response to a device;
• wherein the notification includes a description of the security threat and a mitigation procedure associated with the security threat.